Data security is often described as complex and expensive, but for small and medium businesses the highest-risk issues are usually basic: former employees can still log in, the database has no backup, and administrator accounts are shared. Fixing these basics delivers more value than buying a sophisticated security product.
Accounts: one person, one account, revoke promptly
Shared accounts look convenient, but they make every action untraceable. At minimum, use one account per person and revoke access immediately when someone leaves or changes role.
- Manage administrator accounts separately and avoid using them for daily work;
- Enable two-factor authentication where possible;
- Review accounts that have not logged in for a long time.
Backups: only a backup if it can be restored
A backup is not finished when a scheduled job is created. An effective backup process is verified regularly: is the file complete, how long does restoration take, and is the restored data usable?
A backup that has never been restored is only psychological comfort.
Permissions: least privilege
The goal of permissions is not convenience but sufficiency. Assign the minimum permissions required by each role, keep approvals and logs for sensitive actions, and you can locate and contain problems quickly. For business systems, include the permission matrix as a deliverable at acceptance.