Network security conjures images of big-budget enterprise solutions, but most breaches actually trace back to the absence of simple, free or cheap measures. Here are 10 items — genuinely actionable for SMBs — distilled from 25 years of systems administration experience.
1. Multi-factor authentication — no exceptions
Email, admin panels, cloud provider accounts — MFA should be on for all of them. One leaked password is no longer enough on its own; this single measure blocks the vast majority of attacks by itself.
2. Automate software updates
Most known exploits target vulnerabilities that already have a patch — just not applied. Set up an automatic update policy for OS and critical software; the manual "I'll do it later" list is the highest-risk list in security.
3. Set up email authentication (SPF, DKIM, DMARC)
Without these three, your domain is wide open to spoofing — someone can send email as if it's from you. Setup is a one-time job with a permanent effect. (Full guide in a separate post.)
4. Backups — and testing the restore
Taking backups isn't enough; you need to regularly test restoring from them too. In a ransomware scenario, "we have backups" is a much weaker sentence than "we've tested that we can restore from backups."
5. Segment your network
Guest Wi-Fi and production servers shouldn't share a network. Even if one device is compromised, keeping the attacker from reaching the whole network significantly limits the damage.
6. Review firewall rules regularly
Ports get opened and forgotten over time. At least once a year, review each rule and ask: "is this still needed?"
7. Keep access on least privilege
Not everyone needs admin rights. Set up a process that revokes an employee's access the same day they leave — this is the step most often skipped and the most critical.
8. Use VPN or Zero Trust access
If you have remote work, internal systems should be reached through a VPN or Zero Trust gateway, not directly from the open internet.
9. Log, and actually monitor logs
When an incident happens, "when, where, what happened" needs an answer in your logs. Without logging, post-incident analysis is nearly impossible.
10. Train staff on phishing
The weakest link in technical controls is usually people. A simple phishing simulation produces better results than an annual security training session.
Where to start
Don't try to do all of this at once. Items 1, 3 and 4 (MFA, email authentication, backup testing) have the highest impact-to-cost ratio — start there. Add one more item every quarter until the list is complete.
Not sure where your network security stands? Get in touch — a short audit will make it clear.
