Image: WTMJ
Last week, WTMJ highlighted that the average cost of a data breach for a small business reached $4.88 million in 2024, according to IBM's Cost of a Data Breach Report. For a 40-person firm in Wausau, that number isn't just a statistic—it’s an extinction-level event. Most local business owners I speak with think they are safe because they aren't 'Fortune 500 targets,' but local financial records are actually high-value commodities on the dark web because they are often stored behind weaker authentication protocols than global banks.
When we look at the financial sector, the risk isn't just a stolen credit card; it’s business email compromise (BEC). If a bad actor gains access to your Microsoft 365 tenant, they aren't looking for trade secrets—they are looking for your accounts payable workflow. They observe your vendor payment patterns, clone an invoice from a known supplier, and change the routing number. By the time you notice the discrepancy, the funds have been laundered through three different crypto-exchanges. This is the reality of the threats we face in Wisconsin today.
Implementing Hardened MFA Protocols
Passwords are effectively obsolete. In my twenty years as an IT consultant, the single biggest improvement a local firm can make is moving from SMS-based multi-factor authentication (MFA) to FIDO2-compliant physical hardware keys, like YubiKeys. SMS codes are susceptible to SIM-swapping attacks, where a thief convinces your mobile carrier to port your number to their device. If your firm handles payroll or vendor payments, you should enforce Microsoft Entra ID Conditional Access policies that explicitly require hardware-backed authentication for any user with access to financial applications or banking portals.
The "Least Privilege" Audit
In a 40-person company, it is common to see 'Domain Admin' rights distributed too broadly for the sake of convenience. I once worked with a local accounting firm that gave every staff member full read-write access to the entire file server. When one employee clicked a phishing link, the resulting ransomware encrypted every single client file, including tax returns and payroll records, in under 20 minutes. You need to segment your network. Use Azure Role-Based Access Control (RBAC) to ensure that your HR manager can only access payroll folders and your AP clerk can only access the payment portal. If an account is compromised, the blast radius must be contained to that single user's limited scope.
Practical Steps for Monday Morning
You don't need a massive budget to improve your posture by Monday. Start with these three concrete actions:
- Audit your Global Admins: Go into the Microsoft 365 Admin Center and verify that no more than two people have Global Admin rights. Everyone else should have a standard user role with specific, delegated privileges.
- Enable 'Conditional Access' policies: If you are on a Business Premium license, ensure that sign-ins from outside Wisconsin—or even outside the United States—are automatically blocked unless you have a verified, business-critical need to travel.
- Review 'Mail Flow' rules: Check your Exchange environment for any rules that automatically forward emails to external domains. Attackers often add these to exfiltrate your communications without you ever knowing.
The Human Element of Compliance
Training isn't about watching a generic video; it's about recognizing behavioral anomalies. Teach your team to treat any 'urgent' request for a change in payment details as a red flag, regardless of who the email claims to be from. I recommend setting up a secondary 'out-of-band' verification process: if an email arrives requesting a change to a vendor's bank account, call the vendor at a verified number—not the one in the email signature—to confirm. This simple process has stopped more theft than any software filter I’ve ever installed.
Security is a continuous cycle of verification, not a one-time project. Whether you are scaling your local operations or trying to stabilize your current infrastructure, I am here to help you build a resilient environment that keeps your business moving forward. You can reach out to me via my contact page to discuss a security audit or explore my managed service options today.
If you want to read more, check out the original article.
20+ years in IT systems, automation, and full-stack development. Learn more →