Tag Archive for: breach prevention

Bottom Line: You don't need new tools to lower risk. Start with three moves—reduce what's exposed online, turn on stronger sign-in, and patch known problems first. This guide shows exactly what to do and who should do it. No jargon, just clear steps you can delegate to your IT provider or implement yourself.

Quick Assessment:

• ☐ All staff use a second step to sign in (app prompt or security key)
• ☐ We can list every website, service, or system accessible from the internet
• ☐ We know who to call and what to do if an account is compromised
• ☐ Backups exist and we've successfully restored something in the last 6 months
• ☐ Vendors and contractors have their own logins that expire automatically

What It Is

Every service, website, or admin panel accessible from the internet is a potential entry point. Most businesses have forgotten test sites, old remote access portals, or admin consoles that shouldn't be publicly accessible.

Why It Matters

Fewer exposed services mean fewer targets. If attackers can't reach it, they can't exploit it. This is the single fastest way to reduce your attack surface.

Quick Action (30 minutes)

List every website, app, or service your business uses that can be accessed from outside your office. Include your website, email, file storage, accounting software, remote desktop, security cameras, and any admin panels.

Owner To-Dos

• Review the list with your team—does each service need to be accessible from anywhere?
• Decide what can be removed or restricted to office-only access
• Approve protecting essential services with single sign-on (SSO)

IT Provider To-Dos

• Create an inventory of all internet-facing services and subdomains
• Remove or disable anything nonessential
• Put the remaining services behind SSO and conditional access
• Provide a before/after list to the owner with justification for what stays exposed

What It Is

Multi-factor authentication (MFA) or passkeys add a second step to your login—usually an app prompt on your phone or a security key. Even if someone steals your password, they can't sign in without that second factor.

Why It Matters

Stolen credentials are the number-one way attackers get into business systems. MFA stops approximately 99% of automated credential-based attacks. It's the highest-return security investment you can make.

Quick Action (15 minutes)

Turn on MFA for your email and file storage accounts right now—these unlock everything else in your business. Most platforms have a security settings page where you can enable “two-factor authentication” or “multi-factor authentication.”

Owner To-Dos

• Announce company-wide MFA requirement with a 1-week deadline
• Set policy: No MFA = No access to work systems
• Ask the IT provider for the completion report and the list of any exceptions

IT Provider To-Dos

• Enable MFA/passkeys for all users across email, file storage, and admin accounts.
• Block legacy sign-in methods that bypass MFA
• Prioritize phishing-resistant options (passkeys, hardware keys) for admins
• Document any systems that don't support MFA and create a mitigation plan

What It Is

Known-exploited vulnerabilities are software bugs that attackers are actively exploiting to break into systems. Government agencies maintain public lists of these high-priority issues.

Why It Matters

You can't patch everything instantly, but you must fix what attackers are exploiting—especially on systems exposed to the internet, such as VPNs, firewalls, and remote access tools. The difference between a vulnerability scan and an actual breach is often one unpatched edge device.

Quick Action (1 hour)

Ask your IT provider: “Do we have any known-exploited vulnerabilities on our internet-facing systems?” Set a 72-hour fix standard for anything on CISA's Known Exploited Vulnerabilities (KEV) list.

Owner To-Dos

• Set clear policy: Known-exploited issues on public-facing systems must be fixed within 72 hours
• Approve maintenance windows for urgent patches
• Request a monthly report showing patch status for critical systems

IT Provider To-Dos

• Monitor CISA KEV Catalog and vendor security advisories
• Prioritize patches for internet-facing systems (VPNs, firewalls, web servers)
• Add compensating controls (geofencing, WAF rules) when immediate patching isn't possible
• Track and report median time-to-patch for KEV items

What It Is

Email authentication (SPF, DKIM, and DMARC) prevents criminals from sending emails that appear to come from your domain. It's like putting an official seal on your mail that recipients can verify.

Why It Matters

Invoice fraud, wire transfer scams, and phishing attacks often use spoofed emails that appear to be from your company or a trusted vendor. Email authentication blocks most of these attempts.

Quick Action

Check if your domain has DMARC protection using a free online checker. If not, ask your IT provider or email host to set it up.

Owner To-Dos

• Verify DMARC is enabled for your domain
• Request quarterly reports on blocked spoofing attempts
• Establish a clear process for staff to report suspicious emails

What It Is

Backups are copies of your critical business data stored separately from your central systems. Immutable backups can't be encrypted or deleted by ransomware.

Why It Matters

Ransomware attacks lock up your files and demand payment to unlock them. If you have clean, tested backups, you can simply restore your data and avoid paying criminals. Without backups, many businesses face weeks of downtime or permanent data loss.

Quick Action

Identify your five most critical business systems or data sets. Schedule a restore test for one of them this month—actually pull the files back and verify they work.

Owner To-Dos

• Define what data is critical and cannot be lost
• Set quarterly restore test requirement
• Ask: “If we were hit by ransomware today, how long would it take to recover?”

IT Provider To-Dos

• Implement 3-2-1 backup strategy (3 copies, 2 different media, 1 offsite)
• Enable immutable or offline backups for critical systems
• Test restores quarterly and document recovery time
• Protect backup admin consoles with MFA and network restrictions

What It Is

Endpoint Detection and Response (EDR) is an advanced antivirus that watches for suspicious behavior on computers and servers, not just known viruses. It can detect and stop ransomware even when it's a brand-new variant.

Why It Matters

Traditional antivirus software only catches known threats. Modern EDR spots unusual patterns—like a program suddenly encrypting thousands of files—and stops the attack in real time.

Quick Action

Ask your IT provider: “Do we have EDR on all endpoints and servers?” If not, request implementation within 30 days.

Owner To-Dos

• Approve EDR deployment to 100% of devices
• Request a monthly coverage report
• Clarify who monitors alerts and responds to detections

What It Is

Vendor access management means giving external partners their own temporary logins with only the permissions they need—never sharing your staff accounts or giving permanent, broad access.

Why It Matters

Third-party breaches are rising rapidly—approximately 30% of incidents now involve vendor access. When a contractor's account gets compromised, attackers use it to reach your systems.

Quick Action

Review current vendor access. Who has login credentials to your systems? Are any of those accounts shared or permanent?

Owner To-Dos

• Set policy: No shared accounts for vendors; all access expires at project end
• Require a quarterly review of active vendor accounts
• Ask for a list of vendors with privileged access and their expiration dates

IT Provider To-Dos

• Create a separate identity for each vendor with scoped permissions
• Set automatic expiration (30-90 days typical)
• Require MFA for all vendor accounts
• Log and review privileged vendor actions monthly

Days 1-30: Close Obvious Gaps

Week 1:

• Complete 60-second health check
• Create an inventory of internet-facing services
• Enable MFA on email and file storage for all users

Week 2:

• Remove nonessential internet-facing services
• Request a KEV vulnerability scan on public-facing systems
• Verify DMARC protection is active

Week 3:

• Patch any KEV-listed vulnerabilities found
• Lock down exposed admin panels behind SSO
• Test one critical system backup restore

Week 4:

• Complete rollout of MFA to 100% of users
• Document what stays internet-accessible and why
• Review the month 1 progress with the IT provider

Days 31-60: Strengthen Identity and Logging

Week 5-6:

• Roll out single sign-on (SSO) for core business apps
• Implement least-privilege access controls
• Set up just-in-time admin elevation

Week 7-8:

• Centralize identity, endpoint, and cloud logs
• Configure high-priority alerts to reach the on-duty responder
• Review and retire duplicate or abandoned accounts

Days 61-90: Build Response and Resilience

Week 9-10:

• Deploy EDR to 100% of endpoints and servers
• Verify all backups are immutable or offline
• Create a vendor access workflow with auto-expiry

Week 11-12:

• Write a one-page incident response playbook
• Run a tabletop exercise with key staff
• Document improvements needed based on the exercise
• Conduct a 90-day security review and plan for the next quarter

Subject: Security improvements—starting this week

Hi [Name],

I'd like to prioritize three security improvements this month:

1. MFA everywhere: Please enable phishing-resistant MFA for all users and admins across email, file storage, and admin systems. Target: 100% coverage by [date]. Send me confirmation and note any exceptions.
2. Internet exposure: Please provide a list of all our internet-facing services and systems. Include recommendations for what we can remove or restrict.
3. Known vulnerabilities: Please check for any CISA KEV-listed vulnerabilities on our public-facing systems and patch within 72 hours. Going forward, this becomes our standard.

Let's schedule 30 minutes this week to review the plan.

Thanks,
[Your name]

Subject: Monthly security status—[Month]

Hi [Name],

Please provide brief updates on these items by [date]:

• MFA coverage: What % of users are now using MFA? Any holdouts or issues?
• Patching: Any KEV vulnerabilities outstanding on internet-facing systems? If yes, what's the plan?
• Backups: When was the last restore test? Results?
• Vendor access: How many active vendor accounts? Any that should expire?
• Incidents: Any security alerts or suspicious activity this month?

Thanks,
[Your name]

Subject: Access requirements for [Project name]

Hi [Vendor name],

For security and compliance, all vendor access must follow these requirements:

• Separate login credentials (not shared with our staff)
• Multi-factor authentication enabled
• Access is limited to systems needed for this project
• Automatic expiration on [project end date + 30 days]

Please coordinate with our IT team ([contact]) to set up your access. They'll provide credentials and confirm scope.

Thanks,
[Your name]

When Something Seems Wrong

Trigger events: Suspected account compromise, ransomware/malware detection, unusual admin activity, data exposure, wire transfer or payment fraud attempt

Step 1: Triage (First 15 minutes)

• What happened? When? Who discovered it?
• Which accounts or systems are affected?
• Is it still active or spreading?

Step 2: Contain (Immediate)

• Disable/reset compromised user accounts
• Isolate affected devices from the network
• Revoke access tokens and API keys if involved
• Block known malicious indicators (IPs, domains, file hashes)

Step 3: Investigate (First 24 hours)

• Establish a timeline of events
• Identify entry point and method
• Determine what privileges were used
• Identify what data was accessed or exfiltrated

Step 4: Eradicate (Once contained)

• Apply security patches to affected systems
• Reimage compromised devices from clean backups
• Remove malware persistence mechanisms
• Fix configuration issues that enabled entry

Step 5: Recover (When clear)

• Restore systems from verified clean backups
• Re-enable user access gradually with monitoring
• Verify systems are functioning normally
• Resume normal business operations

Step 6: Learn (Within 1 week)

• Document root cause and complete timeline
• Identify control gaps that allowed the incident
• Update processes and technical controls
• Notify affected parties if required by law

Key Contacts

IT Provider: [Name, phone, email]
Internal IT Lead: [Name, phone, email]
Business Decision Maker: [Name, phone, email]
Legal Counsel: [Name, phone, email]
Insurance Contact: [Cyber insurance provider, policy #, phone]
Law Enforcement: [Local FBI field office, non-emergency number]

Pitfall: Shadow IT and unmanaged SaaS apps

Prevention: Require all new apps to go through IT approval. Run quarterly SaaS discovery scans. Enforce SSO for all business tools—if an app can't integrate with SSO, it needs executive approval as an exception.

Pitfall: Permanent admin rights

Prevention: Replace standing admin access with just-in-time elevation. Admins request temporary elevated rights for specific tasks with automatic time limits and approval workflows.

Pitfall: Slow or incomplete patching

Prevention: Create a separate “security fast lane” for edge devices and KEV-listed issues. Non-critical patches can follow the standard monthly cycle, but known-exploited vulnerabilities on internet-facing systems get a 72-hour SLA.

Pitfall: Backups you can't actually restore

Prevention: Schedule restore tests quarterly. Actually pull files back, open them, and verify they work. Record how long it took and what problems you encountered. Fix those problems before you need the backup in a real emergency.

Pitfall: Vendor access that never expires

Prevention: Every vendor account gets an expiration date at creation. No exceptions. Set calendar reminders to review active vendor access quarterly. Auto-disable accounts that haven't been used in 60 days.

Does implementing these controls replace our need for cyber insurance?

No. Good security controls reduce your risk and may lower your premiums, but insurance remains an essential backstop for residual risk. Many insurers now require MFA and EDR as baseline controls to qualify for coverage.

How much will this cost for a business with 10-25 employees?

Budget approximately $50-150 per user per month for security tools (MFA, EDR, backup, logging), plus implementation time. Many controls (reducing internet exposure, improving patching process) cost only time, not money. The investment is substantially less than the costs of breach recovery or ransom payments.

What if my staff complain about MFA being inconvenient?

Modern MFA (especially passkeys) adds only 2-3 seconds to sign-in. Frame it as protecting both company assets and employee personal liability. Make it clear: inconvenience is not optional—MFA is required for access. Most resistance fades within the first week.

We're too small to be a target. Do we really need this?

Small businesses are frequent targets precisely because attackers assume you have fewer protections. Automated attacks don't discriminate by company size—they scan for vulnerable systems and exploit whatever they find. Basic controls stop most computerized attacks.

Can we phase this in over 6-12 months instead of 90 days?

You can, but risk remains elevated during the delay. The 90-day plan prioritizes the highest-impact controls first. If you need to stretch the timeline, focus on the “Days 1-30” items (MFA, reduce exposure, patch KEV issues) immediately and phase in the rest.

What role does employee training play?

Training helps create security awareness, but technical controls prevent mistakes from becoming breaches. Start with strong technical controls (MFA, EDR, backups), then add training as a supplementary layer. Don't rely on training alone—it's the weakest control.

How do I know if my IT provider is doing a good job with security?

Ask specific questions from this guide: MFA coverage percentage, KEV patching timeline, backup restore test results, and vendor access expiration dates. If they can't answer or push back on implementing these basics, that's a red flag. Consider getting a second opinion through an independent security assessment.

What if we get breached even after implementing all of this?

No security is perfect. These controls dramatically reduce risk and limit damage if something does get through. Your incident response plan and tested backups ensure you can recover quickly. Document what happened, fix the gap, and improve—that's how mature organizations handle security.

From iFeelTech

• Cybersecurity for SMBs: Understanding Risk & NIST CSF 2.0
• Small Business Cybersecurity Guide: Top Tools 2025
• Passkeys 2025: Secure Authentication Without Passwords
• VPN vs. Zero-Trust: Why SMBs Should Upgrade Before 2026
• Business Backup Solutions Guide 2025
• 5-Step Network Security Audit Every Small Business Should Do Quarterly

External References

• CISA Known Exploited Vulnerabilities (KEV) Catalog – Updated daily with vulnerabilities actively used by attackers
• Verizon Data Breach Investigations Report 2025 – Annual analysis of breach patterns and trends
• Microsoft Digital Defense Report 2025 – Identity-centric defense guidance and threat intelligence
• NIST Cybersecurity Framework 2.0 – Framework for managing cybersecurity risk

About iFeelTech: We're a Miami-based IT services company specializing in enterprise-grade network infrastructure and cybersecurity for small and medium businesses. Since 2015, we've deployed secure, scalable technology solutions for over 100 South Florida organizations. Our team holds CISSP, Security+, and vendor certifications from Ubiquiti, Dell, and HP.