Security and patching

Many of the write-ups take one flaw that attackers are using and set out who runs the affected software and what to update or check. They follow the software a small business actually runs: WordPress and its plugins, Microsoft 365 and Windows, the firewall or VPN box at the office, shared hosting control panels like cPanel, and self-hosted tools such as GitLab and Metabase.

The article on CISA's directive BOD 26-04 turns priority into four yes-or-no questions: whether the thing can be reached from the internet without a login, whether the flaw is on CISA's list of vulnerabilities in active use, whether the whole attack can be scripted, and whether it hands over full control. Four yeses means you patch tonight, and three means this week. Everything else waits for your normal routine.

That routine is plain: automatic security updates on every machine that supports them, and a monthly window on the calendar for the updates and restarts that need a person. Put the firewall, the VPN box and any network storage on the same calendar, because automatic updates do not reach them.

Some of the risk sits with your suppliers. If an IT provider manages your computers, its remote management tool is a way into every one of them, and the article on the N-central breach lists the questions to ask your provider. The same goes for the company that hosts your website.