Five things that improve security and cost nothing

A conversation about security in a small company usually starts with “what should we buy”. That is the wrong order. Almost always the biggest improvement comes from tidying up what the company already has — and that needs no budget, only decisions and a few hours.

Below are five things in order of impact. All of them can be done with tools you already pay for.

1. Removing local administrator rights

The single biggest difference available without spending money. A clicked attachment on an ordinary account damages one person’s files; the same attachment on an account with administrator rights can disable protection and move on across the network.

I have described this separately because the subject has traps of its own — the most important being to prepare a separate administrative account before you take anything away.

2. Multi-factor authentication, starting with privileged accounts

MFA is included in every serious office suite. The problem is not that it is missing — it is that it is not switched on.

Do not start with everyone. The order that works:

1. administrative accounts — all of them, no exceptions, today,
2. management and finance — the most frequent target of targeted attacks,
3. access from outside the company network,
4. everyone else.

Point one needs no discussion with the team. There are a handful of administrative accounts and you manage them.

Settle in advance what happens when somebody loses their phone — without that answer, the first such case ends with MFA being switched off for the whole company in a panic, which is back to square one.

3. Closing accounts after people leave

In every environment I look at for the first time there is at least one active account belonging to somebody who has left. Usually more.

This is not about bad intentions on their part — it is that such an account has no owner who would notice something happening to it. Nobody checks whether anyone logs in. Nobody changes the password. Nobody reports that odd mail is arriving there.

A good moment to write the short “what we close when somebody leaves” list: domain account, mail, cloud services, VPN, SSH keys, repository access, door card, mail forwarding to whoever takes over. Written once, it serves for years.

4. Backups outside the server they cover

A backup sitting on the same server as the data, or on a permanently mounted network drive, protects against neither of the two most common scenarios: encryption by ransomware and hardware failure.

The rule worth checking at home: does a copy exist that cannot be reached from a compromised machine. If the answer is no, the backup protects against deleting a file by mistake — a completely different risk from the one you have in mind.

The second question matters more than the first: when did anyone last try to restore anything from it. Without that it is not a backup, only a folder with that name.

5. A password manager instead of a spreadsheet and chat messages

Administrative passwords circulating in messages and spreadsheets are not a matter of sloppiness but of having no alternative — access has to be handed over now, not next week.

A password manager solves three things at once: handing over access without sending a password in plain text, revoking access without changing the password for everyone, and knowing who has what.

Remember the part usually skipped at rollout: a password sent once is a password burned. Introducing a manager without rotating what previously travelled in the clear is a job half done.

What is deliberately not on this list

Phishing awareness training. Not because it is worthless — because it is far less effective than it is sold as, and it replaces none of the points above. A person who is going to click will click despite the training; the question is what happens then, and that depends on points 1 and 4.

Password changes every thirty days. That practice has been out of the guidance for years, because forcing frequent changes produces weaker passwords written on paper.

A security policy as a document. A policy that cannot be enforced is worse than none, because it creates the illusion of control. Working settings first, then a description of what works.

How long this takes

Points 2, 3 and 5 are realistically one day of work in a small company. Point 1 spreads over a few weeks, because the team needs time to adjust. Point 4 depends on what is already there — anywhere from an hour to a project of its own.

Only after that is it worth talking about purchases. Before it, every tool runs in an environment that is not ready for it and delivers less than it promises.