Cybersecurity essentials

Protection checklist for businesses & individuals

In 2024, losses reported to the FBI's Internet Crime Complaint Center reached $16.6 billion, up 33 percent from 2023. Business email compromise, where a criminal poses as a trusted contact to redirect a payment, accounted for $2.77 billion of it.¹ Small businesses and professional services firms are frequent targets.

Cybercriminals target small firms because they often lack dedicated IT security staff while handling significant financial transactions and sensitive client data. A single successful breach can result in substantial financial loss, regulatory penalties, reputational damage, and potential malpractice claims.

This checklist provides essential security measures every small business should implement immediately to protect its business, clients, and reputation.

Immediate action items

These items need your direct action. Steps 1 and 2 come first: without them, nothing else on this list holds. Together they take about an afternoon per person, and most of that is the one-time setup of a password manager.

Do these first

1. Password security

According to Verizon's 2017 Data Breach Investigations Report, 81% of hacking-related breaches involve stolen or weak passwords. Complex passwords are essential, but most people struggle with creating and managing them across dozens of accounts.

ACTION ITEMS: Update passwords for all of your business, financial, and personal accounts. For accounts we manage on your behalf, we'll update passwords and provide them to you securely.

Important: Never send or allow to be sent to you passwords by email or text. Use an end-to-end encryption service like Signal. Otherwise, your passwords may be exposed to cybercriminals.

What a password-cracking rig does with each kind of password:⁴

Password	How it was made	Time to crack
sunshine	One dictionary word, 8 letters	2 weeks by brute force
Sunshine2024!	Word, year, symbol: the pattern most people use	At once. Cracking tools try this pattern first, so it falls in the same first pass despite its 13 characters.
rK7$wq2M!vB9#xLe	16 random characters from Bitwarden	75 quadrillion years

• Generate strong passwords automatically using a password generator.
  Free tool: Bitwarden Password Generator. Set length to at least 16 characters with uppercase, lowercase, numbers, and symbols.

• Use a password manager to securely store all passwords. A password manager is a secure vault that remembers all your passwords so you don't have to. You create one master password to access the vault, and it handles everything else.
  Recommended service: Bitwarden (free for personal use). Bitwarden syncs across all devices and automatically fills passwords on websites.

Setup steps:

1. Create a free Bitwarden account

2. Choose a strong master password (write it down and store it securely)

3. Install the browser extension for Chrome, Safari, or Edge

4. Install the mobile app on your phone

• Update critical passwords first with unique passwords for each account.

Generate and save new unique passwords for:

1. Primary email accounts

2. Banking and financial accounts

3. Payment processing accounts

4. Client management systems

Important: Each account must have a completely unique password. Never reuse passwords across sites. If you have used the same password, or a close variation of it, for years, assume it is already on a breach list and replace it now with one from your password manager. You can check whether your email address has appeared in a known breach at Have I Been Pwned.

2. Multi-factor authentication (MFA)

Multi-factor authentication requires two forms of verification to access an account: something you know (password) and something you have (phone, security key, or authentication app). Even if criminals steal your password, they cannot access your account without the second factor.

ACTION ITEM: Turn on multi-factor authentication for your email today, then the accounts below. Each one takes a few minutes using the setup links. Email comes first because a criminal who controls your email can reset every other password you own.

• Enable MFA on all accounts that support it, in this order:

1. Email: Microsoft 365 or Gmail and Google Workspace

2. Banking and investment accounts (in each institution's security settings)

3. Payment processors: PayPal, Stripe

4. Cloud storage: Dropbox, Google Drive, OneDrive

5. Your Apple Account, if you use an iPhone or Mac

6. Password manager: Bitwarden

• Use an authenticator app rather than text messages when possible.
  Recommended apps: Microsoft Authenticator or Google Authenticator. Text-message codes are acceptable but less secure than an app: a criminal who moves your phone number to a SIM they control receives the codes instead of you.

Then, in order

3. Identity protection and monitoring

Once your personal information appears on the dark web, criminals can open accounts, file fraudulent tax returns, or impersonate you to clients, sometimes for years before discovery. Business principals and anyone with access to sensitive client information or financial accounts require comprehensive identity monitoring.

ACTION ITEM: Visit the link below, select the appropriate plan, and complete enrollment. Enrollment and management are handled directly by you through the service provider.

• Enroll in comprehensive identity monitoring for all business principals.
  Recommended service: Aura Identity Protection offers comprehensive monitoring, including credit reports from all three bureaus, dark web surveillance, and up to $1 million identity theft insurance. Plans start around $12-15 per month per person.

4. Device protection

Comprehensive antivirus and antimalware software provides real-time protection against viruses, ransomware, spyware, and other threats. Modern solutions go beyond traditional antivirus to include behavior monitoring, exploit protection, and web filtering.

ACTION ITEM: Purchase and install security software on all devices. Ensure automatic updates are enabled.

• Install comprehensive security software on all business devices.
  Recommended solution: Bitdefender Total Security consistently ranks highest for threat detection while maintaining low system impact. It covers Windows, Mac, iOS, and Android devices. Plans start around $40-50 per year for multiple devices.

• Enable automatic updates for operating systems and all software.

Most breaches exploit known vulnerabilities that have available patches. Configure Windows Update, macOS Software Update, and mobile device updates to install automatically.

5. Secure communications

Standard email and text messages are not encrypted and can be intercepted or spoofed. Wire transfer instructions, sensitive client information, and confidential business communications require encrypted channels and verification protocols.

ACTION ITEMS: Install Signal on all devices and establish verification protocols with your team.

• Use encrypted messaging for sensitive communications.
  Recommended app: Signal provides end-to-end encryption for messages, voice calls, and video calls. It's free and works on all devices. Use Signal for any discussion involving financial transactions, client confidential information, or sensitive business matters.

• Implement mandatory verification protocols for wire transfers and payment changes.

Required protocol for all wire transfers and account changes:

1. NEVER act on emailed wire instructions without verification

2. Call the sender using a known phone number (not one provided in the email)

3. Confirm instructions verbally before processing

4. Question any last-minute changes to payment instructions

This protocol is mandatory for all staff. No exceptions. Wire transfer fraud typically succeeds because recipients trust email communications without verification.

6. Network security

Public Wi-Fi networks at coffee shops, hotels, and airports are inherently insecure. Criminals can intercept unencrypted traffic, capture passwords, or redirect you to fake websites. Home and office routers also require proper configuration to prevent unauthorized access.

ACTION ITEM: Install VPN software and configure your routers. Contact your internet provider if you need assistance with router configuration.

• Use a VPN when connecting to any public Wi-Fi network.
  A VPN encrypts all internet traffic between your device and the destination. Recommended service: NordVPN provides reliable protection with servers worldwide. Plans start around $3-5 per month.

• Secure your home and office routers.

Basic router security measures:

1. Change the default administrator password

2. Use WPA3 or WPA2 encryption for Wi-Fi

3. Create a strong Wi-Fi password

4. Disable remote management unless specifically needed

5. Keep router firmware updated

7. Ongoing vigilance

Technical controls provide essential protection, but human vigilance remains the final defense. Most successful attacks exploit trust rather than technical vulnerabilities.

ACTION ITEM: Maintain awareness of evolving threats and ensure all team members understand verification protocols.

• Recognize phishing attempts and suspicious emails.

Warning signs of phishing emails:

1. Urgent requests for action or payment

2. Sender address that doesn't match the claimed organization

3. Generic greetings instead of your name

4. Requests to click links or download attachments

5. A password-reset email you did not ask for. Never use its link; go to the site yourself and sign in there.

6. Poor grammar or unusual phrasing

7. Unexpected changes to established procedures

When in doubt, please forward the communication to us for review. Call using known contact information rather than responding to the suspicious email.

• Conduct quarterly security reviews with all staff. Review current threats, reinforce protocols, verify that security measures remain in place, and recheck each staff email address at Have I Been Pwned. Security is not a one-time project but an ongoing practice.

Technical security services we provide

While you implement the action items above, we can help secure your technical infrastructure. These services work at the DNS, email, and hosting level to prevent spoofing, hijacking, and other technical attacks. If you're a current client, contact us to review which of these protections are currently in place. If you're not yet a client, we can implement these measures for you.

Email authentication configuration

We can configure and monitor email authentication protocols that prevent criminals from sending emails that appear to come from your domain:

• DMARC (Domain-based Message Authentication, Reporting, and Conformance): The primary defense against email spoofing attacks. We configure strict DMARC policies and set up reporting so you're notified of spoofing attempts.

• SPF (Sender Policy Framework): Specifies which mail servers are authorized to send email on behalf of your domain.

• DKIM (DomainKeys Identified Mail): Adds digital signatures to outgoing emails to verify authenticity and prevent tampering.

Note: While we configure these DNS records, we don't provide email hosting services. We work with your existing email provider (Microsoft 365, Google Workspace, etc.) to properly configure authentication for your domain.

DNS management and security

We manage DNS services for most of our clients through enterprise providers such as Cloudflare. Proper DNS management includes:

• Secure access controls with strong authentication

• Monitoring for unauthorized changes to DNS records

• Documentation of all authorized changes

• Regular audits to verify record accuracy

DNS hijacking can redirect your email or website to malicious servers without your knowledge. Proper DNS security prevents these attacks.

Website and hosting security

For clients whose websites we host and manage, we implement multiple layers of security:

• SSL/TLS certificates for encrypted connections (HTTPS)

• Web application firewall (WAF) to block malicious traffic

• Regular security updates and patches

• Secure file permissions and access controls

• Regular backups with offsite storage

• Malware scanning and removal

• DDoS protection

• Security headers and best practice configurations

These measures protect your website from common attacks, including SQL injection, cross-site scripting, brute force attacks, and malware infections.

Email setup and support

While we don't provide email hosting services, we assist clients with setup and configuration of Microsoft 365, Google Workspace, and other email platforms. This includes proper authentication configuration, security settings, and integration with your domain.

Questions and support

We understand that implementing these security measures may raise questions or require assistance. We're available to:

• Answer questions about any of these recommendations

• Provide guidance on setting up password managers and MFA

• Help establish security protocols for your team

• Coordinate with your IT vendors if needed

Contact us anytime if you need assistance. These protections are the minimum we recommend for any business that handles client information or payments.

1. FBI Internet Crime Complaint Center, 2024 Internet Crime Report (April 2025): $16.6 billion in reported losses, a 33 percent increase from 2023; business email compromise $2,770,151,146 across 21,442 complaints. ↩
2. Verizon, 2017 Data Breach Investigations Report (10th edition): 81 percent of hacking-related breaches leveraged stolen and/or weak passwords. ↩
3. Microsoft Security, "One simple action you can take to prevent 99.9 percent of attacks on your accounts", August 2019: multi-factor authentication blocks over 99.9 percent of account compromise attacks. ↩
4. Hive Systems, 2026 Password Table: brute-force times for randomly generated passwords on 16 RTX 5090 graphics cards against bcrypt hashes. Hive notes the table is a best case; passwords that use dictionary words or appeared in a past breach are tried first and cracked significantly faster. ↩