A small business IT worry: how do I know my IT is in order and I’m protected?
Updated: Oct 29
We recently supported a small Estonian company that was having minor network issues. Having narrowly escaped a fairly serious cybersecurity incident about a year earlier, the company had invested in a perfectly adequate network infrastructure, including a good firewall with all security services, a decent managed switch and Wi-Fi access points. As the company is small, it naturally has no in-house IT person, there are no technical IT skills on site, and IT is entrusted to external partners.
What did we find?
When we logged into the firewall, we were taken aback by what we found, and we simply have to talk about it.
The expensive firewall licences had not been registered for a year (they were not working).
The firewall’s only administrator account had a password that sits at the very top of the world’s most commonly used passwords.
The entire network was configured (or rather not configured) so that every device sat on a single network: production equipment, staff computers, IoT, users from a tenant in the building and guest Wi-Fi users (a separate guest Wi-Fi had been created, but not segregated).
The firewall itself had no rules at all, which also meant there was no restriction preventing an unprotected Windows XP computer needed for production from reaching the outside world, even though the owner believed this had been set up.
In other words, the investment in infrastructure had delivered no real benefit. The false sense of security created by buying and installing the equipment probably increased the risk of another incident.
We were dismayed. Naturally, we put the network in order so we could sleep at night, but once the initial shock had passed, the episode gave us serious food for thought.
How can a manager without IT knowledge be sure that their IT partner has actually done the job properly?
We have three recommendations:
Ask your partner for basic documentation.
It is hard to document work that has not been done. So if you receive documentation, you can feel a little more confident that your partner has actually done something.
Of course, be prepared to pay for the documentation: it takes time, but good IT documentation is worth its weight in gold in a crisis.
Depending on whether a partner supports all of your IT or just one part of it, the content of the documentation may vary, but the manager of a small company should have at least the following documents on their IT:
IT asset register
List of services and contracts, and a responsibility matrix
Physical and logical network diagram
List of servers and services
IP address plan
Access register (who has access to what)
Authentication and password policy
Description of cybersecurity solutions and software
Description of the backup solution and policy
List of contacts and escalations, or better still, a one-page "IT quick guide for managers".
Have your IT audited
The old saying "trust, but verify" applies to IT too. Even if you have received IT documentation from your partner, and especially if you have not, it is worth having your IT reviewed by a third party with no commercial interest in hiding shortcomings.
If IT documentation already exists, the number of audit hours will also be significantly lower.
Just make sure the audit partner is technically competent and actually looks into the infrastructure, rather than correcting typos in the existing documentation.
Sign an IT management agreement
Although it may seem that a small company does not have enough IT to justify a fixed-fee IT service agreement, in reality it does. And unfortunately, without an ongoing agreement and a regular maintenance obligation, it is impossible to hold your IT partner accountable for how your company’s IT performs.
Need help?
Replicant IT is happy to help if you want:
Clarity on your IT and proper documentation
A European IT infrastructure configured securely and in line with best practice
A reliable, proactive and competent IT service partner
Get in touch and let’s talk!
