Image: wausaupilotandreview.com
Recent reports indicate that hundreds of Wisconsin election offices are missing basic cybersecurity safeguards, including multi-factor authentication (MFA) and routine patch management. For a 40-person business in Wausau, this isn't just a government issue—it’s a warning sign for your supply chain. If your logistics providers, legal counsel, or payroll processors share the same vulnerabilities found in these municipal offices, your data is one lateral move away from being compromised.
When infrastructure is neglected, the risk isn't limited to the primary target. According to the Cybersecurity & Infrastructure Security Agency (CISA), 90% of successful cyberattacks begin with a phishing email, a vulnerability that thrives in environments without robust MFA. If your business depends on third-party vendors who operate with the same lax protocols as these election offices, you are essentially outsourcing your security posture to someone else’s outdated firewall.
The Multi-Tenant Risk Factor
Imagine your payroll provider uses a local server hosted in a shared facility that also manages municipal data. If that facility is breached, the attacker doesn't just get access to ballot counts; they get access to your employee PII (Personally Identifiable Information). I’ve seen this happen in our region where a minor vulnerability in a shared SQL database led to a breach across three different industries. The technical failure wasn't a sophisticated zero-day exploit; it was a lack of proper Role-Based Access Control (RBAC) in a Windows Server environment.
Mapping Your Exposure
You need to identify where your data lives outside your four walls. Start by listing every SaaS platform and managed service provider (MSP) you interact with daily. If you use Microsoft 365, check your Conditional Access policies today. Are you enforcing per-user MFA, or are you relying on legacy protocols that allow attackers to bypass simple password requirements? If your vendor cannot provide a SOC 2 Type II report, you are operating with an unacceptable level of blind risk.
Monday Morning Action Plan
Do not wait for a audit to start cleaning up your permissions. First, run a 'Least Privilege' audit on your own network. Using Microsoft Entra ID (formerly Azure AD), generate a report on all guest accounts and external service providers that have 'Owner' or 'Global Admin' access. Delete anything that hasn't been active in the last 30 days. Second, review your third-party vendor contracts. If they don't explicitly require the vendor to report a security breach within 24 hours, you need to renegotiate that SLA immediately. Third, deploy an endpoint detection and response (EDR) tool like Microsoft Defender for Endpoint across all company-owned hardware. Stop relying on basic antivirus; you need telemetry that shows you exactly what a process is doing in real-time.
Hardening Your Perimeter
Infrastructure security is not about buying more expensive software; it is about rigorous configuration. I often see companies paying for high-end licenses but failing to disable legacy authentication protocols like POP3 or IMAP, which are massive vectors for credential stuffing attacks. In Wisconsin, where we rely on a tightly knit network of local contractors and service providers, one compromised login can lead to a domino effect across the region's commercial infrastructure. Hardening your environment means assuming your neighbors are already compromised and building your internal walls accordingly.
Strategic IT Oversight
I have spent two decades helping businesses navigate these exact risks, from setting up hardened Azure environments to implementing zero-trust architectures that prevent lateral movement. If you are concerned that your current IT setup has 'gaps' similar to those recently exposed in our local municipalities, it is time for a professional review of your configurations. Reach out to me at jon.lat/#contact to discuss how we can secure your operations before a minor vulnerability becomes a major financial loss.
If you want to read more, check out the original article.
20+ years in IT systems, automation, and full-stack development. Learn more →