Most breaches we're called in to review didn't involve anything sophisticated. They involved a shared password, an unpatched server, or a backup nobody had ever tested.
When we're asked to review a security incident, the cause is almost never sophisticated. It's a password four people shared, a server that missed updates for a year, or a backup that existed on paper but had never actually been restored. The unglamorous fundamentals are where most of the real risk lives.
1. Everyone has their own login
Shared accounts make it impossible to know who did what, and they mean access never truly gets revoked when someone leaves. Individual accounts with role-based permissions cost nothing to set up and solve both problems permanently.
2. Access ends when employment ends
Offboarding is where good intentions quietly fail. Former staff keeping access to email, systems, or shared drives is one of the most common findings in any audit we run. A written checklist tied to your HR process fixes it.
3. Something is responsible for patching
The vulnerabilities used in real attacks are usually months or years old, with patches long available. If nobody owns updates, they don't happen. Automate what you can, and put a name against whatever's left.
4. Backups are tested, not just scheduled
An untested backup is a guess. We've seen backups running faithfully for months to a location nobody could restore from. Restore one, on purpose, on a normal day - that's the only way to know it works.
5. Your team knows what a phishing attempt looks like
Technical controls don't help much when someone is convinced to hand over a password. A short, practical session - real examples, no jargon, permission to ask 'is this legitimate?' without embarrassment - is one of the cheapest security investments available.
“Security isn't a product you install. It's a set of habits, and habits need an owner.”
None of this requires a large budget. It requires deciding who is responsible for each item and reviewing them on a schedule. If you can't currently name who owns backups at your company, that's the place to start.
