October is Cybersecurity Awareness Month, and this year it ends on Halloween. That makes this week a good time to stop thinking about security and actually do a few things about it.
You don’t need a big project or a new budget line. These four fixes take an afternoon or less, and each one closes a door that criminals use every day against small businesses across the Hill Country and San Antonio.
1. Turn on multi-factor authentication for email
Email is the front door to almost everything else: bank resets, vendor invoices, customer files, and your other accounts. A stolen password alone should never be enough to get in.
Multi-factor authentication (MFA) adds a second step, usually a code or a tap on your phone, before anyone can sign in. If a password leaks, MFA is often what stops the break-in.
- Turn it on for every email account, starting with the owner, office manager, and anyone who handles money.
- Use an authenticator app instead of text messages where you can. It’s harder to intercept.
- Don’t forget shared mailboxes like info@ or billing@. They are popular targets because nobody watches them closely.
2. Test a backup restore (don’t just check that it ran)
A green checkmark on your backup software tells you a job finished. It doesn’t tell you that you can get your files back. The only way to know is to try.
- Pick one real folder or file from last week and restore it to a different location.
- Open it and confirm it’s the version you expected.
- Write down how long it took. If restoring one folder takes an hour, think about what restoring a whole server would take.
- Make sure at least one copy of your backup lives somewhere ransomware can’t reach, such as an offline drive or a cloud backup with protected versions.
Microsoft 365 and Google Workspace keep your email and files running, but they are not the same as having your own backup. If you rely on them alone, it’s worth a closer look.
3. Clear out the pending updates
That “Restart to update” reminder you’ve been snoozing usually contains security fixes. Attackers look for computers that are missing them because the holes are already public.
- Install pending updates on every computer, then restart them.
- Update your web browsers, PDF readers, and accounting or industry software, not just Windows.
- Check your router, firewall, and printers for firmware updates. These get forgotten for years.
- Still running Windows 10? Make sure each PC is either enrolled in Extended Security Updates or on a plan to move to Windows 11.
4. Make it easy to report a suspicious email
Most attacks start with one email that looks almost right. The fastest defense is a team that speaks up the moment something feels off.
- Tell everyone exactly who to call or email when a message seems strange. Put that name and number where people can see it.
- Make the rule simple: any request to change bank details, buy gift cards, or send money gets verified by phone using a number you already have.
- Thank people who report, even when it turns out to be harmless. If someone clicks by mistake, they should feel safe saying so right away. Fast reporting limits damage.
Finish the month strong
If you do all four this week, you’ll be in better shape than many small businesses. If you only have time for one, start with MFA on email.
And if you’d like a second set of eyes, our complimentary Level 1 Cybersecurity Risk Assessment is available through December 31. It’s confidential, there’s no obligation, and you don’t have to change IT providers to use it.
Need a hand?
Want help with any of these, or a quick look at where you stand? Call us at (830) 237-6547 or request a free IT security checkup at experttechsolutions.com/free-it-security-checkup.