Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The most effective defense is disciplined basic security, not a Russia-specific product. Protect business email, cloud storage, remote access and administrator accounts with strong unique passwords and phishing-resistant multifactor authentication (MFA); patch known exploited vulnerabilities promptly; reduce unnecessary remote access; train staff to report suspicious messages; keep isolated, encrypted backups and test restoration; and prepare an incident-response plan before anything goes wrong.
U.S. CISA, the FBI and the NSA describe spearphishing, brute-force attempts and exploitation of known vulnerabilities as historical methods used by Russian state-sponsored actors. That advisory describes threat patterns, not a finding that every small business is being targeted. The controls below are therefore sensible resilience measures for any small firm, with extra attention to those access methods.
What the Russian cyberattack warning actually means for a small business
Official advisories describe how Russian state-sponsored groups have gained access in the past:
- Spearphishing: targeted email or messages designed to trick a person into opening a link, attachment or login page.
- Brute force: repeated attempts to guess or reuse passwords against exposed accounts.
- Exploitation of known vulnerabilities: attacking software, appliances or services that have a published flaw but have not been patched.
A small company may be reached directly, through a supplier, or simply encounter the same exposed services as a larger organization. The guidance does not establish that Russian actors are targeting every small business, and it supplies no statistic showing a specific rate of Russian attacks against small firms. Use the threat methods as a prioritization lens rather than as a prediction.
CISA’s small-business resources organize the foundation around phishing avoidance, strong passwords, MFA and software updates, then add logging, backups, encryption and incident response. Those basics address the same weaknesses that make spearphishing, password attacks and unpatched systems effective.
Do these five things first
- Secure high-value accounts. Turn on MFA for business email, file storage, remote access and every privileged account. Remove shared accounts and unnecessary administrator rights.
- Find and patch exposed software. Inventory operating systems, routers, firewalls, remote-access tools, cloud applications and internet-facing services. Prioritize flaws known to be exploited in the wild.
- Reduce the attack surface. Disable unused remote-access services, restrict necessary access to named users and approved devices, and monitor the access that remains.
- Make recovery independent of the network. Keep encrypted backups offline or otherwise isolated from ordinary user accounts, and perform restoration tests.
- Decide what happens during an incident. Assign an internal contact, an alternate, a technical helper and a reporting route before systems have to be taken offline.
These actions are more valuable than buying a new security product without changing account, patching and recovery practices.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How to protect business accounts from phishing and brute force
Inventory every account that can open a door
List email, payroll, accounting, customer databases, file storage, remote desktop or virtual private network (VPN) access, domain administration, backup consoles and security tools. Record the owner, business purpose, administrator status, MFA method and recovery contact. Close accounts for former workers and remove dormant guest access. A short inventory prevents an overlooked mailbox or backup login from becoming the weakest entry point.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchUse unique passwords and eliminate shared logins
Give each worker an individual account. Use a long, unique password for every service; never recycle an email password for a cloud console or remote-access account. Store credentials in an access-controlled password manager if your business uses one, and limit who can retrieve administrative secrets. Shared accounts make it difficult to identify an intruder and impossible to remove one person’s access cleanly.
Require MFA where compromise would hurt most
Start with email, remote access, cloud storage, financial systems and privileged accounts. CISA advises businesses to aim for phishing-resistant MFA and to use the strongest method their service supports. MFA should be required, not merely offered, for staff who can reset passwords, change payment details, alter backups or administer devices.
| MFA choice | Phishing resistance | What to verify | Operational considerations |
|---|---|---|---|
| FIDO2/WebAuthn security key or equivalent phishing-resistant method | Strongest when the service supports it | Whether the email, cloud, VPN and device platforms accept the key; whether multiple keys can be registered | Issue a spare, document loss and replacement procedures, and protect the recovery process as carefully as the key |
| Another phishing-resistant method supported by the provider | Strong, subject to the provider’s implementation | Account compatibility, enrollment rules and administrator controls | Usually requires a clear enrollment and recovery policy |
| The provider’s available non-phishing-resistant MFA fallback | Lower than a phishing-resistant method | Whether it is the only supported option and how recovery is secured | Use it rather than leaving an account unprotected, while planning a stronger option |
CISA identifies physical security keys as a common MFA form. A FIDO2/WebAuthn key is a reasonable category to investigate, but check compatibility with each service and device before buying. The cited guidance does not endorse a brand, model or supplier. Register a spare key or another controlled recovery method so a lost key does not trigger an emergency bypass.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Harden recovery and administrator access
Protect password-reset email addresses and recovery codes with the same MFA standard as primary accounts. Keep recovery codes in a restricted, offline location. Separate daily work from administration: administrators should use a standard account for email and browsing, then elevate only when needed. Review privileged access periodically and remove rights that no longer match a person’s job.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesPatch known exploited vulnerabilities before less urgent work
Maintain a simple asset list showing each device or service, its owner, software version, internet exposure and patch status. Include equipment maintained by an outside provider and cloud services where your staff control configuration.
Apply vendor security updates promptly, especially to internet-facing firewalls, remote-access gateways, routers, email systems, virtualization hosts and collaboration tools. CISA states: Prioritizing patching of known exploited vulnerabilities is key to strengthening operational resilience against this threat.
Treat that as a scheduling rule: a vulnerability already being exploited outranks a routine feature update.
A practical patch cycle
- Review security notices and your management consoles on a defined schedule.
- Identify whether an affected product exists in your inventory and whether it is exposed to the internet.
- Back up configuration and data as appropriate, then test the update on a noncritical system when feasible.
- Apply the patch within the urgency set by your risk and the vendor’s instructions.
- Verify that authentication, backups, remote access and business workflows still work.
- Record the update, exceptions and a date for resolving any temporary mitigation.
If a patch cannot be applied immediately, disable the exposed feature, restrict access, isolate the system or use another documented mitigation. An exception without an owner and deadline tends to become permanent exposure.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Limit remote access and contain lateral movement
Remote desktop and other remote-access services are useful but enlarge the attack surface. Keep only the services the business needs. Disable unused protocols and accounts, require MFA for necessary remote access, and restrict access to named users, approved networks or managed devices where your technology permits.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Review remote-access logs for unusual countries, times, devices, repeated failures and successful logins followed by administrative changes. Set alerts that someone will actually investigate. If a provider manages the service, require a description of its MFA, logging, patching and emergency-disable process.
Separate critical systems where practical. Network segmentation can prevent an intruder who reaches one workstation from moving directly to file servers, backup consoles or payment systems. The detailed segmentation and monitoring recommendations in federal critical-infrastructure guidance should be adapted to a small firm’s equipment, budget and expertise rather than copied blindly. Even a modest separation—such as putting backups and administrative interfaces on a restricted network—can reduce the damage from one stolen credential.
Make phishing reporting faster than phishing investigation
Teach staff what a suspicious message looks like, but do not rely on perfect recognition. Attackers can imitate a supplier, executive or cloud service and may use a real conversation as cover.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Verify unexpected payment, payroll, password-reset and document-sharing requests through a second channel.
- Inspect the actual destination of a link before signing in; when in doubt, open the service through a known bookmark instead.
- Do not approve MFA prompts you did not initiate.
- Report suspicious messages immediately, even if a user clicked or entered a password.
- Tell employees that rapid reporting is rewarded; delay and concealment increase harm.
Provide one reporting route, such as a dedicated address or help-desk option, and define who checks it. A report should trigger password protection, session review and message removal when appropriate, not a debate about whether the employee should have noticed sooner.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Build backups that ransomware cannot erase
A backup that an intruder can reach with the same credentials as production data is not an independent recovery copy. Keep critical data encrypted and offline or isolated from ordinary network administration. Separate backup credentials, restrict deletion rights and protect the backup console with strong MFA.
Identify what must be restored
List the data and services needed to keep operating: customer and accounting records, payroll, contracts, operational documents, configurations and contact lists. Assign an owner to each item and record the acceptable order of restoration. Do not assume that a cloud synchronization folder is a historical backup; deletion or encryption can synchronize too.
Test restoration, not just backup completion
Schedule restoration exercises. Recover a representative file, then a larger data set or complete system in a controlled environment. Confirm that files open, permissions are correct, applications can use the restored data and staff know where to work while systems are unavailable. Record the elapsed time, failures and corrective actions. An untested backup is an assumption, not a recovery plan.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Prepare an incident-response and continuity plan
Write the plan in plain language and keep a printed or offline copy in case your normal communication systems are compromised. Name a decision maker, technical responder, legal or insurance contact if applicable, communications lead and alternate for each role. Include current phone numbers and a way to reach people outside company email.
What to do when compromise is suspected
- Isolate affected systems. Disconnect a suspected workstation or server from the network when safe. Disable a compromised account and active sessions without destroying evidence.
- Protect backups. Restrict backup access and verify that isolation has not been breached.
- Preserve evidence. Keep relevant emails, alerts, endpoint images and authentication or remote-access logs. Avoid wiping or reimaging before a qualified responder advises you.
- Review scope. Determine which accounts, devices, data and suppliers may be affected. Change credentials from a known-clean device.
- Bring in qualified help. A specialist or managed provider can assist with containment, forensic preservation, recovery and communications when internal expertise is limited.
- Report through official channels. Use the reporting route your plan identifies for CISA or the FBI, and follow applicable legal, contractual and insurance obligations.
- Restore deliberately. Rebuild or clean systems, patch them, enforce MFA and restore from verified backups before reconnecting normal operations.
Do not negotiate, erase evidence or reconnect an affected system simply to make a deadline without considering safety, reporting and recovery consequences.
Keep essential work moving
Define a minimum operating mode: an alternate way to contact customers, a manual process for urgent orders or payroll, access to critical phone numbers and a preapproved location or device for clean communications. Decide who can pause payments, notify customers, or shut down a service. A continuity plan turns an IT outage into a managed business decision.
A 30-day implementation plan
| Time frame | Work to complete | Evidence that it is done |
|---|---|---|
| Days 1–3 | Inventory critical accounts and internet-facing systems; enable MFA on email, remote access and administrator accounts; remove former users. | Named owner, MFA method and recovery contact recorded for each critical account. |
| Week 1 | Review exposed services, patch known exploited vulnerabilities, disable unused remote access and confirm backups are isolated. | Patch record, documented exceptions and backup-access review. |
| Week 2 | Set a phishing-reporting route, brief staff, review remote-access logs and restrict unnecessary privileges. | Reporting process tested and access list approved by an owner. |
| Week 3 | Restore representative files and a critical service from backup; capture recovery time and failures. | Restoration test record with corrective actions and assigned deadlines. |
| Week 4 | Run an incident tabletop exercise covering isolation, communications, evidence preservation and reporting. | Updated contact sheet and plan changes based on the exercise. |
After the first month, repeat account, patch, backup and remote-access reviews on a schedule suited to the business. Revisit the plan when you add a cloud service, change a supplier or deploy a new remote-access method.
When outside help is worth using
CISA points small businesses to no-cost cyber-hygiene services and guidance for managed service providers and small and medium-sized businesses. Start there if you need a baseline review. A firm without in-house expertise can also ask a qualified provider to assess MFA, patching, backup isolation, restoration testing, incident response and reporting support.
Ask prospective providers to state exactly what they monitor, what they patch, how they protect their own administrative access, how often they test restoration, what happens after hours and who owns the data and logs. Get the escalation and termination process in writing. Federal guidance does not endorse a particular provider or establish that paid help is mandatory; the right level of assistance depends on the systems your business operates and the consequences of downtime.
How to tell whether your protection is improving
- Every critical account has an individual owner, unique password and enforced MFA.
- At least one MFA method is phishing-resistant where the service supports it, and lost-key recovery is documented.
- Known exploited vulnerabilities have an owner, deadline and recorded mitigation if they cannot yet be patched.
- Unused remote-access services are disabled, and necessary access is logged and reviewed.
- Backups are encrypted, isolated and restorable within the time the business can tolerate.
- Employees know exactly how to report a suspicious message or unexpected MFA prompt.
- The incident plan works without company email and identifies who isolates systems, preserves evidence, contacts responders and reports the event.
These checks do not guarantee that an attack will fail. They make common entry methods harder to use and give the business a safer way to contain and recover when prevention is imperfect.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
