The 30-Minute Cyber Check: 10 Settings That Stop Most Small-Business Hacks 

The 30-Minute Cyber Check

10 settings that stop most small-business hacks

Most small-business security problems don’t start with “high-tech hackers.” They start with simple gaps: no MFA on email, shared passwords, outdated PCs, or backups that were never tested. This quick checklist is designed for owners and office managers in Biloxi, Gulfport, Ocean Springs, and the Mississippi Gulf Coast who want the biggest security wins in the least time.

1) Turn on MFA for email (first)

Email is the #1 target because it can reset passwords for everything else. Turn on multi-factor authentication (MFA) for Microsoft 365 or Google Workspace, banking, payroll, and any remote-access tools. Use an authenticator app when possible. 

2) Eliminate shared passwords

Shared logins make it impossible to track activity and turn one leaked password into a full-office problem. Give each person their own account. If you need shared access (like a shared inbox), use the platform’s shared features—not one shared password.

3) Remove “everyone is an admin”

Daily user accounts should not have local admin rights. Admin access makes it easier for malware to install and gives attackers more control. Keep a separate admin account for installs and management.

4) Turn on automatic updates (and reboot weekly)

A lot of attacks rely on known vulnerabilities that updates already fix. Turn on automatic updates for Windows/macOS and keep key apps updated (browsers, Adobe, QuickBooks, VPN tools). Set a simple rule like: restart computers every Friday. 

5) Lock down remote access (or disable it)

Remote access is convenient—and heavily targeted. If you don’t need it, turn it off. If you do, require MFA, limit who can use it, and don’t expose Remote Desktop directly to the internet.

6) Use a password manager

Strong, unique passwords are non-negotiable, but nobody can remember them all. A password manager eliminates sticky notes and reused passwords. Make it policy: if it’s worth logging into, it’s worth storing securely.

7) Tighten email security (phishing is the #1 threat path)

Most “hacks” start with a convincing email: fake invoices, payroll updates, or urgent payment requests. Turn on anti-phishing protections, consider an “External Sender” warning, and adopt one simple policy: verify payment/banking changes by phone using a known number. 

8) Encrypt laptops

Lost or stolen laptops can become a data breach if they aren’t encrypted. Enable BitLocker (Windows) or FileVault (Mac) and store recovery keys safely.

9) Backups: automate them AND test restores

A backup you’ve never restored is a hope, not a plan. Ensure backups cover critical files and key apps. Keep at least one backup offline or immutable (protected from ransomware). Test a restore monthly—even if it’s just one file.

10) Confirm endpoint protection is installed and reporting

Antivirus/EDR should be installed on every device, updating, and actually alerting someone. “We think it’s installed” isn’t a strategy—visibility matters.