Caldera Cybersecurity
Recap
Caldera Cybersecurity  •  NM & CO
17 / 18
Speaker Notes
Recap the four. Reassure them this is a starting point they can act on now — most of it is free.
Caldera Cybersecurity
Live Webinar

4 simple security habits
every small business
can do on its own.

No enterprise budget. No IT department. Just four practical habits that stop the attacks small businesses actually face.

Start the walkthrough →
Use ← → or scroll↓
The reality

Small businesses are the target — not the exception.

Attackers go where defenses are thin, and they count on small teams having no one watching. The good news: the habits that stop most of them cost little or nothing — and you can start this week.

43%
of cyberattacks target small businesses
254K
Average cost of a cyberattack targeting a small business
$0
Cost to start most of today's four habits
The promise

No IT department.
No big budget. Just four habits you can start this week.

The agenda

Four habits, four wins.

A practical checklist you can run on your own.
01
Turn on multi-factor auth
A second lock a stolen password can't open.
→
02
Update & patch
Closing the doors attackers walk through.
→
03
Back up your data
Your undo button when files disappear.
→
04
Limit administrator access
Fewer keys to the kingdom, fewer ways in.
→
Practice 01 / 04

Turn on
multi-factor auth.

A password is one lock. MFA adds a second proof — something you have or something you are — so a stolen password is useless on its own.

Phone Security key Biometrics
Types of MFA

Not all factors are equal.

Email codes
Only as safe as the inbox they land in
WEAKEST
Text-message codes (SMS)
Better than nothing, but can be intercepted
BASIC
Authenticator app
Free rotating codes — strong & easy
STRONG
Push approval
Tap to approve — just don't approve blindly
STRONGER
Hardware key & biometrics
A physical key or your fingerprint
STRONGEST
Where to turn it on first

Protect your email before anything else.

START HERE
Email
Email is the master key — password resets for everything else land here. Lock it down first, then work outward.
02
Banking & payroll
03
Accounting software
04
Cloud & admin accounts
⚠
Choose an app or hardware key over SMS wherever it's offered.
Practice 02 / 04

Update
& patch.

Updates aren't nags — they're locked doors. Every patch fixes a flaw attackers are actively looking for. A huge share of breaches exploit holes that already had a fix.

The race to patch

Every patch closes a window of risk.

1
A flaw is found. A weakness in your software becomes public.
2
A patch is released. The maker ships a fix — for those who install it.
3
You apply it. The door is locked. The faster you update, the smaller your exposure.
What to keep current

Turn on automatic updates — everywhere.

01
Operating systems
Windows & macOS
02
Browsers & apps
The tools you use every day
03
Phones & tablets
They hold your email too
04
Routers & firmware
The most-forgotten device of all
CAN'T AUTO-UPDATE?
Set a monthly patch day
Pick one day a month to check and apply updates across every device.
A PERMANENT OPEN DOOR
Retire end-of-life software
Once a product is unsupported it's never patched again — replace it.
Practice 03 / 04

Back up
your data.

A backup is your undo button for the bad day — ransomware, a dead drive, a stolen laptop, or the wrong folder deleted.

Ransomware
Hardware failure
Theft & loss
Accidental deletion
The 3-2-1 rule

Keep three copies, two kinds of media, one immuteable, off-site.

3
Local copy — an external drive or NAS
Fastest to restore from — but it sits in the building with you.
2
Cloud copy — automatic & off-site
Microsoft 365, Google, or Backblaze copy files automatically and survive a fire or flood.
1
One copy off-site & disconnected
A copy ransomware can't reach because it isn't plugged in.
Your files Local drivefast restore Cloudautomatic & off-site Off-site vaultdisconnected
Make it actually work

A backup you've never tested isn't a backup yet.

01 · AUTOMATE IT
Don't rely on memory
Manual backups get skipped. Set them on a schedule so they run whether anyone remembers or not.
02 · TEST THE RESTORE
Try getting a file back
Every so often, actually restore a file. A backup that won't open in an emergency is the worst kind.
03 · KEEP ONE OFFLINE
Unplug a copy
Ransomware encrypts everything it can reach. A disconnected or versioned copy stays safe.
Practice 04 / 04

Limit admin
access.

Admin accounts are the keys to the kingdom — they can reach everything. One compromised admin can mean your whole network, so give each person only the access they truly need.

Least privilege

Most people don't need admin privileges.

Give each role the minimum access it needs to do the job. The fewer keys at the top, the fewer ways an attacker can take over everything — and the smaller your target.

Administrator Managers / IT Power users Standard users — everyone else Fewer keys at the top = a smaller target
Four simple rules

Don't hand out admin like it's candy.

01
Two accounts, not one
A standard account for daily work; a separate admin account only when making changes.
02
Never share a login
Shared admin passwords can't be traced and never get changed. One account per person.
03
Remove access fast
When someone leaves or changes roles, shut off their access that day.
04
Review who has it
Once a quarter, list who has admin and remove anyone who no longer needs it.
The recap

Four habits. Start them this week.

✓
Switch on MFA — email first, app or key over SMS.
✓
Turn on automatic updates — close the doors attackers use.
✓
Back up your data — 3 copies, 2 media, 1 off-site & tested.
✓
Limit admin access — least privilege, reviewed regularly.

Bring your questions.
We'll bring the coffee.

Book a free Caldera Coffee Break — a relaxed, no-pressure call to talk through these four habits and figure out where your business should start.

Scan to book your coffee break
Book online →