Security & SSL

Nobody is targeting your business by name. That is worth saying first, because most security advice is written for companies with a security department and it makes small businesses feel either paranoid or hopeless. The real risk is far more boring: an automated attempt, one of thousands, that succeeds because a password was reused and nothing else stood in the way.

How it actually goes wrong

What follows is almost always the same story. Somebody gets into a mailbox and sits there quietly reading. They learn who pays whom, and roughly when. Then a genuine-looking invoice goes out from your address, with the bank details changed, to a customer who has no reason to doubt it. The money is gone the same day, the relationship takes a lot longer to repair, and the whole thing started with one login.

What gets done about it

So the work here is unglamorous and it is mostly about closing that door. Two-factor on email and on anything that touches money. Filtering that catches the phishing attempt before somebody has to be clever about it. A look at what of yours is actually reachable from the internet, which is usually more than the owner expects. SSL on the website, renewing itself, so a browser never puts a warning in front of a customer.

When somebody needs proof

Where a bigger client, an insurer or a tender asks you to show evidence rather than say the words, that is a different job and it is priced as one. A written assessment tells you what is exposed, what it would cost to fix, and what you can reasonably leave alone — and leaving things alone deliberately, knowing why, is a perfectly respectable answer.

What I will not do is frighten you into buying something. If your setup is already reasonable, I will say so.