iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Secure a business network against phishing with layered controls: require multifactor authentication (MFA), give sensitive and privileged accounts phishing-resistant authenticators, filter and authenticate email, limit access, maintain endpoints, train people to verify unusual requests, and rehearse a credential-compromise response. No single control blocks every phishing route, so combine prevention with rapid containment.
What a phishing defense must protect
Phishing is a social-engineering attempt delivered through email, text messages, social networks, phone calls, collaboration tools, or other messages. An attacker may imitate a bank, supplier, cloud service, colleague, or executive and ask for a password, payment, a one-time code, a document, or an urgent change. A successful click can lead to a counterfeit sign-in page; a successful conversation can persuade someone to bypass a control without clicking anything.
For a small business, the practical objective is not to identify every malicious message perfectly. It is to make stolen credentials less useful, make impersonation harder, limit each account’s reach, and ensure that a suspected mistake is reported quickly. NIST’s small-business phishing guidance, created October 22, 2021 and updated August 19, 2025, recommends this kind of layered risk management. NIST’s Cybersecurity Framework 2.0 small-business quick-start guide (February 2024) provides a useful structure for assigning owners, documenting risks, and improving controls over time.
Start with a risk-based control plan
List the systems that would cause the greatest harm if an attacker obtained a login. Typical priorities are business email, payroll and banking portals, customer or health data, remote-access tools, source-code repositories, cloud administration consoles, and systems that can reset other users’ passwords. Record the identity provider used for each service, who administers it, whether MFA is available, and how an account can be recovered.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Prioritize people and accounts
- Privileged administrators: protect first because one stolen administrator session can change many accounts or security settings.
- Finance and payment staff: protect banking, payroll, invoicing, and supplier-payment workflows.
- Executives and assistants: protect roles commonly impersonated in urgent payment or data requests.
- Remote and shared-access users: review devices, recovery methods, and third-party access.
- Service accounts: remove interactive logins where possible and document ownership and rotation.
Assign owners and review dates
For every control, name an owner and a review interval. An email administrator can own SPF, DKIM, DMARC, and filtering; an identity administrator can own MFA and recovery; managers can approve job-based access; and a designated incident contact can receive reports. Review access when someone changes roles and immediately when employment ends. A written owner prevents a security setting from becoming nobody’s responsibility.
Require MFA, then make sensitive sign-ins phishing-resistant
Enable MFA on every account and service that supports it. MFA adds a barrier when a password is exposed, but methods differ in their resistance to phishing. For email, financial systems, administrative consoles, and services containing sensitive information, prioritize phishing-resistant authentication rather than treating every second factor as equivalent.
What “phishing-resistant” means
The National Institute of Standards and Technology (NIST) defines it in SP 800-63B as follows: “Phishing resistance is the ability of the authentication protocol to prevent the disclosure of authentication secrets and valid authenticator outputs to an impostor verifier (i.e., an attacker fraudulently posing as the verifier) without relying on the vigilance of the claimant.”
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
In practical terms, the authenticator should bind the sign-in to the legitimate site or service so that a look-alike page cannot simply collect and replay the response. Manually entered one-time passwords and codes delivered out of band do not meet this NIST definition, even though they can still be more protective than a password alone.
Compare authentication choices
| Method | Phishing resistance | Deployment and recovery considerations | Best use |
|---|---|---|---|
| FIDO authenticator with WebAuthn | Designed to resist disclosure to an impostor verifier when correctly implemented. | May be built into a phone or laptop or supplied as a separate hardware key. Confirm identity-provider and service support; enroll a backup authenticator and document recovery before enforcement. | Privileged users, email, finance, and sensitive applications. |
| Hardware FIDO2 security key | Phishing-resistant when the service supports the required FIDO/WebAuthn flow. | Physical distribution, loss replacement, spare-key storage, and account recovery must be planned. Compatibility depends on the service and device. | Administrators and staff who need a portable authenticator. |
| Platform authenticator | Can be phishing-resistant when it uses a supported FIDO/WebAuthn implementation. | Availability depends on device, operating system, browser, and identity provider. Define what happens when a device is replaced or reset. | Users who can enroll an authenticator on a managed phone or computer. |
| Push approval | Not automatically phishing-resistant; attackers may use repeated prompts or social engineering. | Teach users to deny unexpected prompts and report them. Use number matching or other provider safeguards if available, without calling the result phishing-resistant unless the protocol qualifies. | Interim protection where stronger methods are not yet supported. |
| Manually entered OTP or out-of-band code | Does not satisfy NIST’s phishing-resistance definition because a user can be induced to disclose the code. | Protect enrollment and recovery channels; never read a code to a caller or enter it into a page reached from an unexpected message. | Fallback or interim MFA, not the preferred control for high-risk accounts. |
Roll out MFA without locking out legitimate users
- Inventory services and identify the identity provider, supported authenticators, and administrator for each one.
- Enroll administrators and high-impact users first, using two authenticators where the service permits it.
- Test sign-in, device replacement, lost-key recovery, and an employee’s departure in a non-production or pilot group.
- Publish a recovery procedure that verifies identity through a known channel; do not reset MFA solely because a caller supplies information from an email.
- Enforce MFA for the pilot group, monitor failed and unusual sign-ins, fix legitimate exceptions, and then expand in waves.
- Keep a documented emergency account only when the provider requires one, protect it with a strong unique credential and monitored access, and review its use.
Centralizing logins around single sign-on paired with MFA can reduce the number of separate passwords and give administrators one place to disable a departing user’s access. CISA’s 2025 phishing guidance specifically emphasizes phishing-resistant MFA for privileged users and centralized sign-in with MFA.
Make passwords and permissions limit the blast radius
Use unique, strong credentials
Never reuse a password between business email, financial services, administrator consoles, and personal accounts. A password manager can generate and store unique passwords; choose one that fits your organization’s identity, administration, and recovery requirements. Do not place shared passwords in spreadsheets or chat messages. If a service cannot use MFA, a unique password and restricted access become especially important.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Apply least privilege
Give each person only the systems and actions required for the job. Separate ordinary work accounts from administrator accounts, and use the administrator account only for administrative tasks. Remove inherited group memberships and stale third-party connections. Review permissions after role changes and disable accounts promptly when employment ends. Least privilege does not prevent an employee from being phished, but it limits what the stolen session can reach.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Protect recovery and reset paths
An attacker who controls a recovery email address, phone number, help-desk process, or administrator can bypass a strong primary login. Restrict who can reset MFA, require a documented identity check, log resets, and review them. Make sure backup authenticators belong to the right person and are not stored together with the primary device.
Harden business email against spoofing and malicious content
Use the strongest filtering available from your email provider. Filtering can identify suspicious senders, attachments, links, and message patterns before they reach an inbox, but it will not catch every carefully crafted phish. Users still need a safe way to report a message without forwarding a live malicious link to colleagues.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Configure SPF, DKIM, and DMARC
NIST’s trustworthy-email guidance (SP 800-177 Rev. 1, February 2019) treats sender-domain authentication as a set of complementary controls:
- SPF publishes which servers are allowed to send mail for a domain.
- DKIM adds a cryptographic signature that receiving systems can validate.
- DMARC lets the domain owner specify how receivers should handle messages that fail alignment checks and provides reporting.
Ask the email or domain administrator to verify that legitimate senders are included, review reports, and move toward an enforcement policy only after authorized services are aligned. These records reduce spoofing of your domain; they do not stop an attacker from registering a look-alike domain, compromising a real mailbox, or directing a victim to a credential-harvesting site.
Free tools Windows power users keep installed
One-click scans. No signup required.
Verify unusual requests out of band
Require staff to confirm payment changes, gift-card requests, new bank details, password resets, and urgent data transfers using a known telephone number, an established chat thread, or another contact method already on file. Do not use the phone number, reply address, or link supplied in the suspicious message. Use a two-person approval rule for high-value payments when practical.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Keep endpoints and software maintained
Maintain antivirus or endpoint-protection software and apply operating-system, browser, application, and firmware updates. NIST’s small-business guidance recommends both maintained antivirus and regular updates. These controls reduce the chance that a malicious attachment, drive-by download, or stolen session can persist, but antivirus is not a substitute for MFA or cautious verification.
Standardize a managed baseline
- Use centrally managed devices for staff who access sensitive systems.
- Enable automatic security updates where business compatibility allows, and define a short exception process.
- Remove unsupported applications and browser extensions that can read sign-in pages.
- Require screen locks and encrypted storage on portable computers and phones.
- Record which devices are allowed to enroll authenticators and how a lost device is revoked.
Train employees to pause, verify, and report
Training should answer three operational questions: Do employees know how to spot a phish? Are they regularly practicing the response? Do they know exactly how to report a suspected mistake?
Teach recognizable warning signs
- An unexpected link, attachment, or sign-in request.
- Urgency, secrecy, threats, or pressure to bypass the normal process.
- A request for passwords, MFA codes, payment details, customer data, or gift cards.
- A sender address, domain, display name, or reply path that does not match the claimed organization.
- A message that asks the recipient to install software or enable macros.
Explain that a polished logo, familiar writing style, or a message from a known account is not proof of safety; that account may itself be compromised. Teach employees to open a service through a bookmarked or typed address rather than a link in an unexpected message.
Make reporting quick and blame-free
Publish one reporting route, such as the organization’s security mailbox, help desk, or incident channel, and state who monitors it. Include what to send: the original message or a screenshot, the time, the link clicked, information entered, and whether a code or payment was provided. Tell employees to report immediately even when they are embarrassed. A fast report gives administrators time to revoke sessions, reset credentials, and warn others.
Use a response sequence when credentials may be exposed
Assume a credential is compromised when someone entered it on a suspicious page, approved an unexpected MFA request, disclosed a code, or lost a device containing an active session. Do not wait for proof of misuse.
Quick Recap
- Stop further interaction. Close the page, disconnect a suspicious device from the network if directed by your incident contact, and do not reply to the attacker.
- Report immediately. Contact the designated internal response person through a known channel. Include the account, device, time, message, and exact information supplied.
- Change the affected password. Use a known-good device and the legitimate service address. Change every other account that used the same password; reuse is a common way one phish becomes several compromises.
- Revoke active access. Sign out other sessions, revoke refresh tokens or app passwords where the service provides those controls, remove unfamiliar forwarding rules, and review newly added MFA methods and recovery addresses.
- Contain related accounts. Temporarily suspend the account or restrict risky actions if suspicious sign-ins, mailbox rules, or administrator changes appear. Preserve relevant logs for investigation.
- Protect money and transactions. If a bank, payroll, card, or supplier-payment account is involved, contact the financial institution using its published contact information and follow its fraud process.
- Warn affected people. Notify colleagues, customers, suppliers, or other parties if the account sent malicious messages, exposed data, or initiated a fraudulent transaction. Use a verified contact channel.
- Assess notification duties. Determine whether personal, health, financial, or contractual data was involved. Notification requirements depend on applicable law, jurisdiction, contracts, and the facts; consult qualified legal counsel and the relevant state attorney general information when appropriate.
- Learn and improve. Document the entry point, controls that worked, controls that failed, and the recovery time. Update filtering, MFA policy, training, and approval procedures.
Implementation roadmap for a small business
| Time frame | Actions | Evidence to keep |
|---|---|---|
| First 24 hours | List critical accounts; enable available MFA; protect administrators and finance users; publish the reporting contact; verify that affected passwords can be reset. | Account inventory, owner list, recovery instructions, and the reporting address. |
| First 30 days | Pilot phishing-resistant FIDO/WebAuthn authentication; remove stale access; separate administrator accounts; confirm endpoint protection and update settings; review email filtering and sender-domain records. | Pilot results, exception list, access-review record, and SPF/DKIM/DMARC configuration notes. |
| Within 90 days | Expand phishing-resistant MFA to sensitive services; enroll backup authenticators; formalize payment verification; run a reporting exercise; review logs, forwarding rules, and recovery changes. | Enrollment coverage, exercise findings, incident contacts, and remediation owners. |
| Ongoing | Repeat role-based training, access reviews, update testing, domain-authentication review, and response exercises after major system or staffing changes. | Review dates, training attendance, exceptions, and closed improvement actions. |
Common implementation mistakes and fixes
- “We turned on MFA, so phishing is solved.” MFA methods vary. Identify which accounts still use phishable codes and move high-risk users to supported FIDO/WebAuthn authenticators.
- “DMARC will block every scam.” Domain authentication helps prevent spoofing of your domain; it does not stop look-alike domains or compromised legitimate accounts. Keep filtering and verification procedures.
- “Everyone is an administrator for convenience.” Remove unnecessary privileges and provide a separate administrative account for elevated work.
- “We will sort out recovery later.” Enroll backup authenticators and test replacement before enforcing MFA broadly.
- “Employees should not report mistakes until they are certain.” Uncertainty is the reason to report. Delay gives an attacker time to use the session or message other people.
- “A password reset ends the incident.” Revoke sessions, inspect forwarding rules and MFA changes, change reused passwords, and check financial and data impact.
Security checklist
- Critical accounts and their owners are inventoried.
- MFA is enabled wherever available.
- Privileged, email, finance, and sensitive-data users use phishing-resistant authentication when supported.
- Each user has only job-required access; administrator privileges are restricted.
- Passwords are unique and stored with an approved password-management process.
- Email filtering is enabled, and SPF, DKIM, and DMARC are reviewed by the domain administrator.
- Antivirus or endpoint protection is maintained, and updates are applied promptly.
- Employees know the warning signs, the verification rule, and the exact reporting contact.
- Backup authenticators, account recovery, session revocation, and financial-fraud contacts are documented.
- The organization has practiced the credential-compromise sequence and assigned improvement owners.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
