Cybersecurity Basics Every Small Business in BC Should Know
When we run a first security assessment on a new client's network, we find the same three things almost every time: a flat network with no segmentation, everyday staff accounts carrying administrator rights, and remote access exposed directly to the internet.
None of those are exotic. All three are fixable in weeks. Together they account for most of how small businesses actually get compromised, which is rarely the sophisticated attack people picture.
The Three Things We Find Almost Every Time
A flat network. Everything can reach everything. The reception computer can see the accounting server. The guest wifi touches the same network as the file server. This matters because attackers rarely land where they want to end up. They land somewhere unimportant and move sideways. Segmentation is what stops that walk.
Over-privileged accounts. Staff doing ordinary work while logged in as an administrator. It usually starts as a convenience during a setup and nobody removes it. The effect is that anything that compromises that user compromises the machine completely, and often more than the machine.
Exposed remote access. Remote desktop or a management interface reachable from the open internet, often left from a rushed remote-work rollout. These get found by automated scanning within hours of going live, and then get attacked continuously.
If you do nothing else after reading this, ask whoever manages your IT about those three.
Email Is Where It Actually Starts
Asked where we see data and money leave BC businesses, the honest answer is email, email, and email.
Not clever network intrusions. Not zero-day exploits. Someone receives a convincing message, acts on it, and the damage follows. Invoice redirection, credential harvesting, a mailbox quietly monitored for weeks before anything happens.
This is also why multi-factor authentication is necessary and not sufficient. It raises the bar considerably. It does not close the door, because session tokens can be stolen after a legitimate login, and a stolen session does not prompt for a second factor.
We cover that in detail in the business email compromise post linked below. The short version: MFA on, plus monitoring that notices when a mailbox starts behaving oddly.
The Controls Worth Having, In Order
For a BC business with 10 to 50 staff, this is a defensible order of work:
- Multi-factor authentication everywhere, starting with email and any remote access. The single highest-value control available.
- Separate administrator accounts from the accounts people use daily.
- Remove remote access from the open internet. Put it behind a VPN or a managed access layer.
- Patch on a schedule, including the things that are not Windows: firewalls, routers, printers, line-of-business software.
- Backups you have actually restored from, stored somewhere ransomware on your network cannot reach.
- Segment the network so a compromise in one area does not become a compromise everywhere.
- Managed detection and response, so somebody is watching outside business hours.
- Staff awareness training, which works best once the technical controls are in place rather than instead of them.
The Canadian Centre for Cyber Security's baseline controls cover similar ground and are worth reading if you want an independent reference.
Who Notices First
Here is a question worth asking your provider: if we were compromised right now, how would we find out?
For most small businesses the honest answer is that someone would notice something strange and mention it. That can be weeks after the fact.
With managed detection and response in place, the sequence is different. The security operations centre sees the anomaly, alerts us, and we are contacting the client rather than the client contacting us. The client's first involvement is a phone call telling them what has already been contained.
That difference, between finding out yourself and being told, is most of what separates an incident from a disaster.
What BC Businesses Specifically Should Know
A few things are particular to operating here.
If you hold personal information about customers or staff, PIPEDA obligations apply, and the Office of the Privacy Commissioner publishes practical guidance on what that means in practice. Breaches involving a real risk of significant harm must be reported.
Cyber insurance is also changing fast. Insurers in BC now ask detailed questions about controls before quoting, and coverage can be declined on the answers. We cover what they are asking for in the insurance post below.
And if you work with public sector, health or legal clients, their security requirements will increasingly become yours. We see this arriving in contract renewals more often each year.
Where to Start If This Feels Like a Lot
It is a lot. Pick one thing.
If you have no MFA, start there. If you have MFA but nobody has looked at your network in two years, get an assessment. If you have a backup you have never restored from, test it this month.
Security work compounds. Each control makes the next one more effective. A business that does three of the eight items above is in a genuinely different position from one that does none, even though it is not finished.
How Digital Sky Solutions Can Help
Most small businesses do not need enterprise-level complexity. They need practical protection, clear advice, and reliable support. Digital Sky Solutions helps businesses in Victoria, Vancouver, and across BC improve cybersecurity through:
We help businesses put the right foundations in place, including MFA, backups, endpoint protection, email security, access management, patching, monitoring, and staff guidance.
If your business is unsure whether its current protections are enough, Digital Sky Solutions can help you review your environment and build a practical cybersecurity plan that fits your size, budget, and risk level.
Learn how our managed IT and cybersecurity services can help protect your business in Victoria, Vancouver, and across British Columbia. Contact us today.
Related Posts:
- Cyber Security Essentials for Victoria and Vancouver Businesses
- How to Protect Microsoft 365 Accounts with Multi-Factor Authentication
- Why Small and Mid-Sized Businesses Need Cybersecurity Insurance
