This week's security headlines paint a stark picture: Metabase zero-day exploitation affecting business intelligence platforms, social engineering attacks at Levi Strauss compromising three employees, and vishing campaigns targeting financial services through personal phones. The common thread? Basic security controls could have prevented or significantly limited the damage in each case.
Whether you manage IT for a small business or handle security decisions for your organization, the fundamentals matter more than ever. Here's your practical guide to hardening your security posture in 2026.
System Hardening: Close the Easy Doors First
System hardening means reducing your attack surface by eliminating unnecessary services, closing unused ports, and applying secure configurations. This week, CISA added CVE-2026-8037 affecting Progress LoadMaster to its Known Exploited Vulnerabilities catalog after active exploitation. Organizations running default configurations with internet-facing management interfaces became instant targets.
Start with these concrete steps:
Minimize exposed services. Audit what's accessible from the internet. Remote management interfaces, database ports, and administrative panels should never face the public web without additional protection layers. Use VPNs or zero-trust access controls instead.
Disable unnecessary features. The Atlassian Rovo vulnerability discovered this week shows how AI assistants can be manipulated to exfiltrate Jira and Confluence data. If you're not actively using a feature, disable it. Every enabled service is another potential attack vector.
Patch management isn't optional. CISA's KEV catalog now includes six vulnerabilities added just this week, including flaws in N-able N-central, JetBrains TeamCity, and Apache Tomcat. Establish a regular patching cadence with emergency procedures for critical vulnerabilities. Test patches in a staging environment when possible, but don't let perfect be the enemy of good—an unpatched critical vulnerability is worse than brief downtime.
Segment your network. Guest WiFi should be isolated from business systems. Financial data shouldn't sit on the same network segment as general employee workstations. IoT devices need their own restricted VLAN. Network segmentation limits lateral movement when attackers gain initial access.
Multi-Factor Authentication: Your Best Defense Against Credential Theft
The Levi Strauss breach involved social engineering that compromised employee credentials. MFA would have stopped the attack in its tracks.
Implement MFA everywhere, but do it right:
Avoid SMS-based MFA when possible. Use authenticator apps (Microsoft Authenticator, Google Authenticator, Authy) or hardware security keys (YubiKey, Titan). SMS can be intercepted through SIM swapping attacks.
Prioritize critical systems. Start with email, VPN access, cloud administration panels, financial systems, and remote desktop access. Then expand to all business applications.
Plan for device loss. Maintain recovery codes in a secure location. Document your MFA reset procedures. Employees will lose phones—have a process that's secure but doesn't create operational paralysis.
Watch for MFA fatigue attacks. The UNC6671 vishing campaign targeting financial services employees shows attackers calling victims directly to manipulate them into approving MFA prompts. Train employees to reject unexpected MFA requests and report them immediately.
Password Managers: Stop the Credential Reuse Problem
New research this week revealed CSS attacks that can break webmail defenses to steal passwords and tokens. While technical defenses matter, the foundation is still strong, unique passwords for every service.
Password managers solve the human memory problem:
Choose a reputable solution. 1Password, Bitwarden, and Keeper all offer business plans with administrative controls. Avoid storing passwords in browsers alone—dedicated password managers provide better security and audit capabilities.
Enforce strong master passwords. The master password protecting the vault needs to be both memorable and strong. Consider passphrases: four random words create more entropy than complex eight-character passwords.
Use the password generator. Random 20+ character passwords for every service. No patterns, no reuse, no exceptions. Let the software handle complexity.
Share credentials securely. Business password managers include secure sharing features. Stop sending passwords through email or Slack.
Backup Strategy: Your Ransomware Insurance Policy
The North Carolina Ports cyberattack disrupted critical infrastructure operations this week. Robust backups are your last line of defense when prevention fails.
Follow the 3-2-1 rule: three copies of data, two different media types, one offsite.
Automate everything. Manual backups don't happen consistently. Schedule automated backups daily for critical systems, weekly for everything else.
Test restoration regularly. Backups you haven't tested are Schrödinger's backups—simultaneously working and broken until you check. Quarterly restoration tests catch configuration problems before emergencies.
Isolate backup storage. Ransomware specifically targets backups. Use immutable storage options, air-gapped backups, or cloud storage with versioning that prevents immediate deletion. Backup credentials should differ from production system credentials.
Document the process. When systems are down and stress is high, detailed restoration documentation prevents mistakes. Include access credentials, restoration steps, and expected recovery times.
Incident Response Basics: Prepare Before You Need It
The Unlimited Technology Systems breach impacted 3.8 million people, with the initial compromise occurring in October 2025. Detection speed matters.
Create a basic incident response plan:
Define clear roles. Who makes containment decisions? Who communicates with customers? Who contacts law enforcement? Assign these roles before an incident.
Establish communication channels. Primary email might be compromised. Set up out-of-band communication methods—personal phones, Signal groups, or alternative email accounts.
Know your notification obligations. Depending on your industry and location, you may have legal requirements to notify affected parties within specific timeframes. Document these requirements now.
Preserve evidence. Take systems offline to contain threats, but preserve logs and forensic evidence. Disconnect from networks rather than powering off when possible.
Have expert contacts ready. Identify forensic investigators, legal counsel, and cyber insurance contacts before you need them. The middle of an incident is the wrong time to research options.
Taking Action Today
Security doesn't require a massive budget or dedicated security team. Start with one improvement this week. Enable MFA on your email. Deploy a password manager to your team. Schedule your first backup restoration test.
The threat landscape continues evolving, but the fundamentals remain constant. Organizations that master the basics—hardening, MFA, password hygiene, backups, and incident preparation—survive most attacks that devastate less-prepared targets.
If you need help implementing these controls or want a professional assessment of your current security posture, Vici Tech Solutions offers penetration testing and security consulting services tailored to small and medium businesses.