The most effective way for a small organization to stop remote attackers is to make every remote and administrator login require strong multifactor authentication, close or restrict unnecessary internet-facing services, keep systems patched, secure remote-control tools, and preserve isolated backups and useful logs. These controls work together: if an attacker steals a password, MFA should stop the login; if a device is compromised, segmentation and least privilege should limit movement; if systems are encrypted or destroyed, tested backups should restore operations.
The steps below are based on U.S. Cybersecurity and Infrastructure Security Agency (CISA) guidance for small and medium-sized businesses. They are a practical baseline, not a substitute for an organization-specific architecture, legal review, or industry compliance assessment.
As an Amazon Associate I earn from qualifying purchases.
Start with the paths a remote attacker can use
Remote attackers usually do not need to break through every device on a network. They look for one usable path: a stolen cloud password, an exposed VPN portal, an internet-facing server with an unpatched flaw, a remote-control application that nobody is monitoring, or an administrator account with excessive privileges. Once inside, they try to reach more systems, steal data, disable defenses, and delete backups.
Map those paths before buying new tools. Make an inventory of:
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Cloud identity, email, file-sharing, accounting, and line-of-business systems.
- VPN gateways, remote desktop services, firewalls, wireless controllers, and other remote-access infrastructure.
- Remote-control and remote-support applications installed on workstations or servers.
- Administrator, service, vendor, and shared accounts.
- Servers, storage appliances, network devices, laptops, and other assets reachable from the internet or from a remote session.
- Backup systems and the credentials that can modify or delete them.
For each entry, record who can connect, from which devices or locations, what authentication is required, what resources become reachable after login, and where activity is logged. You cannot secure an access path that nobody knows exists.
Do the highest-value work first
A small team can reduce exposure quickly by treating security work as a sequence of decisions rather than a large technology project.
- Protect privileged and remote identities. Require multifactor authentication (MFA) for every account that can reach the organization remotely and every privileged or administrative account. Remove dormant accounts and separate administrator accounts from ordinary daily-use accounts.
- Disable unnecessary exposure. Turn off unused VPN profiles, remote desktop listeners, remote-control agents, internet-facing management interfaces, and firewall rules. Restrict unavoidable services to named users, approved devices, and required resources.
- Patch the systems that accept remote connections. Prioritize VPN appliances, firewalls, remote-access servers, identity systems, email, browsers, endpoint agents, and externally reachable applications.
- Review remote-control software. Inventory every agent, verify its owner and business purpose, remove unauthorized installations, and alert on unexpected sessions.
- Verify recovery. Ensure critical data and system configurations are backed up automatically, keep a copy isolated from routine administrator credentials, and perform a restoration test.
- Turn on practical logging. Collect authentication, VPN, remote-control, administrator, endpoint, and backup events in a place someone reviews. Define how long logs must be retained for operational and legal needs.
These actions address the most common remote-entry and recovery failures without assuming a particular firewall, identity provider, or cloud platform.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Require phishing-resistant MFA for remote and privileged access
Password theft is common because a password can be phished, reused, guessed, or exposed in a breach. MFA adds another factor, but not every factor offers the same protection. CISA’s small-business guidance says to confirm that “all remote access to the organization’s network and privileged or administrative access requires multifactor authentication.” Aim for a phishing-resistant method wherever the identity system and application support it.
Choose the strongest method the environment supports
| Method | Security characteristic | Deployment considerations |
|---|---|---|
| FIDO/WebAuthn hardware security key | CISA describes a physical security key as the strongest method in the hierarchy on its small-business MFA page. FIDO/WebAuthn can block a login when a user is directed to a fake website. | Check compatibility with the organization’s identity provider, applications, browsers, and user devices. Keep a controlled replacement process for lost keys. |
| App-based MFA | CISA places app-based methods below a physical security key in the hierarchy described by its “More than a Password” guidance. | Use it where a security key is not supported, and protect the phone or device hosting the authenticator with its own screen lock and update process. |
No single hardware model is universally compatible, and CISA does not endorse a particular brand. Test enrollment, sign-in, recovery, and help-desk procedures with a small pilot group before requiring a method for everyone.
Roll MFA out without creating a recovery loophole
- List every identity source and application that permits remote or privileged access, including vendor and service accounts.
- Mark accounts that can change MFA, reset passwords, create administrators, alter firewall rules, or modify backups. Protect these accounts first.
- Enroll two approved authentication factors for each critical administrator, stored separately so one lost device does not lock out the organization.
- Require MFA for ordinary remote users, then remove legacy sign-in methods that bypass the policy.
- Test sign-in from an ordinary workstation, a managed mobile device, and an untrusted network. Confirm that a password alone cannot reach the protected resource.
- Document identity-proofing and emergency recovery. A help-desk reset that relies only on easily guessed personal details can undo the protection MFA provides.
Keep break-glass accounts rare, monitored, and unavailable for normal work. Store their credentials securely, test them under supervision, and alert whenever they are used.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Treat VPNs and remote-control tools as privileged entry points
A VPN or remote-support agent is not automatically safe because it is a commercial product or because it uses encryption. It creates a route into systems that may otherwise be unreachable. CISA and partners’ June 18, 2024 alert describes risks from traditional remote-access and VPN deployments, especially when they are misconfigured, and encourages organizations to evaluate approaches such as Zero Trust, Secure Service Edge (SSE), and Secure Access Service Edge (SASE) for greater visibility and control.
Review the VPN
- Inventory every gateway, client, profile, certificate, and account that can establish a tunnel.
- Require MFA for the VPN and for the identity provider behind it.
- Limit each group to the networks and applications it actually needs. A contractor who needs one internal application should not receive broad access to servers and management interfaces.
- Disable unused protocols, old accounts, test profiles, and split-tunnel settings that conflict with the organization’s risk model.
- Restrict administrative access to the VPN itself, and alert on configuration changes, new accounts, failed logins, and unusual countries or times.
- Keep the gateway and its client software current. Subscribe to the supplier’s security advisories and have a documented emergency patch process.
Do not publish device-specific firewall rules without knowing the organization’s equipment, addressing, applications, and regulatory requirements. The safe rule is to expose only what is necessary and to verify each exception.
Control remote-control and remote-support software
CISA’s June 6, 2023 Guide to Securing Remote Access Software notes that threat actors increasingly co-opt remote-access software to reach victim systems. The same software used by a support technician can provide an attacker with interactive control if an agent is installed, an account is compromised, or a session is left open.
- Use endpoint management or a software inventory to find every remote-control agent, including portable or browser-based tools.
- Assign an owner and business purpose to each installation. Remove agents nobody can explain.
- Restrict installation and use to authorized administrators and approved support personnel.
- Require MFA, unique accounts, least privilege, and session approval where the product supports them.
- Disable unattended access unless it is essential. If it is essential, limit the host, schedule, and account that can use it.
- Record connection time, source account, source device, destination host, commands or file transfers where available, and whether the session was approved.
- Alert on an agent being installed, a new administrator being created, an unexpected support session, or access outside normal operating patterns.
When a support relationship ends, remove the provider’s accounts and agents immediately, rotate shared secrets, and verify that no scheduled task or service remains.
Reduce the attack surface and patch in risk order
Every enabled service is a possible entry point. Begin with a simple exposure review: scan the organization’s public addresses, inspect firewall and cloud security-group rules, and compare the results with the asset inventory. Close ports and services that have no documented owner or purpose. Management interfaces should not be directly reachable from the public internet unless there is a compelling, reviewed reason.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsBuild a repeatable update process
CISA’s small-business resources list software updates as a core practice. The goal is not merely to install occasional patches; it is to know what exists, learn when a security update is available, deploy it, and verify that the system remains functional.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Maintain an inventory with operating system, application, firmware, owner, and location.
- Prioritize internet-facing systems, identity infrastructure, remote-access software, browsers, endpoint protection, and devices holding sensitive data.
- Use automatic updates where they are reliable and compatible with operations. For systems requiring manual changes, assign an owner and a due date.
- Test important updates in a representative environment or during a planned maintenance window.
- Track exceptions with a reason, compensating control, owner, and review date.
- Retire unsupported systems or isolate them from remote access until replacement is possible.
A patch process should include network devices and security appliances, not just employee computers. Attackers often target the systems that control access because compromising one can expose many others.
Limit what a compromised account or device can reach
MFA reduces account takeover, but it does not stop every attack. A stolen session, infected laptop, malicious insider, or compromised vendor account can still operate within the permissions it has. Use least privilege and segmentation to contain the damage.
Separate users, servers, management, and backups
- Place servers and administrative interfaces in networks that ordinary user devices cannot reach directly.
- Separate backup infrastructure from production systems and restrict who can modify backup jobs or retention settings.
- Keep guest and personal devices away from business resources.
- Use device and user identity, not only an IP address, when deciding whether access is allowed.
- Permit administrative protocols only from managed administrator workstations or approved jump hosts.
- Review service-account permissions and remove interactive sign-in where it is not required.
Segmentation does not have to mean rebuilding the entire network. Start with the systems whose compromise would stop operations or expose the most sensitive information, then add barriers around them.
Secure endpoints used for remote work
Require supported operating systems, automatic screen locking, disk encryption where available, endpoint protection, and prompt installation of updates. Do not allow an unmanaged personal computer to receive the same network access as a managed business device. If remote work requires personal devices, place access behind application-level controls and limit the data that can be downloaded.
Administrators should use separate, hardened devices or profiles for privileged work. Web browsing, email, and office tasks performed under an administrator identity make phishing more consequential.
Back up for recovery, not just for storage
Backups are a security control because ransomware and destructive attacks often target both production data and the backups used to recover it. CISA’s small-business materials include backups and recommend that organizations consider how backup data is protected and restored. CISA guidance for managed-service relationships also calls for automatically and continuously backed-up critical data and system configurations, with air-gapped backup storage.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Design a recoverable backup system
- Identify the data and configurations required to resume operations: files, databases, identity settings, network-device configurations, application settings, and documentation.
- Automate backups and monitor for failures. A job that has silently failed for weeks is not a backup strategy.
- Keep at least one copy isolated from ordinary administrator accounts and production network paths. Air-gapped storage provides stronger separation where practical.
- Protect backup administration with MFA and separate privileges for reading, writing, deleting, and changing retention.
- Define recovery priorities and acceptable downtime for each critical service.
- Perform restoration tests. Verify that data is complete, credentials work, applications start, and the organization can operate while systems are rebuilt.
Record the date, scope, and result of each test, then correct the failures. A backup that cannot be restored under pressure is only an assumption.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Collect logs someone can use
Logging turns a suspicious event into an investigation. At minimum, collect successful and failed authentication, MFA changes, VPN connections, remote-control sessions, administrator actions, endpoint detections, firewall changes, and backup failures or deletions.
Centralize logs so an attacker who gains control of one workstation cannot erase the only copy. Restrict access to the logging system, synchronize device clocks, and define retention based on the organization’s operational, contractual, and legal needs. CISA’s small and medium-sized business resource collection includes logging guidance and points to tools for smaller organizations; choose an approach the team can actually monitor.
Create a short list of alerts that require human action:
- Successful administrator login from an unusual location or device.
- Repeated MFA failures followed by a successful login.
- Creation of a new administrator, VPN profile, remote-control agent, or forwarding rule.
- Large downloads, mass file changes, or backup deletion.
- Remote access outside approved hours or from a country where the organization has no staff.
Document who receives each alert, what evidence to preserve, and when to escalate to a specialist or law enforcement.
Use cloud services deliberately
CISA advises small businesses to consider secure cloud versions of email and file storage when maintaining on-premises systems exceeds their capacity. Moving a service to the cloud does not remove security work: the organization still controls accounts, MFA, sharing permissions, devices, retention, and recovery.
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
Before moving or expanding a service, decide who owns configuration, who approves external sharing, how administrator access is protected, how logs are reviewed, and how data is recovered if an account is deleted or compromised. CISA names Google Workspace and Microsoft 365 as examples of cloud services in its small-business guidance; those examples are not endorsements and do not replace configuration review.
Make an MSP or outside support provider accountable
An outside provider may administer firewalls, endpoints, cloud accounts, backups, or remote-access tools. That can improve capability, but it also creates a high-value third-party access path. CISA’s MSP and small-business guidance provides a basis for asking how the provider protects its own access and customer environments.
Questions to put in writing
- Does every provider employee use an individual account and MFA, preferably a phishing-resistant method?
- Are provider permissions limited by customer, role, device, and task?
- How are provider accounts removed when staff change roles or leave?
- Who owns backup data, backup credentials, retention settings, and restoration testing?
- Are critical data and system configurations backed up automatically and continuously, with an isolated or air-gapped copy?
- Which logs will the organization receive, how quickly are security events reported, and who investigates them?
- How are emergency changes approved, documented, and reviewed afterward?
- What happens to accounts, agents, credentials, and data when the contract ends?
Put the answers, service boundaries, response times, notification duties, and evidence requirements in the service agreement. A provider should supplement the organization’s controls, not become an unmonitored exception to them.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Prepare for a suspected remote compromise
Decide in advance what the team will do if an account, VPN, or remote-control tool is abused. Keep an offline copy of contact details for leadership, the IT provider, identity and network administrators, legal counsel, cyber-insurance contacts if applicable, and relevant authorities.
- Confirm and preserve. Record the time, affected account or device, alerts, screenshots, and relevant logs. Avoid wiping a system before evidence is preserved.
- Contain. Disable or isolate the affected account, device, VPN profile, or remote-control agent. Do not disable every control blindly if doing so would destroy evidence or interrupt critical safety functions.
- Protect identities. Reset credentials from a known-clean device, revoke active sessions and tokens, rotate exposed service secrets, and verify MFA methods.
- Check scope. Search for new accounts, forwarding rules, persistence mechanisms, lateral movement, unusual data access, and backup tampering.
- Recover carefully. Rebuild or restore from a known-good backup, patch the initial weakness, and reintroduce systems in a controlled order.
- Learn and document. Identify which control failed, update the inventory and procedures, and test the revised process.
If sensitive information or regulated systems may be involved, obtain appropriate legal and incident-response advice before making notification decisions. The correct obligations depend on jurisdiction, industry, contracts, and the facts of the incident.
A practical 30-, 60-, and 90-day plan
First 30 days: remove obvious paths
- Inventory remote-access services, remote-control agents, administrators, vendors, and internet-facing assets.
- Enable MFA for privileged and remote access, starting with administrators and provider accounts.
- Disable dormant accounts, unnecessary services, and unexplained remote-control agents.
- Patch exposed gateways, identity systems, operating systems, browsers, and endpoint software.
- Verify that backups are running and perform one restoration test.
Days 31–60: contain damage
- Apply least-privilege access to VPN groups, cloud applications, servers, and management interfaces.
- Separate user, server, management, guest, and backup networks where practical.
- Centralize authentication, VPN, remote-control, administrator, and backup logs.
- Write the incident contacts, escalation steps, and evidence-preservation procedure.
- Review the MSP or support contract and close gaps in MFA, permissions, backups, logging, and offboarding.
Days 61–90: improve resilience
- Pilot phishing-resistant FIDO/WebAuthn keys for administrators and users whose systems support them.
- Test recovery of critical applications and configurations, not only individual files.
- Review alerts and investigate sample events to ensure someone can act on them.
- Evaluate whether Zero Trust, SSE, or SASE approaches would provide better visibility and access control than the current remote-access design.
- Schedule recurring access reviews, patch reviews, backup tests, and remote-tool inventories.
Common mistakes that undermine the plan
- MFA only for ordinary users. Attackers prioritize administrators and remote gateways; those accounts need protection first.
- Assuming a VPN is a security boundary by itself. A compromised VPN account can expose everything the account can reach.
- Allowing broad vendor access indefinitely. Access should be named, limited, monitored, and removed when the work ends.
- Keeping backups on the same credentials and network as production. An attacker who controls both can encrypt or delete both.
- Installing more monitoring than the team can review. A smaller set of actionable alerts is more useful than an ignored flood.
- Ignoring cloud configuration. A secure provider cannot compensate for weak accounts, open sharing, or unprotected administrator access.
- Skipping restoration tests. Recovery assumptions fail when credentials, dependencies, or system configurations were never included.
- Using unsupported equipment because replacement is inconvenient. Document the risk, isolate the device, and create a funded replacement plan.
How to choose the next security investment
When several options appear reasonable, compare them against the organization’s actual constraints:
- Resistance to phishing: Prefer methods that prevent a fake-site login, such as FIDO/WebAuthn where supported.
- Compatibility: Confirm support for existing identity systems, applications, browsers, and user devices before committing.
- Access granularity: Ask whether access can be limited by user, device, application, network, and resource.
- Visibility: Verify which authentication, session, configuration, and data-access events are logged and how they will be reviewed.
- Operational burden: Include enrollment, lost-device recovery, patching, alert triage, and staff training in the workload.
- Recovery: Check whether the design protects backups and preserves a workable path when a provider, device, or identity system is unavailable.
- Total cost: Include licenses, replacement hardware, implementation time, support, testing, and the cost of maintaining exceptions.
The best control is one the organization can deploy consistently, monitor, recover from, and improve. A modest design with enforced MFA, limited access, current software, isolated backups, and actionable logs is safer than a complex design that nobody owns.
Recommended Free Tools
What this guidance can and cannot establish
CISA’s material is general U.S. federal guidance. It does not determine the right firewall rules, retention period, network topology, contractual terms, or compliance obligations for a particular organization. Those decisions depend on the organization’s industry, jurisdiction, data, equipment, cloud services, staffing, and tolerance for downtime. Review current CISA materials and the documentation for each system before implementation, and obtain qualified assistance when internal capacity is insufficient.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
