⛨Security in everyday work

These three, in this order:

1. Activate two-factor sign-in wherever it is available — starting with the mailbox. It prevents by far the most common incident: an account taken over via an intercepted password.
2. Introduce a password manager. That puts an end to reusing passwords, which is the second most common cause.
3. Check backups — not whether they run, but whether a restore works. An untested backup is a hope.

Everything else is important but secondary. These three cover most of the cases that actually affect small businesses.

Time required for all three: one afternoon.

Long and unique — that is all it takes, and everything else is outdated.

What applies:

• Length beats complexity. Four random words are better than “P@ssw0rd!”.
• A separate one for every service. That is the only rule that really counts: if one service is hacked, everything else goes with it otherwise.
• No regular changes without a reason. That has been disproved for years — it leads to “Summer2024” becoming “Summer2025”.

What you should not do: save passwords in the browser without securing it. And no notes stuck to the screen.

The only practical way to remember all this: you remember none of them. That is what the password manager is for — one password for it, all the others inside it.

A program that stores all passwords in encrypted form. You remember one, it remembers the rest, and it generates new ones that nobody can guess.

Yes, you need one. Without it, one of three things inevitably happens: the same passwords everywhere, passwords on slips of paper, or passwords in a file called “Passwords.xlsx”.

What to look out for:

• For the business, not just private use. There must be shared areas — the access details for the domain should not belong to just one person.
• Emergency access. If the person with the master password is unavailable, someone must be able to get in.
• Two-factor for the manager itself.

What to put in it: everything. Especially the things that are rarely needed — domain management, registrar, hosting provider. Those are exactly what you search for in an emergency.

A second proof in addition to the password — usually a numeric code from an app on your phone.

Why it is so effective: a stolen password alone is of no use to the attacker. That defuses phishing, data leaks at other services and guessed passwords in one go.

Where first:

1. Mailbox. The most important account of all — all others can be reset through it.
2. Domain management.
3. Password manager.
4. Bank and payment services.
5. Everything else.

With what: an app on your phone. SMS is better than nothing, but vulnerable.

And set up recovery codes and file them away. A lost phone without codes locks you out of your own mailbox.

By a combination — a single feature is rarely enough:

• Pressure and deadline. “Your account will be blocked in 24 hours.” Genuine providers rarely set such short deadlines.
• A link whose target does not fit. Hover over it with the mouse without clicking — the actual address appears at the bottom.
• A sender address that is almost right. One letter swapped, a different ending.
• Unexpected attachment, especially with extensions such as .zip, .exe, .html.
• Salutation without a name, where there usually is one.
• Unusual transaction: an invoice you are not expecting; a payment change from a known supplier.

The last point is the most dangerous: invoice fraud with changed bank details. Whenever an account number changes: call — on the number you know, not the one in the email.

With a simple rule: only open what you were expecting.

And if you are unsure:

• Do not open it in the preview pane, but ask the sender — by phone.
• Pay attention to the extension. Executable files and archives are dangerous: .exe, .scr, .js, .zip, .iso. Also a document with macros.
• Do not enable macros. If a document asks you to, it is almost always malware.

What you should not do: forward a suspicious attachment to a colleague “to be safe” so they can take a look. That spreads it.

If something has happened: disconnect the device from the network, report it, do not carry on working. And do not wait until it “sorts itself out”.

Four things, all of them set up once:

1. Disk encryption. Built into current systems and activated in ten minutes. It decides whether a lost device is a data breach or just a nuisance.
2. Screen lock with a short delay — even in your own office.
3. Current updates. Automatic, not “when there is time”.
4. Set up remote locking, where available.

For private devices used for work, there is an additional arrangement: what happens when someone leaves, who may delete what? That should be settled in writing before the case arises.

And the practical classic: do not leave an unprotected device in the car. Most lost laptops are ones stolen from vehicles.

The same as in the office, plus three points:

• No third-party Wi-Fi unless necessary. If in doubt, use your phone as a hotspot. Public networks in cafés and hotels are not suitable for anything confidential.
• Screen not visible to others — not even family members. Customer data is no business of anyone in the household.
• Paper. Printouts with customer data do not belong in the household rubbish.

What is not necessary: a special security product. The connection to Aurora Hive Sales is encrypted; that is enough for the normal case.

And the organisational point that is often missing: anyone working from home should know whom to call in the event of an incident. At home, there is nobody in the next room to ask.

Three properties — and the third is almost always missing:

1. Regular. Automatic, not by hand.
2. Separate. A backup connected to the same network gets encrypted along with everything else in a ransomware attack. At least one copy must be offline or in a different place.
3. Tested. A backup from which nothing has ever been restored is an assumption.

The test is simpler than it sounds: once a year, restore one file or record and look at it. Twenty minutes.

And what is often forgotten: cloud services need backups too. An accidentally deleted folder is gone there too — the deletion is synchronised as well.

As few as possible, at least two.

The reason for “at least two” is not security but availability: anyone who has only one administrator has a problem when that person is on holiday or leaves.

The reason for “as few as possible”: every additional full access is another way to do something big by accident, and another account that can be taken over.

In practice, for a business with ten people, this means: two administrators, the rest with the role that suits their work.

One more rule that is broken most often: an account belongs to one person. Shared accounts make any traceability impossible, and in a dispute that is exactly the information that counts.

Measures that cost effort and achieve nothing — or do harm:

• Regular password changes without a reason. Lead to predictable patterns. Change when there is a suspicion, otherwise not.
• Complexity rules (“at least one special character”). Produce “P@ssw0rd!” instead of length.
• Password lists in encrypted Excel files. The protection is weak, the handling poor.
• Security questions such as your mother’s maiden name. Usually researchable in public sources.
• Extensive policies that nobody reads. One page that gets read beats twenty that get filed away.

What works instead are the three points from the beginning: two-factor, password manager, tested backups. The rest is fine-tuning.

Not with an annual training session, but with three habits:

• Reporting is welcome and has no consequences. Anyone who clicked a wrong link and reports it has done the right thing. Anyone who gets into trouble for it will not report it next time — and that is the expensive case.
• Show real examples. A phishing email that actually came in, looked at together, has more effect than any presentation.
• One rule per quarter. Not twelve at once. This time: always check changes to bank details by phone. Next time: something else.

What does not work: fear. Anyone who believes every click is dangerous either stops clicking altogether or gets used to ignoring the warning.

And the most important thing: lead by example. Anyone who passes on their own password cannot enforce any rule.

Four things, and before the work starts:

1. A separate account, time-limited, with the smallest suitable role.
2. Data processing agreement (AVV), if personal data is involved.
3. Who at the service provider has access? A contract with an agency does not mean that only your contact person looks inside.
4. What happens at the end? Switch off accounts, delete data, return access details — that belongs in the contract, not in the final email.

That leaves the point that saves the most trouble: the domain belongs to you. Check whom it is registered to. A domain registered to the service provider is theirs in a dispute.

Revoke accounts on the day the contract ends, not when you happen to think of it again.