There was some chatter recently about how to help really small organizations out, so I thought I’d share how I approach them (and I encourage all of you to share your “baseline” recommendations)
When it comes to super-small orgs, my approach is to encourage them to come up to the level of what i recommend for most people for their home networks.
someone needs to be responsible for security. I don’t expect a security FTE (heck, in many of these orgs I don’t expect an IT FTE), but someone needs to be the person to talk to who’s willing to listen to advice.
MFA all the things. Odds are 95% of their critical assets are some form of SaaS. Turn MFA on. Using Google workspaces? Turn MFA on. If there’s an MFA setting in existence, turn it on. At your size this is a large portion of how you get compromised.
patching. I don’t expect a “vuln management” program. I expect “leave automatic updates turned on for this laptop you bought at a big box store and just started using”
endpoint protection. Similarly, “just leave the Windows Defender thingie that ships by default turned on” is fine for tiny orgs.
That’s really the baseline for most orgs. Where to level up?
network filtering. I’m not saying get a VPN. I’m saying get some sort of PDNS or PiHole equivalent or at least install an adblocker in the web browser. This will protect you from lots of phishing sites and malware delivery mechanisms.
separate computer accounts for everyone if there’s a central shared system. Bonus points if there’s a separate admin account so most of your users can’t just install things. Even if your users have the need to install things on their systems, setting them up with separate admin accounts will slow down them accidentally installing malware.
password managers! The good ones make it harder to enter passwords in phishing sites.
I like these recommendations. My biggest addition:
Make sure they have an asset inventory, including ways to track cloud resources as well as hardware. You can pitch it as a financial measure, tracking assets and making sure spend doesn’t get out of control, and (eventually) knowing when things are due for replacement.
Also I’d recommend that they start tracking where their intellectual property is, and making sure they are protecting it. Source code repos, cloud environments, Saas solutions.
These are all great recommendations! From my experience one of the biggest level-ups you can do in a super small org outside of the ones you’ve already mentioned is:
Getting them off of free-tier cloud services. Especially file sharing services like Google Drive, Dropbox, etc. When you’re working with super-small orgs like this the temptation from everyone there is to just use their personal email address, or a company prefixed free email address (ie smallorg.mustardfacial@gmail.com) which is dangerous in all of the obvious ways but also for DLP, which is a thing most small orgs don’t take into consideration.
Solving this problem doesn’t even need to involve the cost and administration of buying a domain and setting up LDAP and email or subscribing to Google Workspace. It’s a bit of a CapEx vs OpEx problem and each org is going to want to approach it differently but you can solve it with an old CAD workstation off of Marketplace, some NAS drives from Server Part Deals and an install of ownCloud / Nextcloud (I forget which one is the good one) and making them a private cloud. Or hell, and even easier solution is getting an old Synology and using the built-in private cloud features in DSM. It’s surprisingly robust.
It’s not the most secure setup in the world, but it doesn’t need to be. It just needs to work for them and be robust enough that they don’t YOLO setup a dropbox account out of frustration.
You know, if I were greenfielding a new business in 2026 (which, I guess I am?) I would do everything in my power to not only avoid The Goog, but also avoid Windows Active Directory as an identity dependency. While big business uses AD and will for years, choosing to onboard it today is a willful acceptance of massive, unncessary tech debt. I would work backward from an identity solution like Okta or open source Keycloak and figure out what else you need from there.
Most of the orgs I work with don’t have more than 5 people FTE and sometimes add a contractor or two.
What I’m seeing:
Co-mingling of personal data and business data
Too many services that do the same thing, or a fraction of the thing that the other one does, expanding third party risk and increasing OPEX. Generally I’m seeing up to 1300 / month for services
For those who can’t afford a second device, most are willing to make a new account that handles the ‘business’ use case.
What folks have been willing to adopt:
A hardware based MFA
How I’ve found modeling the conversation has helped build context.
In order to protect yourself, you need to know what you’re protecting. Who are you, according to the internet? Who do you want to be, according to the internet?
Actual vs. Legitimate Flow of Information:
Expectation of Flow: Users might have an expectation of how their information should be shared or kept private.
Legitimacy of Flow: The legitimate flow of information should be based on actual, practical considerations and societal norms.
Identity is Gold
Your identity is the single most valuable thing you own, and motivated people want it. Everything about your identity is used to gain access to manufacture, counterfeit, or coerce, consent (and access to your network to do the same).
• Your identity is a combination of factors, including your favorite things and even what your neighborhood looks like
• Your passwords and accounts matter more than your name or even your credit card information
• Who you know and what they can access is the big reason for leveraging your data, and is why social engineering is so dangerous. Think of what occurs in ponzi schemes or chain letters, now imagine if you scale that.