The Myth: “Microsoft 365 Handles My Backup Needs”

Let’s kick things off with some myth busting: many SMB owners and IT managers believe that Microsoft 365, on its own, offers comprehensive backup (or what we in the tech field call “redundancy”). While Microsoft 365 does have its own backup tool, which has some redundancy and “resiliency” – meaning that it helps to keep things running smoothly in the event of a catastrophe – it is not a comprehensive backup solution.  Solely relying on it would be putting all your eggs in one basket, so if by some miracle something went wrong with Microsoft, all your data would be gone. It’s kind of like having a safety net, but it’s not as robust as you might think.

Microsoft 365’s Native Capabilities

Now that we’ve dispelled that common misconception, let’s break down what its “resiliency” or “redundancy” means in practice:

• Deleted Items: If you delete something in your Microsoft environment – like an email or document – it doesn’t vanish into thin air, it goes to your deleted items folder.
• Recycle Bin: Now, if you delete something from your deleted items, or if you delete files and folders from SharePoint and OneDrive, they go into a recycle bin. It’s like the second level of your digital trash system.
• Retention Period: Here’s the catch: Microsoft keeps these items in the recycle bin for about 90 days (93 for services like SharePoint Online and OneDrive for Business). After that, they are permanently deleted. Microsoft gets rid of it because indefinitely storing deleted items in their data centres would be too costly for them and just wouldn’t make sense.
• File Versioning: Microsoft 365 also has some helpful features like version history in SharePoint and OneDrive. When you’re collaborating on a file, it saves different versions as people jump in and out, which is great for tracking changes. By default, there are around 30 versions of each document. As useful as this is, it’s not a backup — it’s version control. It’s important to remember that if you delete the entire document, it goes straight to the recycle bin and is subject to the same 90-day deletion rule.

So, while Microsoft 365 gives you a little bit of breathing room with deleted items and a recycle bin, it doesn’t actually back your data up, but saves it for a relatively short period of time. The main takeaway is that if you delete something by accident, and it sits there in the recycle bin for more than 90 days it’s gone forever.

The Biggest Gaps and Why They Matter

With data being worth more than gold, it only makes sense to protect it at all costs – especially when we start talking about cyber threats. Microsoft offers a host of tools that have cyber security backup features. This further speaks to the fact that Microsoft 365 on its own is definitely not enough to cover all your needs. So, what are the main shortcomings?

• Limited Timeframe: The 90-day retention period is a major limitation.  That’s a pretty tight window, especially when you’re busy running a business.
• Accidental Deletion: Microsoft 365 is not human error-proof. If you accidentally delete something important and don’t notice for three months, it goes straight to the recycle bin, and the clock starts ticking. Once 90 days have passed that data is gone for good and there’s no way to get it back.
• No Warnings: Here’s another catch: there are no reminders about items in the recycle bin that are about to be permanently deleted. There’s no handy alert that says, “Hey, this file is about to vanish!”. It’s up to you to keep on top of your data.
• No Coverage for Legal Requirements: If your company needs to keep data for a long time for legal reasons, Microsoft 365’s features simply won’t cut it. Some companies in construction, architecture, or the legal profession need to keep files for 9, 10, or even 15 years. The 90-day rule means you could find yourself in some real hot water with a client who, for example, asks for a file you mistakenly deleted two years ago. However, legal data loss is covered in some plans but not the ones typically used by SMBs – and this is where backup comes in.
• Not a True Backup: We’ve touched on this already, but it’s worth repeating before we move on: the versioning is great for tracking changes, but it is not an actual backup. This means if you delete the entire document, version history isn’t going to save it.

No matter what industry you’re in, there’s a lot at stake when it comes to data management. The real risk is that you might not even realise you’ve deleted something important until it’s too late. You might go on a sabbatical, or you might just forget that you deleted it. Next thing you know, four months later you need to reference that Word document in an important pitch you’re presenting to a major client in a few days and it’s nowhere to be found. This is where a proper backup solution really comes in handy. If you delete something by accident, a backup tool doesn’t delete it, it remains safe and sound – which brings me to my next point.

Why You Need a Dedicated Backup Solution

Here’s why you need that extra layer of security:

• Extra Resilience: A dedicated backup tool keeps your data safe even if you delete it – there’s no looming 90 day window. This means that your data is protected from accidental deletions and human error.
• Extended Data Retention: There are many reasons why you may need to hold on to your data for a long period of time. A proper backup solution allows you to do this.
• Protection Against Cyber Threats: If a hacker gets into your Microsoft 365 account, they could delete or steal all your data. Without a backup, you’re in serious trouble. They could lock you out of your account, or they could put something across all the data, or try to harvest it. A proper backup solution safeguards your data against these threats.
• Protection from Disgruntled Employees: It’s not just external threats you need to worry about. You might have a conversation with a disgruntled employee, and they could maliciously delete a load of data from a small file per se, and you might not even realise it until they’re long gone. A backup solution will protect you even then.
• Safeguard Against Human Error: Let’s face it, we all make mistakes. Most of us find ourselves juggling a million things at a time, making it all too easy to accidentally delete something without realising it. A backup is there to help when this happens, allowing you to restore lost data and keep your business running smoothly.
• Complete Data Protection: It’s important to remember that Microsoft 365 does not provide complete protection against all forms of data loss. Many people automatically think that they have complete data protection when they have Microsoft 365, but again, this is not the case. A proper backup solution is essential for complete data protection.

Having a comprehensive backup solution is not just about improving data hygiene, but is more so a best practice when it comes to strengthening your cyber security. If you don’t have a backup in place, you might not have other security measures in place. For example, you may not have Multi-Factor Authentication (MFA) turned on, which makes your account vulnerable. We’ve spoken before about how SMBs are the primary targets in the rise of cyber threats. If someone gets into your account, they could delete all your data and lock you out of your account. You could have a lawsuit on your hands if you have to declare that customer data has been compromised. Then there’s the additional cost of trying to retrieve said data from a hacker (which isn’t exactly full proof by the way).

Enter Acronis: Filling the Microsoft 365 Backup Gaps

So, we’ve established that relying solely on Microsoft 365 for backup isn’t the best idea. That’s why I strongly suggest using a separate vendor like Acronis (one of our trusted partners). They are industry leaders in what they do. While there are other vendors out there, we at Babble have developed a great relationship with Acronis. Here’s why I’m a fan of their work:

• Comprehensive Backup and Recovery: Acronis provides complete backups that are easy to recover. They are industry leading in what they do in terms of cyber backup.
• Advanced Security: Acronis has top-notch security, including protection against ransomware. They also encrypt data at rest, ensuring that your data remains secure at all times.
• Seamless Integration: Acronis integrates seamlessly with Microsoft 365, with the added benefit of being easy to use.
• Global Data Centres: Acronis has data centres all over the world. This is important for companies with satellite offices or those needing data stored in specific regions. If you need to have data in a certain region for legal reasons, you can do that with Acronis.
• Data Separation: Having your data backed up with a different company from Microsoft is just good business. If something happens to Microsoft, your data is still safe. It’s good to have your data stored with another company and not put all your eggs in one basket.

I can personally attest to the fact that the Acronis team are a great bunch to work with. They have an excellent product, which we have vetted and used ourselves. Valued partnership aside, the reasons why we use Acronis is because of their industry-leading security solutions, the way they encrypt data, and their global data centres.

Don’t Wait for Disaster: Secure Your Data Now

Making sure that every single person in your organisation is practicing good data hygiene is a lot to think about when you are managing your business. Babble is here to help you take the proper steps to protect your data and avoid catastrophe.

Remember, while Microsoft 365 provides some great tools, it doesn’t offer complete data protection. So, relying solely on Microsoft 365 for data backup leaves you vulnerable and exposed to all kinds of threats.

As a Microsoft cyber security expert at Babble, I’ve seen firsthand how not taking data backup seriously can take a business of any size out at the knees. My goal is to help you understand these risks and make informed decisions to protect your business.

The time to properly back up your data is now. We partner with industry leading vendors like Acronis to provide you with best-in-class backup solutions to keep your data safe. This gives you access to comprehensive backup and recovery, advanced security, seamless integration, global data centres, and data separation.

The Cornerstone: Multi-Factor Authentication (MFA) 

First and foremost: turn on Multi-Factor Authentication (MFA) right now (if you haven’t already). It is, without a doubt, the most impactful thing you can do to secure your Microsoft environment. Honestly, I can’t stress enough how crucial this is.  

MFA adds another layer of security to your password by requiring something else as well. This additional security factor could be using your face or fingerprint or verifying access on another app. Passwords get stolen all the time, so if this had to happen, MFA would prevent them from accessing your account without that second form of verification. 

The best part about it is that it’s free, and is included in both the Business Standard and Business Premium plans.  

Now, I know some of you might be rolling your eyes and saying, “Yeah Steve, we get all that, but MFA slows us down” or “It’s a hassle to have to use an app every time I want to check my emails”. And if you have employees using their personal devices, you might get some pushback about installing work apps. I’ve heard it all, and I get it: those extra seconds of logging in can briefly disrupt the flow of getting things done. 

But let me tell you, the minor inconvenience of using MFA is nothing compared to the potential disaster of a compromised account. Plus, there’s more than one way to skin this cat. You can set it up so you receive a call on a mobile number and then punch in a code. So, while the app is often the easiest way, you have options. 

We see this in our personal lives all the time now – logging into banking apps, shopping online – these extra security steps are becoming the norm. It’s no longer like the old days with VPN tokens (remember those?), it’s much easier now. Between us, I sometimes think it’s just a bit of complacency that stops people from using it. 

Taking Control: Conditional Access 

Once you have MFA firmly in place – seriously, I hope you stopped reading the article to switch that on – let’s talk about further strengthening your security posture with conditional access.  

What it is: This feature, available with Microsoft 365 Business Premium, offers a more advanced layer of security control. While MFA verifies who is trying to access your systems, conditional access focuses on how, when, and where they are trying to do so. 

How it works: With conditional access, you can restrict logins based on location, time, and the type of device being used – you can choose how granular you want to go. For example, if your entire workforce is primarily based in the UK and doesn’t typically travel for business, you can set a policy to restrict logins from anywhere outside of the UK. You can even block access attempts from high-risk countries known for ransomware and malware breaches.  

Why it matters: The beauty of setting your own policies is that you can tailor them to your operations. For instance, you might allow full access only from company-owned and managed devices. This level of control helps you refine who can access what and under what circumstances. 

Shielding Your Inbox: Microsoft Defender for Office 365 

Email remains a primary vector for cyber attacks like phishing and ransomware. This is what makes Microsoft Defender for Office 365 an incredibly valuable tool of defence against email-based attacks. 

Here are some key configuration best practices to get the most out of Defender for Office 365: 

• Scanning attachments and links: Firstly, make sure that you have it actively scanning email attachments and checking links. The keyword here is actively, because Defender is smart enough to look at where a link (“funnywebsite.com”) actually goes (“nastywebsite.com”), even if the displayed text looks innocent. Needless to say, it would be flagged as unsafe.
• Impersonation protection: In another article, we discussed how user impersonation is on the rise. Defender is great for protection against impersonation attacks. If someone outside your organisation tries to sneak into your system by impersonating a senior member of your team – like sending an email pretending to be your CEO asking for an urgent payment – Defender has mechanisms to identify and stop that.
• Continuous link scanning: Did you know that even a “safe” link can become compromised over time if the website it points to is hacked or if the linked document becomes infected? This happens because a link is essentially just a pointer to a location on the web, and that location can change even if the link itself doesn’t. One of the most surprising and valuable features is Defender’s ability to rescan links every time an email is opened, not just the first time. So, even if you received a safe document link from a colleague, if that document later becomes infected, Defender will catch it when you click the link again.

Securing Every Device: Microsoft Defender for Endpoint 

With remote work being the new normal, securing every device in your organisation is an absolute must. Why? Because each of these endpoints (i.e., laptops, phones, and tablets) is a gateway into your business. In other words, if one of them is compromised, the entire business is in jeopardy – this is where Microsoft Defender for Endpoint comes in. 

What it is: This solution is designed to protect your users from all sorts of malicious software, including malware and ransomware, which can steal your data or make your devices unusable. 

How it works: Defender for Endpoint works by constantly monitoring the device and its environment for any unusual activity. It looks for things like changes in user behaviour, how files are being structured, and how each device is used. If it detects something suspicious or out of the norm, it responds using a set of pre-defined security tools. 

Why it matters: It’s absolutely essential to have this in place and kept up to date because malware is constantly evolving and changing. The good news is that Microsoft provides regular updates to Defender to ensure it has the latest intelligence on threats and bad actors. 

Defender not only tries to keep devices clean but is quite proactive: it can also flag problems and automatically try to contain them. For example, if Adam in Accounting’s phone gets infected, Defender can help isolate it to prevent the issue from spreading to other devices, allowing you to respond quickly and effectively.  

Your Virtual Security Analyst: Microsoft Sentinel 

For SMBs that often don’t have dedicated security teams, Microsoft Sentinel is almost like having an in-house cyber security person, as its primary focus is threat detection and response. 

What it is: Sentinel is a centralised security information and event management (SIEM) and security orchestration, automation, and response (SOAR) solution. In English, it’s an engine that pulls in information about what’s happening in your Microsoft environment and then reacts to it. 

How it works: This reaction can involve advising a user to take action or automatically responding to problems on your behalf. However, it’s worth noting that while it helps you analyse the security-related data it extracts, detects threats, and automates responses, its recommendations should be taken with a grain of salt. SMBs will often say to themselves, ‘I’ve spent money on this product over here. I’m now safe. I can relax. I can just get on with the job.’ But herein lies the problem: it’s a program and not a person. Many applications only respond automatically to certain threats and often just report issues – which still requires someone to take action.  

Why it matters: Nonetheless, it’s still a useful tool because you need someone (or something) to tell you what’s wrong in order to fix it. Sentinel is great at gathering all the information you need and then asking you what you’d like to do about it. It’s like having an extra pair of eyes overseeing everything happening in your environment, helping you to react effectively even without a dedicated in-house security expert. 

Beyond Mobile: The Power of Microsoft Intune 

While Microsoft Intune secures all types of devices, it’s still a common misconception that it is only for mobile devices. Contrary to popular belief, your organisation’s laptops are not completely secure and locked down. They are just as susceptible to the same problems mobile devices are. This leads many SMBs to often overlook Intune’s broader security benefits and capabilities because they don’t understand what Microsoft Endpoint Manager (which includes Intune) can actually do for them.  

But this is not an attack (I come in peace!), and I get it: if you’re like most businesses, you’re simply too busy with your core operations to gain an in-depth understanding of the product stack. (If you did, guys like me would have to find a new line of work).  

What it is: As we’ve just clarified, Intune is not just for managing mobile devices: it’s a powerful tool for securing and managing a wide range of devices – from mobiles to desktops, it covers all endpoints.  

How it works: As a significant component of Microsoft 365 Business Premium, Intune allows you to create templated builds of devices, restrict what users can and cannot do, and centrally deploy applications and updates in a controlled manner.  

Why it matters: This level of control stops shadow IT dead in its tracks. In other words, Intune prevents users from installing anything without your knowledge or authorisation. It’s also a great solution to the Bring Your Own Device (BYOD) conundrum: let’s say your employees all use their personal cell phones for work but you still need to keep your business data secure. Intune blocks them from sending it via WhatsApp or typing copies of it, for example. If someone leaves the company, and they of course take their phone with them, Intune ensures that they no longer have access to the business data once they’ve left. All of this is managed centrally through policies and processes you can set up. 

A Unified Front: Leveraging the Microsoft Security Ecosystem 

Any Microsoft user will notice that a lot of the applications within the Microsoft stack are complementary to each other. So, individually they might provide protection at a certain level. But if you bolt on some of the other functions – like Endpoint on top of Defender on top of Defender for Office 365 – you’re then starting to protect the device, the data, and the email, and essentially beginning to create a growing shield of protection around your environment. 

Your Next Steps to a Stronger Security Posture 

And there you have it: an overview of the cyber security features built into your Microsoft licenses. Remember, the biggest impact comes not just from having the tools, but from using them effectively and making the most out of them. 

If you haven’t turned on MFA by the end of reading this, please do. I’d hate for you to have a breach simply because you didn’t activate this free security feature.  

While Microsoft provides a fantastic suite of security products, it’s also worth remembering that sometimes it’s beneficial to complement the Microsoft stack with certain third-party solutions. Not only can an expert like myself, help you optimise your current licences, but we at Babble provide tailored tech stacks that meet your unique business needs.  

It’s time to take full advantage of the security tools you have at your fingertips to keep your business protected – request a full security audit today! One of our experts will help you maximise your cyber security protection from your Microsoft licenses. 

Why Cyber Security is Non-Negotiable for Your SMB 

The reality is that SMBs in particular have the biggest targets on their backs and are the most vulnerable to cyber threats. Why? Well, there are quite a few reasons, but the main one is that they are much easier targets than large enterprises.  

Read more about why SMBs are targeted here. 

This is where Microsoft’s cyber security tools come into play: their enterprise-grade security solutions tailored for SMBs ensure that your business remains protected against looming cyber threats.   

What Makes Microsoft Stand Out    

At this point, you may be saying something along the lines of ‘Yeah, Phil, that’s great and all but there are thousands of cyber security tools on the market. Even though we use Microsoft to get work done, what makes them stand out when it comes to protecting my business?’. Well, I’m glad you asked – let’s unpack my top three reasons for  why Microsoft should be your starting point when building and optimising your cyber security stack:  

Seamless Integration 

Firstly, it’s the way everything works together. All of these tools communicate with each other and are part of the same ecosystem. Microsoft has its own data centres and this allows all of the products to work really nicely together. It’s a huge advantage to have that level of integration and it means that everything runs smoothly. Also, let’s not forget that Microsoft invests billions of dollars each year in security, so you’re getting cutting-edge protection. 

Cost-Effective  

A lot of these tools are bundled into Microsoft 365 business plans, which is a huge cost-saving. So, it’s far more cost-effective than buying separate solutions. It’s also good to know that they’re available on a monthly subscription (OpEx) which helps with budgeting. 

Easy to Implement 

In terms of implementation, MFA is the easiest to get started with. Defender for Business also has good out-of-the-box protection, but some of the other tools are a bit more complex, so you might need some help there. 

The Essential Microsoft Cyber Security Toolkit for SMBs 

Having spent years immersed in the world of Microsoft, I’ve handpicked a set of cyber security solutions perfect for SMBs. These tools aren’t just about reacting to threats — they’re about proactively securing your business against both current and future risks, all while being easy to use and affordable. 

Before we dive in, it’s worth noting that these are not one size fits all solutions. Comprehensive cyber security needs a tailored approach, so they may not be right for your business’s unique cyber security needs. While we’ll be covering the most important tools for most organisations, I still highly recommend getting an individualised cyber security audit to determine your best stack.  

However, these are great tools to use a first step towards securing your business and improving your overall data hygiene and security posture. Alright, let’s get into it: 

1. Multi-Factor Authentication (MFA)

The great thing about MFA is that it’s often free as part of your Microsoft 365 subscription. 

What it is: MFA is a security system that requires more than one method of authentication to verify a user’s identity before granting access to an account. It’s part of Microsoft Entra ID and adds an extra layer of protection beyond just a password.  

How it works: You’d need to provide additional verification like a code from your mobile phone, a biometric scan, or another security key. This extra step keeps cyber criminals out even if they’ve gotten their hands on your password. 

Why it matters: MFA is your first line of defense against account takeovers. The reason why I put it at number one is because unauthorised access is the biggest cause of fraud, and it’s so easy to fix with MFA. So, if you have Microsoft 365, there’s really no excuse not to use it.

2. Microsoft Defender for Business

This one is a key part of the Microsoft security ecosystem and is specifically built to help SMBs improve their security. 

What it is: Microsoft Defender for Business is an enterprise-grade antivirus solution designed for SMBs. It’s not just about blocking viruses; it’s about keeping your devices secure with proactive threat detection.  

How it works: If you’re on a Windows device, it’s likely already there – look for the little shield icon in the corner. It’s designed to keep all your devices safe and secure by providing real-time threat detection and protection for your devices. This tool actively scans for malware, viruses, and other malicious software, preventing them from infecting your systems.  

Why it matters: Securing devices is one of the three most crucial areas in protecting your business. The increase in remote work coupled with the growing sophistication of cyber threats, makes this solution a must-have to keep your devices safe regardless of where your team is located.

3. Microsoft Defender for Office 365

Email security is absolutely paramount. Given that it’s the main form of communication for all businesses, cyber criminals are actively trying to infiltrate your inbox.  

What it is: Microsoft Defender for Office 365 is a specialised security tool designed to protect your email communication within the Microsoft 365 environment. Think of it as a security guard for your email that checks for malicious links, attachments and other phish-y behaviour.  

How it works: It scans incoming and outgoing emails for malicious links and attachments. It also examines documents for potentially harmful content. This tool is constantly working in the background to identify and block threats before they reach your inbox.  

Why it matters: When hackers get into an account, they target emails and often sit back and watch how you communicate for months before they make their move. Their goal is to gain as much information as possible so that they can trick you into handing over the keys to the kingdom. 

4. Microsoft Intune

Touching on my earlier point about the rise in remote work brings me back to the importance of device security, Microsoft Intune helps you do just that.  

What it is: Whether it’s mobile phones, laptops or anything else, Microsoft Intune is a go-to tool for securing and managing your organisation’s devices – no matter where they are being used. 

How it works: With this device security solution, you can set policies, control access, and even wipe a device remotely if it gets lost or stolen. Intune ensures that all devices have the latest antivirus software, that passwords are in place, and that devices are configured according to the policies set by the company. It also allows your IT team to manage everything from one central place. 

Why it matters: A simple policy like restricting access to Office 365 to only company-owned devices drastically improves cyber security. Every company needs to make sure that every single device their organisation uses is not only managed but secured – especially when teams are split across the globe.

5. Microsoft Information Protection

Your data is precious, and Microsoft Information Protection helps you keep it close to your chest.  

What it is: This tool is designed to secure sensitive data within Microsoft 365, including platforms like SharePoint and OneDrive. It focuses on applying extra security around documents both when they’re sitting on your device and being sent. 

How it works: Microsoft Information Protection provides additional layers of security by adding extra encryption to your documents and emails – allowing you to control who can download, forward, or copy them. It also allows you to label your information based on its sensitivity. 

Why it matters: You wouldn’t want any sensitive information falling into the wrong hands. Microsoft Information Protection provides extra control over it by preventing unauthorised access and preventing data breaches. As a bonus, implementing a labelling system encourages data hygiene by making you think about how sensitive the information is – and more importantly, how to manage it.  

Bonus: Microsoft Secure Score 

This one nicely ties together everything we’ve just discussed. While this isn’t something you install, it’s something you absolutely need to be using. 

What it is: Microsoft Secure Score is a built-in tool quietly running in the background that gives you a score out of 100, showing how secure you are compared to similar organisations, based on Microsoft’s benchmarks. This score looks at your security settings and is readily available to Microsoft 365 users. 

How it works: Upon logging in, those with administrative access can see the company’s score along with recommendations on how to increase it. Microsoft Secure Score also provides details on areas where Microsoft spots potential vulnerabilities in your cyber security.  

Why it matters: This is such a valuable tracking tool for management to see how secure the business is compared to others in their industry. Plus, the advice this tool gives on how to improve your score is automatically updated as security technology evolves. Did I mention that it’s free too? 

A Word of Implementation Advice 

Implementing these tools is usually where things can get tricky. Even tools that seem easy to use need to be set up correctly. For example, if Intune isn’t set up with the right policies, it might not protect your devices. You may think it’s working, but in reality, it’s not doing anything at all – and you wouldn’t know until it’s too late. If you go it alone and you aren’t sure what you’re doing, you could be exposing your company to risks. So, if you can, work with a partner who knows what they’re doing. 

Stepping Up to Enterprise-Level Security 

Another question you may be asking is ‘How do these tools compare to the enterprise-level ones?’. The tools I’ve mentioned cover all the cyber security bases for SMBs. As you grow, you might want to step up to enterprise-level tools, which offer more granular detail, automation, and data. However, the SMB tools are still a fantastic place to start. The enterprise-level tools work off these ones as a baseline. For example, with enterprise-level Defender, you can set automated policies, so it locks out certain devices if there are threats. You also get a lot more data and analysis back, which is useful for internal IT teams. For example, with Entra ID at the enterprise level, you can get it to recognise geographically impossible login attempts and block them. 

Your Next Steps to a Stronger Security Posture 

This is all a lot to digest, and it can be overwhelming to keep pace with cyber threats that move at lightning speed. But the good news is, you don’t have to go it alone. We at Babble are here to be your trusted advisor: after doing a cyber security audit, our experts will ensure that the security tools we provide are tailored to your business.  

Remember, all SMBs are likely to experience a cyber attack at some point. Being the primary targets coupled with the fact that cyber threats are getting increasingly sophisticated, makes implementing proactive cyber security measures even more crucial.  

As one of the leading Microsoft Partners in the UK, we understand the solutions to these challenges inside and out. Babble is here to help you navigate this often-complicated journey. This blog has gotten the ball rolling by outlining the key steps you can take to protect your business today.  

What’s next? Start by implementing Multi-Factor Authentication (MFA), which is free and essential for preventing account hacks. Then explore Microsoft’s bundled offerings for cost-effective solutions. Once you have decided on your cyber security tools, take advantage of the free resources on Microsoft Learn to educate yourself and your team on how to implement and manage them effectively. 

What is a Tech Stack?

Before you ask, a tech stack is not a giant heap of hard drives, physical firewalls, and the like. In simple terms, your tech stack is the makeup of the products and solutions that you use to get your work done. While there are more complex layers when we talk about cyber security, at its core, your tech stack is the elements that make up the technology needed to secure your environment.

The purpose of building a tech stack (i.e., investing in multiple cyber security solutions) is to have a multi-layered defence system to protect your valuable data and ensure that your operations don’t stop for a second in the event of a breach.

Sounds good, right? But there’s a catch: simply investing in cyber security tools doesn’t necessarily keep your business safe. This is probably what brought you to this article in the first place. While not putting all your eggs in one basket by investing in multiple solutions is just good business, you can still have too many or too few eggs in your basket.

One of the first questions I ask my clients is: “Is your current tech stack genuinely working for you?”. It’s crucial to identify whether your investments are paying off or if they’re creating more problems than solutions. So, how do you determine if your current tech stack is working for you or against you? Let’s discuss it!

Tech Sprawl: When More Isn’t Better

Let me give you a scenario I’ve seen all too often:

Michael, the owner of a growing SMB, recently read our article highlighting the fact small businesses are the primary targets for cyber attacks. In a panic, he quickly began adding new cyber security tools to his organisation. Some were recommended by his managed security service provider (MSSP), and others he chose himself due to attractive reviews or vendor promotions.  

Soon, Michael’s employees noticed issues: antivirus programs started conflicting with endpoint security software already installed by the in-house cyber security team, causing frequent system slowdowns and operational headaches. Instead of increased protection, the overlapping technologies created confusion, leading frustrated employees to disable or bypass essential security features just to get their work done efficiently. 

This, my friends, is “tech sprawl”: the excessive use of many different tools, some of which overlap or even counteract each other. By rushing into investments without proper coordination, Michael took on unnecessary expenses and his business ended up with redundant, conflicting solutions that provided less protection than a single, strategically chosen and properly integrated suite.

Understanding what stack you currently have (before buying any more) is important because you want to focus your spending and energies on the areas that are most critical to you as a business.

How to tell if you have too much in your tech stack:

Overlapping Tools

Do you have multiple tools performing essentially the same functions? Like Michael, many SMBs buy equipment that already comes with a host of free software tools like antivirus, anti-ransomware, etc. Because they don’t know this, they then deploy more tech on top of what they already have.

Productivity Bottlenecks

Is your security hindering your team’s efficiency? Think of your cyber security tools as eager children wanting to help. But instead of silently running in the background, they’re too busy competing against each other to protect your business, which of course slows operations down.

Financial Burden

No matter how big or small your business is, cost is always important, and any investment a business makes has to showcase value – tech is no exception. Having too many tools in your stack means you’re paying for multiple products and services that essentially do the same thing. You may not notice this right away, but you’ll surely realise your misstep once you have a look at the numbers. So, before you hop on the latest trend, ask yourself: “What value does this tool set bring to my organisation?”. 

Tech Minimalism: When Less Leaves You Vulnerable

At this point, you may be thinking that adopting the ‘less is more’ approach to your tech stack may be the best way to proactively mitigate tech sprawl – but think again. At the opposite end of the spectrum lies “tech minimalism”: where you’ve got too few products or services in place to actually do the right job and keep your business safe.

Remember Michael who stacked his tech to the brim? He has a friend Sophie, who has the opposite approach when it comes to protecting her business. Running a thriving small consultancy firm, Sophie prides herself on keeping overheads low and running a lean operation. To save on costs, Sophie opted for a free antivirus program for her team’s devices, assuming it provided enough protection since they hadn’t experienced issues before. 

One morning, Sophie woke to dozens of frantic calls from the office. An employee clicked on a seemingly harmless email, unknowingly triggering ransomware that locked critical client files. Because Sophie’s minimalist approach didn’t include robust endpoint security or email protection, her basic antivirus solution failed to detect and stop Hailey the Hacker’s attack. 

Sophie now faced an unexpected crisis: downtime, lost productivity, and worst of all, damaged client relationships. The costs to recover from the breach far exceeded what she would have spent investing proactively in a comprehensive cyber security stack.  

Before you Marie Kondo your tech stack, have a look at what you have and see if you’re making the most of it.

How to tell if you have too little in your tech stack:

Insufficient Protection

All businesses heavily rely on email, which is why it remains the largest attack vector (tech geek for a hacker’s favourite place to live). This is the first place you want to protect. At the very least, your emails need to be scanned.

Focusing Solely on Cost Savings

Are you looking for ways to tighten your belt instead of prioritising what kind of protection your business needs? A free solution might seem appealing at first, but whilst you think you’re making a saving because you haven’t had to buy it, the reality is that you’re not protecting yourself properly and leaving your business exposed.

Long-Term Costs Outweighing Short-Term Savings

Closely tied to my last point, having too slim a tech stack has a larger adverse effect than you think. Again, you might be saving money month on month, but the long-term impact on your business could be far more expensive. You’re essentially looking at either spending a few extra hundred Pounds or facing bankruptcy if you have a data breach.

Regular Tech Audits to Balance Your Stack

Cyber technology is in a constant state of flux: a tech stack that was perfectly adequate last year may fall short of meeting today’s challenges. So, it’s crucial to find a balance between keeping up with the changing environment and maintaining your security posture by keeping a close eye on your tech stack.

A prime example of this is what happened during COVID. One day, your organisation had a tech stack that was traditionally based around people working from an office. This meant that your data was being held in a single location and accessed primarily from that location. Then the world changed overnight, and all of a sudden, your whole workforce was sitting in various locations and accessing that data differently.

I’m in no way trying to manifest another pandemic (touch wood!), but I want to stress the importance of scheduling regular tech audits to assess your current stack and identify any vulnerabilities or gaps.

Integration: Ensuring Seamless Collaboration Between Your Tools

Beyond just the number of tools, integration is key. If your data is scattered across disparate systems, your team will struggle to access it and make informed decisions. Well-integrated tools offer advantages in data management and data loss prevention (DLP), ensuring your most valuable asset is protected.

You’ll also have the added benefit of knowing exactly where your data is stored, how it’s protected, and who has access to it. This includes considering data leakage when employees leave. Poor integration can lead to dreaded data silos and lost productivity. A great example of this is when clients are keen to jump into Microsoft Copilot without having the right data management measures in place. Poorly managed data can become a vulnerability with AI tools – but I digress.

Tech Alone Isn’t Enough: The Value of User Awareness Training

Before we go our separate ways, I cannot overemphasise the significance of user awareness training. You can invest in the most advanced technology available, but if your employees aren’t using it correctly, it won’t provide the protection you need. Educating your people about cyber threats and best practices is the most valuable investment you can make in your organisation’s security.

It’s like having a perfectly secured home with alarms, flood lights, video cameras and window locks. But if you leave the front door open, people can just walk in. It doesn’t matter what you do from a spending perspective, education is absolutely key.

Finding Your Tech Stack Balance: Empowerment and Expert Guidance

You should now feel more empowered to assess your current tech stack and determine if it truly aligns with your business needs. Remember, finding the right balance isn’t about having the most tools but about having the right tools working effectively for you. But, don’t feel pressured to navigate this alone – help is available.

We’ve explored the dangers of both “tech sprawl,” where overlapping and conflicting tools hinder productivity and strain your budget, and “tech minimalism,” which leaves you vulnerable with insufficient protection. The core challenge is ensuring your technology investments are genuinely contributing to your security and operational efficiency.

Engaging an outside expert can offer a fresh perspective and help you steer clear of common pitfalls. I view it as a meeting of the minds, where I can combine my specialised knowledge of technology with your intimate understanding of your business.

Don’t wait until a problem arises. Establish a relationship with a trusted partner who can guide you through the process and assist you in making well-informed decisions to balance your tech stack.

Why Employees Are Your Biggest Cyber Security Risk

As we have just seen, employees are the biggest cyber threat to the companies they work for. Mimecast attested to this in their State of Email and Collaboration Security (SOECS) 2024 report: over two-thirds of their respondents believed that their employees were putting their organisations at risk. 

We’ll talk about how in a second, but I want to kick things off with a story – it’s a scary one and based on true events, so you may want to sleep with the light on tonight:

A customer (we’ll call him Sam) is booking a hotel room for an upcoming corporate event. This, of course, is happening over email, and while details are being ironed out, another person – masquerading as an accounts manager from the hotel – hops in the thread (we’ll call her Hailey). 

Hailey sends Sam an email with a legit-looking invoice attached, kindly asking him to make a deposit. Like most of us, Sam gets about 256334 emails a day, so he doesn’t think anything of it. He doesn’t want to lose his reservation either, so he sends the invoice straight to Finance, and because he’s a big wig in the company, they waste no time in making the payment.  

A few days go by, the event is around the corner, and Sam receives an email from the hotel reminding him to pay for his room. After picking his jaw up from the ground, Sam scrolls through his emails and finds two invoices from the hotel. They’re identical except for one thing: the bank details. Instead of paying the hotel, Sam’s company paid Hailey the Hacker (who is probably sipping margaritas on a beach somewhere). 

Getting hacked isn’t always as obvious as being locked out of your devices and a creepy message demanding a massive ransom flashing across all of your screens. Cyber attacks are getting more sinister and evolving at lightning speed, and we have seen a dramatic increase in user impersonation.

Impersonating users can happen in two ways: someone could be sitting in a mail account at the hotel, watching invoice emails come and go. Or someone could be sitting in the director’s email environment and changing the details.

Regardless of which route the hacker takes, they are solely relying on one thing: an employee not knowing any better. This, my friends, is just one example of why human error is the biggest cyber threat to your business – let’s unpack more.

How Employees Unintentionally Put Your Business at Risk

When customers ask me why they should prioritise their employees as a major cyber security risk, I always start by saying this: people will click on anything. Secondly, most of us have terrible password hygiene (this, thankfully, has nothing to do with body odour, but creating the most basic passwords that might as well be tattooed on our foreheads). Lastly, with remote work being the new normal, more and more people are working on their devices or connecting to insecure networks. There are so many more reasons I could go into, but this is an article, not a book.

Problem One: Trigger Happy Clickers

Before you bring the hammer down on your organisation, just know that it’s not always out of malice: sometimes people are just incredibly busy. They see an email that looks like something they were expecting, they click on it, and it takes them somewhere bad – or they pay the wrong person, like poor Sam.

Hackers are masters at duplicating legitimate pages, so it’s all too easy to fall for their antics. For example, a page will look just like a typical Microsoft landing page, but if you don’t know what to look for in a URL, you’re in trouble. That’s where user awareness training comes in.

Solution: Targeted Threat Protection and Email Content Control

There are ways to get around random clickers. You can have Mimecast targeted threat protection, which stops fake URLs from being clicked on. Or it can “sandbox” it. Cisco Umbrella can also block URLs linked to dubious sites or newly created domains.

Mimecast CyberGraph flags when someone is added to an email thread or impersonates someone using a different email address. It’ll prompt the user to check before replying. You can also improve email content control by adding a banner on the email, advising the user to double-check before replying.

Problem Two: Weak Passwords and Unauthorised Websites

Weak passwords are another common vulnerability. If your password is easy enough to guess, then you should probably change it. But having a strong password is only half the story.

In my previous article, I spoke about how employees are notorious for going onto unauthorised websites that they use to transfer data and input their company details. This is another reason why password protection is so crucial: it’s more than just ensuring that it includes a bunch of special characters; you have to guard it like the life of the company depends on it (which it does).

Another client of mine (we’ll call him Frank) had an ironclad password but made the mistake of putting in his company username and password on an unauthorised hosting environment. Having fallen for her trap, Hailey had access to Frank’s corporate network through the hosting environment and put ransomware on all of their servers. The cost of hiring a third party to clean up the mess was a three-figure sum.

Paying a ransom (if you have it) is not exactly a solution. Even if you pay the hackers, they may republish the stolen data on the dark web for others to use. That’s why you have to have systems in place to check the dark web for credential hacking to ensure user information is secure.

Solution: Password Hygiene

To improve password hygiene, enforce a stringent password policy with alphanumeric special characters and two-factor authentication. Multi-factor authentication (MFA) might annoy users, but it adds an extra step to the login process.

Problem Three: BYOD (Bring Your Own Device) Risks

Employees using their own devices for work is risky business. Unless they’re tech geeks, their devices are guaranteed not to have the same security as company-issued ones. Shadow IT is almost inevitable because they’ll visit all kinds of sites (hopefully outside of working hours), and download sensitive company information onto their devices.

Pause here and ask yourself this question: should employees be able to access your company’s most valuable data on their devices? If so, why?

Overall, it’s more difficult to keep an eye on and manage personal devices compared to company ones (this isn’t Big Brother).

Solution: Data Loss Prevention (DLP) Policies

If employees use personal devices to access corporate information, you need to have policies in place to prevent them from downloading information to their devices. Data loss prevention (DLP) measures should control whether a user on a personal device can access your crown jewels.

Getting Employees to Follow Security Practices

At this point, it’s painfully clear that every single member of an organisation is responsible for keeping the business safe. But life gets in the way, to-do lists become never-ending, and emails seem to multiply by the minute. So, even after implementing watertight security policies, many employees don’t follow them and end up using shadow IT to get the job done as quickly as possible.

It bears repeating that keeping your business safe is not a one-time thing: your cyber security strategy needs to constantly be monitored – and that includes employee behaviour. Not to be dramatic, but if just one person in the organisation drops the cyber security ball, the whole business is at risk.

Controlling Human Error in Cyber Security

In a perfect world, cyber security wouldn’t be something you’d constantly need to stay on top of, but it is. It’s not just about spending money either: you need to ensure your cyber security solutions are as effective as the people using them.

It may all seem a bit doom and gloom, but the reality is that human error is the biggest cyber security risk. I didn’t write this article to scare you but to show you that while your biggest threat lies within your organisation, it’s a problem you can control.

I’ve shared insights from my years of experience helping businesses bolster their cyber security, with an anecdote or two that should help you learn from the mistakes of others.

Empower your people by investing in user awareness training, which should cover password hygiene, two-factor authentication, AI, and email use in a corporate environment. It all goes back to the saying: when you know better, you do better.

What is Shadow IT?

Shadow IT, at its core, involves employees using systems and applications that haven’t been approved or even vetted by management or the IT department. This includes everything from alternate email and customer relationship management (CRM) systems to off-site data repositories and unapproved chat apps. It may seem harmless or convenient for employees to use whatever tech solutions they please, but the cyber risks are substantial.

Might Shadow IT Be a Risk Factor for Your Business?

Before we talk strategy, let’s talk a bit about why shadow IT is a huge internal security risk in the first place. It turns out that shadow IT can open up a whole can of worms – let’s unpack this scary bunch:

Security Risks

Shadow IT can introduce what I like to call ‘Trojans’: viruses and malware that sneak into your systems. This happens when data is pulled back into the business from unapproved repositories that may contain threats. Think of it like bringing a stray animal into your home – you don’t know where it’s been or what it’s carrying!

Unexpected Costs

Apart from the filed expenses, are you aware of every single service or solution every person in your organisation is signing up for? If you’re like most SMBs, the answer is mostly likely no. But you’re not alone: many businesses have stories where they have suddenly received a bill for additional hosting that they were not aware of – and no one approved.

Compliance Nightmares

When you’re auditing your data, how do you know that all your data is in one place? With data scattered across unapproved hosting environments, businesses can go from being very compliant to having no idea where their data is, making compliance impossible. This extends to AI by the way: shadow IT makes it difficult to know where your data is stored, especially when using AI to process or generate information – more on that later.

Acquisition Complications

If your business is based on a Mergers & Acquisitions model, this point is for you. During company acquisitions, shadow IT systems can complicate data audits, making it difficult to articulate the location of all data to the core business. What this means in English is, that when one company is buying another, shadow IT can throw a wrench into figuring out where all the important data is located. It’s like trying to assemble a puzzle when you don’t even know if you have all the pieces.

How to Identify and Mitigate Shadow IT

Now that we’re aware of the dangers of lurking in the shadows, let’s switch gears and chat about how to shine a light on your tech stack. A question that always pops up when I talk to my clients about deciphering whether they have shadow IT or not is, “How do you know what to prevent if you don’t know it exists?”. This is fundamental to ask because the more solutions you have in your tech stack, the more difficult it is to gauge which ones are helping or harming your business.

So, the first step in tackling shadow IT is knowing how to find it. You need to implement systems to scan your environments and see what applications your users are actively using. This may be quite daunting if you have a relatively large organisation, but tackling shadow IT doesn’t require a massive budget. There are many ways to gain visibility and control that are easy on the pocket – here are a few to get you started:

Web Activity Monitoring

Monitoring web activity helps to identify if employees are using applications or websites not approved by the business. Without this visibility, identifying shadow IT becomes nearly impossible.

Hosting Environments

More often than not, employees work on their hosting environments on platforms like AWS or Azure for short-term projects. People might think, ‘I need to get this done by the end of the week. I’ll just spin this up and expense it later’. That simply can’t happen: remember, shadow IT is any tech solution that has not been preapproved – and that includes hosting environments.

Proactive Blocking

In addition to monitoring, consider proactively blocking specific sites that employees should not be browsing during work hours, especially on work devices. This is not about blocking the obvious ‘not safe for work’ sites but has much more to do with ensuring that your company data doesn’t fall into the wrong hands.

While access to approved corporate systems should be permitted, measures should be in place to ensure employees cannot use personal accounts or methods to interact with these systems in a way that could compromise data security. What does this mean? Well, I’m glad you asked – let’s break this down:

• Allow Access to Corporate Solutions: Ensure employees can use approved tools like corporate Box accounts.
• Prevent Access with Private Details: Block employees from accessing corporate systems (like Box) using personal email addresses.
• Prevent Data Transfer via Private Email: Implement measures to stop employees from sending data from corporate systems to their email addresses.

The name of the game here is data loss prevention (DLP): ensuring that all data interactions within corporate systems are monitored and controlled. This of course prevents the unauthorised copying or transfer of data (what we in the biz call ‘data exfiltration’).

Proactive Measures to Prevent Shadow IT

With our shadow IT detectors sharpened, let’s take a look at the bigger picture and how you can prevent or manage shadow IT. Building long-term security requires a multi-faceted approach. This means that to truly protect your business from threats like shadow IT, you can’t just rely on one solution. I like to look at security at multiple levels: from individual devices to your network’s edge.

Endpoint Protection

Let’s go back to my Trojan metaphor: the antivirus software on your computer that protects it from viruses masquerading as harmless emails is basically what endpoint protection is – just supercharged and designed for businesses. “Endpoint” refers to devices like laptops, desktops, and servers. So, endpoint protection helps prevent these machines from being compromised and used to attack internal servers or Active Directory servers, which could damage the entire network.

Edge Security

Think of your company’s network as a castle. Edge security is like having guards at the castle walls (the “edge” of your network) to control who comes in and what they can do. It’s all about setting rules about where users can and can’t go, and what they can and can’t access. It gets very draconian, but from a security point of view, you don’t want your users going here there and everywhere either without that activity being monitored.

What’s worse is having a disgruntled user accessing your crown jewels (which is data in this case) – whether that’s financial information, proprietary code, or intellectual property. You want to avoid a situation where an employee shares sensitive information with competitors – which brings me to my next point.

A Quick Word on Employee-Related Risks

We can’t talk about the tech without mentioning the people buying and using said solutions.  In this article, I talk about what makes your employees the biggest internal security risk, but for now, I’ll say this: Keep a close eye on employee behaviour, especially those who’ve given their notice.

Imagine this: Laura, a long-time marketing employee, hands in her resignation. While everyone wishes her well, a silent clock starts ticking in the IT department.

The IT team flags Laura’s account, not because they distrust her, but because they need to ensure company data (crown jewels) remains secure. Tom in IT then goes ‘Right, monitor what that user is doing in more detail than others’. So, they monitor where she’s going on the web and what data she’s moving around.

But it’s not just about laptops and data transfers. Be aware that sensitive information can be shared in social settings, not just through technological means.

Perhaps Sarah mentions a new marketing campaign to a friend at a networking event, inadvertently sharing confidential information with a competitor. It’s not always about malicious intent or clicking on a ‘phish-y link’. Sometimes, it’s a casual conversation that poses a risk. This is why awareness and vigilance are so important, both in the digital and physical realms.

Taking Control of Shadow IT

You now have practical strategies to start tackling shadow IT within your organisation. Remember, you’re not alone in this fight. Many businesses face the same challenges, and with the right approach, you can regain control of your IT environment.

Shadow IT poses significant risks, including security breaches, compliance nightmares, and unexpected costs. By implementing the steps outlined in this blog, you can mitigate these risks and protect your business.

As a cyber security expert at Babble, I’m committed to helping businesses like yours navigate the complex world of cyber security – after all, these things are usually best left in the hands of a trusted partner.

Take the first step towards a more secure IT environment by reading my blog, Why Your Employees Are Your Biggest Security Risk to get a comprehensive understanding of how you can keep your business safe from all angles.