Security without a security team
A small company can’t do everything about security. It doesn’t need to — it needs four things, done consistently.
Big companies have departments for this. A small company has you, partially, on a Friday afternoon. The good news is that the security that actually matters at small scale is short, boring, and mostly free.
Most incidents at small companies are not sophisticated. They are unlocked doors: passwords in a shared document, the ex-contractor’s login that still works, the backup that has never once been restored to check. Nobody hacks the lock when the door is standing open.
Four things
One door. Get every system behind one login, so that adding a person is one action and removing them is one action. The day someone leaves, everything closes at once. That single property does more than any policy ever will.
Least privilege. People see what their job needs and nothing else. The intern does not need payroll. The estimator does not need the customer list export. Generous defaults are convenient right up until they aren’t, and the day they aren’t is a bad day.
Backups that restore. A backup is a theory until it has been restored. Pick a quiet Friday, restore the important thing somewhere safe, and time it. Do this occasionally, forever. It is the cheapest insurance in software. Most companies hold the imaginary version.
Updates applied. Most breaches walk through doors that were patched, publicly, months earlier. Turn on automatic updates wherever the stakes allow, and have a short list for the rest. This is unglamorous in the way that functioning brakes are unglamorous.
What this doesn’t need
Not a policy binder nobody reads. Not annual training theater. Not a new hire, a new department, or a new platform. The list above is short because it has to be — short is what actually gets done, by busy people, in a company where security is one of forty jobs.
Do the four things always, and you are ahead of most. Not because you did something clever, but because you stopped leaving doors open.
Working on something this applies to? Tell us about it — thirty minutes, no pitch.