Ready for the Tuesday morning you hope never comes.
Most of security is quiet work done in advance: hardening, MFA, backups that restore, a review of where you stand. The rest is knowing exactly who to call, and what happens next, when something gets through. I handle both, for small businesses across Vancouver and the Lower Mainland.
or call 778-384-4479
The quiet work that makes a bad morning shorter.
Protection sized to your business, not to an enterprise budget. Each of these either stops an incident or decides how fast you recover from one.
Hardening
Computers, servers and Microsoft 365 or Google Workspace set up with the risky defaults switched off, disk encryption on, and updates that actually install.
Access control & MFA
MFA on email and remote access, separate admin accounts, and access that matches each person’s job. When someone leaves, their access leaves the same day.
Backup & disaster recovery
Versioned, off-site copies a stolen login can’t delete, with restores tested on a schedule. This is the line that decides how the afternoon below goes.
Risk reviews
Where you stand today, ranked by risk and effort, on one page. There’s a sample further down.
Insurer & client questions
Cyber insurance applications and client security questionnaires, answered accurately, with the evidence ready to show.
A written response plan
One or two pages: who to call, in what order, your insurer’s breach line, and what comes back first. The timeline below is that plan, running.
If you’re hit on a Tuesday morning.
What the day looks like when a client with a plan and working backups calls me. Your part is short. Mine is the rest.
-
08:52Notice
Something looks wrong
Files on the shared drive have odd names and won’t open. Or a client calls about a strange email that came from your account.
YouStop. Don’t switch anything off or delete anything. Call me.
-
08:55Call
One number
You call 778-384-4479. I answer, and I already know how your systems are set up, so there’s no explaining your network to a stranger.
YouTell me what you saw and when.
MeA few quick questions, then a decision on what to cut off first.
-
09:10Contain
Stop it spreading
The first job is to stop the damage growing, before working out how it started.
YouKeep people off the affected machines. Carry on where I say it’s safe.
MeIsolate affected computers, disable the accounts involved, sign out every session, reset passwords, remove any forwarding rules an attacker added.
-
09:45Insurer
Call the breach line
If you have cyber insurance, the policy usually wants to hear early. The number is in your written plan, so nobody hunts for it.
YouCall your insurer’s breach line. They may assign their own response team.
MeBrief them on what I’ve seen and work alongside whoever they bring in.
-
11:00Scope
What was touched
Which accounts, which files, which machines, and how they got in. Evidence is kept before anything is cleaned up, because the insurer will ask for it.
YouAnswer questions about who was doing what this morning.
MeReview sign-in logs, mailbox activity and device alerts. Preserve logs and copies for the insurer.
-
13:30Recover
Back from clean backups
Affected machines are cleaned or rebuilt, and files come back from the last backup taken before the problem started.
YouConfirm what comes back first. It’s already agreed in the plan.
MeRestore in the agreed order, check the restored files open, and watch for any sign the attacker is still around.
-
17:00Working
People back at their desks
Staff are working again on clean machines, with new passwords and MFA checked on every account.
YouLet staff know what happened, in plain terms. I can help with the wording.
MeKeep watching overnight for anything unusual.
-
Wed 10:00Follow-up
Write it down, close the gap
A written account of what happened, what was affected and what I changed, so it can’t happen the same way twice.
YouIf personal information was involved, decide with your lawyer and insurer whether it has to be reported under PIPEDA or BC PIPA.
MeGive you and your advisers the technical facts, then fix whatever let it in.
An illustrative example, not a promise. Real incidents vary and some take days; what stays the same is the order of the work. For managed IT clients I respond the same business day, and I help other businesses as quickly as I can. If it’s happening now, call 778-384-4479.
Where you stand, on one page.
A review ends with a single page an owner can read in five minutes: what I found, how much each item matters, how hard it is to fix, and what to do first. The detail comes with it for whoever does the work.
- Ranked by risk and by effort, so the cheap, important fixes go first.
- Written for the person who signs the cheques, not for another IT firm.
- Lines up with what insurers and clients ask, so it doubles as your evidence.
I do every review myself, and I’m the one who picks up on a Tuesday morning. 778-384-4479
Summary
| # | Finding | Risk | Effort |
|---|---|---|---|
| 01 | MFA is not enforced on every mailbox | High | Low |
| 02 | No off-site backup copy; restores never tested | High | Medium |
| 03 | Former staff accounts still active | High | Low |
| 04 | Daily work done from an admin account | High | Low |
| 05 | Laptops without disk encryption | Medium | Low |
| 06 | Guest Wi-Fi shares the office network | Medium | Low |
| 07 | No DMARC record on the email domain | Medium | Low |
| 08 | File server past the end of vendor updates | Medium | High |
| 09 | No written incident response plan | Low | Low |
Risk (up) against effort to fix (across). Shaded: do these first.
Fix first: 1, 3 and 4. All high risk, all fixable in days. Then 2, which needs a backup service chosen.
On site across the Lower Mainland when it matters.
Reviews and most fixes are done remotely, and so is most of an incident response. When a machine needs to be pulled off the network or rebuilt in person, I come to you, from Vancouver, Burnaby and Richmond out to Surrey, Langley and Abbotsford. Remote help anywhere in BC.
- Vancouver
- Burnaby
- Richmond
- Surrey
- New Westminster
- Coquitlam
- Port Coquitlam
- Port Moody
- North Vancouver
- West Vancouver
- Delta
- Langley
- White Rock
- Maple Ridge
- Pitt Meadows
- Abbotsford
- Mission
- Chilliwack
Questions about security and incidents
01We’re a small business. Are we really a target?
02What does a security review involve, and what do we get?
03Can you help with our cyber insurance questionnaire?
04Do we have to switch IT providers to work with you?
05What happens if we get hit?
06Do privacy laws like PIPEDA or BC PIPA apply to us?
07Will MFA and tighter security slow my team down?
08Isn’t OneDrive or Google Drive already our backup?
Get a plan in place before you need it
The quickest start is a free IT assessment, or a call to 778-384-4479. Prefer to write it down? Tell me what you run and what prompted the question, an insurance renewal, a client’s form or a near miss, and I’ll suggest a time to talk.
Dealing with something right now? Don’t use the form. Call 778-384-4479.