Cybersecurity tips: the short answer
The cybersecurity tips that prevent the most damage are not exotic. Turn on multi-factor authentication (MFA) for every account. MFA is a second login step, such as a code on your phone. Keep devices and software updated. Keep backups that attackers cannot reach. And teach staff to slow down when an email asks for money or a password. Everything else in this list builds on those four habits.
The tips below are grouped by area, so you can hand each group to the person who owns it. If you only have an hour this week, start with this table.
| Priority | Tip | Why it matters |
|---|---|---|
| 1 | MFA on email, banking and admin accounts | Stolen passwords are one of the most common ways in |
| 2 | Automatic updates on every device | Closes known holes that attackers scan for |
| 3 | Offline or immutable backups, tested | Lets you recover from ransomware without paying |
| 4 | Phone verification for payment changes | Stops fake invoice and CEO fraud |
| 5 | A one-page incident plan | Saves hours of confusion when something goes wrong |
Accounts and passwords
1. Turn on MFA everywhere, starting with email. Your mailbox is the key to every password reset, so protect it first. Then do banking, payroll, cloud consoles and admin accounts. Prefer an authenticator app, a hardware security key or passkeys over text message codes. Criminals can steal those by moving your phone number to their own SIM card (SIM swapping).
2. Give the whole team a password manager. A business password manager lets people use long, unique passwords. It also lets them share logins safely instead of pasting them into chat or spreadsheets. Reused passwords are what turn a breach at some unrelated website into a breach of your company mailbox.
3. Separate admin accounts from everyday accounts. IT admins should read email and browse the web with a normal account. They should use a separate admin account only for admin work. That way, a phishing click on the everyday account does not hand over the keys. (Phishing is a fake message that tricks you into clicking or sharing a password.)
4. Remove access the day someone leaves. Keep a short leaver's checklist covering email, online apps, shared passwords, VPN and building access. Forgotten accounts of former staff and contractors are a common and avoidable way in.
Want to know whether staff passwords are already for sale? Our guide to dark web monitoring explains how that works.
Email and phishing
5. Switch on the protections you already pay for. Microsoft 365 and Google Workspace both include anti-phishing and malware scanning. Check they are enabled, and turn on the banner that marks email from outside the company.
6. Publish SPF, DKIM and DMARC records. These are settings in your domain's DNS (its public address book). They help other mail servers reject email that pretends to come from your domain. Start DMARC in monitoring mode. Then move to quarantine or reject once all your real senders are covered.
7. Verify every payment change by phone. Make it a written rule. Any request to change bank details or make an urgent payment is confirmed by calling a number you already have. Never use the number in the email. This one rule stops most invoice fraud.
8. Make reporting easy and blame-free. Add a report button to the mail client and thank people who use it, even for false alarms. One fast report lets IT pull the same email from everyone else's inbox.
For the warning signs to teach your team, see how to spot a phishing email.
Devices: how to protect your home computer and work laptops
How can you protect your home computer if you work from it? The same rules apply at home as in the office, and these four tips cover both.
9. Turn on automatic updates. That means the operating system, browsers and everyday apps such as PDF readers and video call tools. Restart when prompted, because many updates only apply after a reboot.
10. Use security software and full-disk encryption. Security software on each computer spots and blocks attacks. Encryption scrambles the data so a thief cannot read it. Built-in tools such as Microsoft Defender, BitLocker and FileVault are a sensible baseline for small teams. With encryption on, a lost laptop is a nuisance rather than a data breach.
11. Secure the home network. Change the router's default admin password and keep its firmware updated. Use WPA2 or WPA3 Wi-Fi security. Put smart TVs, cameras and other gadgets on a guest network away from work devices.
12. Lock screens and keep work devices for work. Set a short auto-lock, and do not let family members use work laptops. That cuts both accidents and theft risk. On public Wi-Fi, use the company VPN or a phone hotspot. Our guide to man-in-the-middle attacks explains why.
Data and backups
13. Follow the 3-2-1 backup rule. Keep three copies of important data, on two different types of storage, with one copy offsite. At least one copy should be offline or immutable (locked so it cannot be changed). Then ransomware, which locks your files for a fee, cannot encrypt or delete it.
14. Test restores, not just backups. Restore a few files and one full system every quarter. A backup you have never restored is a hope, not a plan.
15. Know where sensitive data lives and limit who sees it. List the systems that hold customer data, payment data and HR records. Remove "anyone with the link" sharing and give access by role, not by habit.
Cloud, SaaS and web security best practices
16. Review your cloud and SaaS settings. Check Microsoft 365, Google Workspace, AWS or Azure. Who has admin rights? Is MFA required for everyone? What is shared outside the company? Is audit logging on? Wrong settings are a common cause of cloud leaks, such as a public storage folder or an admin account without MFA.
17. Apply web security best practices to your website and apps. If you run a website, customer portal or web app, these basics close the most common gaps. Pass this list to your web developer:
- Serve everything over HTTPS and enable HSTS (which forces browsers to use the secure version)
- Keep the CMS, plugins and themes updated, and delete plugins you do not use
- Require MFA on every admin login
- Set security headers such as Content-Security-Policy
- Validate input and use parameterized database queries, with the OWASP Top 10 as your checklist
- Put public sites behind a web application firewall
Then have it tested. Our comparison of a vulnerability assessment vs a penetration test explains which one fits your stage.
Staff awareness
18. Train little and often. Short, regular sessions and realistic practice phishing emails work better than one yearly slideshow. Cover the scams your team actually sees: fake invoices, gift card requests from "the CEO" and fake MFA reset messages. Our guide to social engineering covers the main tricks.
19. Give people an obvious place to ask "is this real?" A dedicated chat channel or a named person works. Attackers rely on urgency and on people feeling silly for checking, so make checking the normal thing to do.
Incident readiness
20. Write a one-page incident plan and know who to call. It does not need to be long. It should answer these questions:
- Who makes decisions, and who is their backup?
- How do we isolate an infected laptop or disable a compromised account?
- Who calls the bank, the cyber insurer, customers and, where required, regulators?
- Where is a printed copy of key phone numbers if email is down?
- Which outside incident response firm will we call? (Check whether your insurer requires a specific one.)
Turn on audit logs in your email and cloud platforms now. You cannot investigate what was never recorded. If nobody watches those logs out of hours, read managed SOC vs MDR for the options. A SOC is a team that watches your systems for attacks 24/7.
How NextGarrison helps
Not sure which of these tips you already cover? Our free 10-question security assessment gives you a quick read on where you stand. When you are ready for more, we run penetration tests (expert attempts to break in), 24/7 SOC monitoring and incident response for growing businesses. See all our services.
Need a hand with this?
Talk to a senior consultant. We reply within one business day with clear next steps and a scoped quote.
Written by
NextGarrison Security TeamPenetration testers, SOC analysts and compliance consultants
Our consultants test applications and networks, run 24/7 security monitoring and prepare companies for SOC 2, ISO 27001 and PCI DSS assessments. We write about what we see in real engagements, in plain English.