Securing a server: the checklist for small businesses

1. Updates

• Security updates are installed automatically
• Operating system and software are still supported by the vendor
• Someone is responsible for planning major upgrades

2. Logins and permissions

• Login with keys instead of passwords, direct login as administrator is disabled
• Two-factor authentication for every admin panel
• Everyone has their own account with only the permissions they need
• Accounts of former employees and contractors are removed

3. Network

• A firewall allows only the services that really need to be reachable
• Repeated failed logins are blocked automatically
• Databases and internal services cannot be reached from the internet
• All connections are encrypted, certificates renew automatically

4. Backups

A backup only counts once the restore has been tested. The 3-2-1 rule has proven itself: three copies of the data, on two different types of storage, one of them in another location.

• Backups run automatically and encrypted
• At least one copy lives outside the server and is protected against deletion
• Restores are tested regularly

5. Monitoring

• Availability, disk space and errors are monitored continuously
• Someone is alerted immediately when there is a problem
• Logs are kept, so incidents can be traced

6. Documentation

What runs on the server, who has access, how is it restored? A short document should answer these questions, so that nothing depends on a single person.