It's a great question, but answering it reveals what we use which could leave us exposed in the event there are holes in our solution. Having said that, we recommend that all business owners start with securing their user accounts.

Since leaving the corporate world, every computer I've worked on has the user working in the admin account. Best practice is to have the local admin account locked down to only be accessed by a single authorized user. All users should be working in a standard user account.

No matter the brand, all systems should have antivirus installed. Where you have multiple machines, consider a solution that offers unattended updates and scheduled scans. A service that prevents the logged in user from making changes is one to consider. And when multiple devices are being supported, a solution that incorporates a dashboard is a huge benefit.

We also strongly suggest the use of a DNS security tool. A DNS solution that allows the admin to define white and black lists, granular web filtering and fast, secure lookups is well advised.

The use of unique passwords and the use of two factor authorization is yet another pillar of system security. If possible the use of security keys like the Ubikey are the highest level of 2FA one can use. These are relatively inexpensive and easy to setup. I'll agree they are a little easier to lose than a phone, but, because they cost less than a phone, purchasing two is not a huge investment.

Everyone should also factor in local and offsite backups of all critical business or personal data. This will help mitigate loss in the event of a ransomware attack. Having your most critical data backed up to a local NAS or SAN, and an offline service will allow you to recover from a ransomware attack with little pain. We also strongly encourage and assist our clients with securing their network modems, routers and IoT devices.

Finally, all staff should be trained to be responsible for security and to recognize phishing attempts. They should know that they should never click on links within any email, unless that email is one generated by an inquiry they themselves generated (like a password reset they initiated). Rather than clicking links in an email, users should be trained to visit site directly, or call the company that claims to have sent the message, to inquire about the any issues presented in the email.

From there its remind, remind, remind your staff to stay diligent and trust that feeling in their gut when they open an email and they get that sense that something isn't quite right.

If after reading this you feel there is a hole you need plugged for the one computer you use for your business or for all of your business' computers, please don't hesitate to contact us for help.

We can be reached at xxx.xxx.xxxx or visit us online at www.trivessa.com.