Local Circuit

When the same person designs your IT systems and protects them, you've got a built-in conflict of interest.

Even a great IT person can't reliably check their own work. Backups, firewall rules, access reviews, incident post-mortems: every one of those checks is done by the same person who built the thing being checked. The result is a system where every safeguard verifies itself.

Large enterprises split these roles for exactly this reason. They have separate teams for engineering and security, and the security team's job is to find what the engineering team missed. Small businesses can't afford a full second team, but the principle still applies.

The fix is lighter than you'd expect. Hire an outside firm for one half-day a year to audit what your internal IT person built. The audit looks at your backup logs, your access list, your patch report, and the last three things your IT person would like to fix. The cost is usually under $3,000, and the value comes from the fact that the outside auditor doesn't work for the IT person.

One half-day audit a year is the whole fix. It costs less than ignoring the problem ever could.

Your primary work email is on every business card, contract, and website. It's also the first thing attackers look for when they're targeting your business.

Phishing crews scrape your company website and LinkedIn for the format and patterns of your email addresses. Once they have one address, they can guess the rest of your team's emails in seconds. That gives them targets for credential phishing, fake invoice scams, and CEO impersonation.

Email aliases reduce that exposure. An alias is an extra email address that delivers to the same inbox without exposing the real one. Microsoft 365 supports up to 400 aliases per mailbox. Google Workspace supports up to 30 per user. Both are free and built in.

A simple pattern that works for most small businesses:

- Use a public-facing alias for any address that lives on your website, business cards, and signup forms (info@, hello@, sales@). Keep your real email off public pages.
- Create vendor-specific aliases for major suppliers ([email protected], [email protected]). If one vendor leaks and you start seeing phishing on that alias, you know exactly which one.
- Use one tightly held internal email for sensitive operations like banking and payroll. That one stays off everything public.

If a phishing campaign hits one of your aliases tomorrow, you'll know which list you ended up on. You can shut that alias off without changing your main address.

Most of the tools your team uses to get work done are probably not on your IT list.

Some examples: personal Dropbox accounts for client files, ChatGPT with confidential information pasted in, a Trello board the marketing team set up a year ago, a Notion workspace someone in operations runs from their phone. The name for all of this is shadow IT, and every business has more of it than you'd guess.

The risk shows up in two places. First, data that should live inside your business sits inside accounts you don't control and can't delete. When an employee leaves, the data stays where they put it. Second, none of those tools are configured with your security in mind. MFA settings are weak or off, and there's no data loss prevention, retention policy, or audit log to check when something goes wrong.

You don't need a top-down crackdown to fix this. Ask four questions in your next team meeting:

1. What software or web tool are you using this week that wasn't installed by IT?
2. Which one would slow your work down the most if it disappeared tomorrow?
3. Is any client or company data sitting in it?
4. Would you be embarrassed if it leaked in a breach?

Run the conversation as a fact-finding exercise. The helpful tools get sanctioned, the risky ones get replaced.

If you don't know what's running in your business, you can't protect it.

If someone asks whether your business has backups, you probably say yes. Disaster recovery is a different question.

A backup is a copy of your data. Disaster recovery is the plan that brings your business back to running condition after something goes wrong. The two get confused all the time, and the confusion costs real money when ransomware or a hardware failure hits.

A good backup setup follows the 3-2-1-1-0 rule: three copies of every important file, on two different types of storage, with one copy stored offsite, one copy that's immutable so ransomware can't encrypt it, and zero errors in your last test restore.

That last one is what most businesses skip. Untested backups are not backups.

They're an unverified promise.

Pick a normal file, an email, and a full server volume, then try to restore each one to a different location.

If the restore works, you have backups. If it doesn't, you have a problem you can fix today instead of during an attack.

Disaster recovery goes one layer further. It's the playbook for what your business does when it can't function. Things like which systems come back first, which people make decisions, which vendors get called, and how long each step is supposed to take. Without that playbook, even a working backup leaves you guessing during the worst week of your year.