Practical Network Security Steps for Small Professional Firms
Security advice gets overwhelming fast. There’s always another product or acronym to worry about.
My honest take: if you’ve got 10 to 50 people, a short list of basics covers a lot of the risk. You don’t need it all this month, just the right things first. Here’s the order I’d go in.
1. Turn on MFA, and enforce it
Multi-factor authentication (MFA) means logging in with your password plus a second check, like a code or an app prompt on your phone. A stolen password on its own stops being enough.
If you only do one thing after reading this, make it MFA on Microsoft 365. We had a high-end furniture retailer in the GTA get its on-premises network hacked. Our cybersecurity stack and 24×7 SOC team caught it within minutes, and they were back in business within two hours with no data loss. The lesson I took away was simple: enforce MFA on Microsoft 365. Don’t just offer it.
From there, add it to remote access and VPN, then banking, payroll and accounting software, then the admin accounts for your firewall, Wi-Fi and backups. For accountants, the CRA’s EFILE guidance also encourages strong, unique passwords, regular account monitoring and signing out after each session.
2. Keep everything patched
Attackers love old software with known holes. Updates close them. It isn’t only Windows, either. Browsers, PDF readers, accounting and practice management software, your firewall, your Wi-Fi gear and even the printers need updates too.
Patching by hand gets forgotten, and I don’t blame anyone for that. We use NinjaOne to automate updates across a firm’s computers and track which ones are falling behind.
3. Swap the ISP router for a real firewall
A business firewall gives you control over what comes in and goes out. Keep its firmware current and replace the default admin password with a strong, unique one. Never expose remote desktop or file sharing straight to the internet. Turn on logging too.
4. Separate your networks
Your guest Wi-Fi shouldn’t sit on the same network as your client files. Neither should the boardroom TV or the security cameras. Give staff, servers, guests and devices their own zones, so a problem in one stays there.
The Canadian Centre for Cyber Security’s Baseline cyber security controls for small and medium organizations is clear that guest Wi-Fi should never be connected to your internal network.
5. Lock down admin rights
Most staff don’t need to install software or change system settings. If everyone’s an admin, then malware that lands on someone’s laptop gets admin rights as well.
Give people regular accounts for day-to-day work, and keep admin accounts separate for when they’re really needed. Remove access promptly when someone leaves. A former employee’s account that still works is an open door, and I see it more than I’d like.
6. Use modern endpoint security
Old-style antivirus looks for known threats. Attackers now use tools that slip right past it.
We use Huntress to watch for suspicious behaviour on computers and in Microsoft 365, like unusual logins or tools attackers commonly use. When something looks wrong, it can be investigated and isolated quickly.
7. Secure your email
Email is still the most common way in, and where a lot of payment fraud starts. Turn on filtering for spam, phishing and dangerous attachments. Set up SPF, DKIM and DMARC, the email authentication records that make it harder for criminals to send mail that looks like it came from your domain.
Then make a rule that any change to payment or banking details gets confirmed by phone, using a number you already have on file. For law firms and real estate brokerages handling trust funds and closing payments, I’d treat that rule as non-negotiable.
8. Train your team, briefly and often
I don’t buy the line that people are the weakest link. They’re your early warning system, if they know what to look for. Keep the training short. Show them what a fake login page looks like. Tell them exactly what to do if they clicked something they shouldn’t have, and make sure they know they can call right away without getting blamed.
9. Watch for stolen passwords
When other websites get breached, staff passwords often end up for sale on the dark web. If someone reused their work password there, an attacker now has a key to your office. Our dark web monitoring flags when your firm’s email addresses and credentials show up in known leaks, so you can reset them first.
10. Back up, and make sure you can restore
None of these steps removes risk. They shrink it. A solid backup is what lets you recover when something does get through.
Keep backups offsite and separate from your normal logins, and test restores regularly. We keep backups in Canadian data centres, which also helps with your obligations under PIPEDA to protect personal information with appropriate safeguards.
Have a plan for the bad day
Write down who to call, how to disconnect an affected computer and how you’ll reach staff if email is down. Under PIPEDA, some privacy breaches must be reported to the Office of the Privacy Commissioner of Canada. The OPC explains when in its guide to mandatory breach reporting.
Not sure where to start?
Most firms already have a few of these covered. The question is which gaps matter most for yours.
Book a free 30-minute call with Midas Tech. We’ll go through your setup and send you a written fix-first list, ranked so you know what to do first.
Book your free 30-minute call or call us at 1-905-787-2038.