---
title: "Business Cybersecurity: Pitfalls to Avoid | SIRKit"
description: Secure your business from cyber threats with essential IT security tips. Avoid pitfalls and fortify defenses. Contact us for expert guidance.
image: https://www.sirkit.ca/hubfs/IT-Security-Tips-for-Every-Business-Common-Pit.width-800.jpg
---
[Skip to main content](https://www.sirkit.ca/blog/it-security-tips-for-every-business-common-pitfalls-to-avoid#main-content)
[ ](https://www.sirkit.ca)
- Show submenu for Services Services
- [Managed IT](https://www.sirkit.ca/managed-it-services)
- [Co-Managed IT](https://www.sirkit.ca/co-managed-it-services)
- [Integrated IT Solutions](https://www.sirkit.ca/integrated-it-solutions)
- [Cybersecurity](https://www.sirkit.ca/cybersecurity)
- [Show submenu for About Us About Us](https://www.sirkit.ca/about)
- [Executive Team](https://www.sirkit.ca/about?#exec)
- [Careers](https://www.sirkit.ca/careers)
- [Contact Us](https://www.sirkit.ca/contact)
- [Blog](https://www.sirkit.ca/blog)
Open main navigation
Close main navigation
- Show submenu for Services Services
- Services
- [Managed IT](https://www.sirkit.ca/managed-it-services)
- [Co-Managed IT](https://www.sirkit.ca/co-managed-it-services)
- [Integrated IT Solutions](https://www.sirkit.ca/integrated-it-solutions)
- [Cybersecurity](https://www.sirkit.ca/cybersecurity)
- Show submenu for About Us About Us
- About Us
- [About Us](https://www.sirkit.ca/about)
- [Executive Team](https://www.sirkit.ca/about?#exec)
- [Careers](https://www.sirkit.ca/careers)
- [Contact Us](https://www.sirkit.ca/contact)
- [Blog](https://www.sirkit.ca/blog)
- [Connect with our Team](https://www.sirkit.ca/contact)
[Connect with our Team](https://www.sirkit.ca/contact)
[Skip to main content](https://www.sirkit.ca/blog/it-security-tips-for-every-business-common-pitfalls-to-avoid#main-content)
This is an announcement bar or top menu bar. Additional content can go here.
[ ](https://www.sirkit.ca)
- Show submenu for Services Services
- [Managed IT](https://www.sirkit.ca/managed-it-services)
- [Co-Managed IT](https://www.sirkit.ca/co-managed-it-services)
- [Integrated IT Solutions](https://www.sirkit.ca/integrated-it-solutions)
- [Cybersecurity](https://www.sirkit.ca/cybersecurity)
- [Show submenu for About Us About Us](https://www.sirkit.ca/about)
- [Executive Team](https://www.sirkit.ca/about?#exec)
- [Careers](https://www.sirkit.ca/careers)
- [Contact Us](https://www.sirkit.ca/contact)
- [Blog](https://www.sirkit.ca/blog)
Open main navigation
Close main navigation
- Show submenu for Services Services
- Services
- [Managed IT](https://www.sirkit.ca/managed-it-services)
- [Co-Managed IT](https://www.sirkit.ca/co-managed-it-services)
- [Integrated IT Solutions](https://www.sirkit.ca/integrated-it-solutions)
- [Cybersecurity](https://www.sirkit.ca/cybersecurity)
- Show submenu for About Us About Us
- About Us
- [About Us](https://www.sirkit.ca/about)
- [Executive Team](https://www.sirkit.ca/about?#exec)
- [Careers](https://www.sirkit.ca/careers)
- [Contact Us](https://www.sirkit.ca/contact)
- [Blog](https://www.sirkit.ca/blog)
- [Get Started](https://www.sirkit.ca/contact)
[Get Started](https://www.sirkit.ca/contact)
Categories
- [Cyber-Security Advisories](https://www.sirkit.ca/blog/tag/cyber-security-advisories)
- [Technical Pro-tips and How-to](https://www.sirkit.ca/blog/tag/technical-pro-tips-and-how-to)
- [Knowledge Base (KB)](https://www.sirkit.ca/blog/tag/knowledge-base-kb)
- [SIRKit News](https://www.sirkit.ca/blog/tag/sirkit-news)
- [Product Reviews](https://www.sirkit.ca/blog/tag/product-reviews)
- [SIRKit360® News](https://www.sirkit.ca/blog/tag/sirkit360-news)
# IT Security Tips for Every Business – Common Pitfalls to Avoid
[Kris Wilkinson](https://www.sirkit.ca/blog/author/kris-wilkinson)
Mar 11, 2021
Every business, no matter how large or small, should be prepared to make a larger investment in cyber-security; [data shows](https://www.inc.com/adam-levin/more-than-70-percent-of-businesses-admit-theyre-unprepared-for-a-cyberattack.html) that 73% of businesses admit to having inadequate defences.
The numbers are concerning and while some businesses are taking steps to appropriately protect their systems, many continue to ignore how serious the risk actually is. And that’s exactly what cyber criminals count on:
“It’s the hacker’s job to find those places people aren’t going into or thinking about. They run a business, after all, and they want to find where those new opportunities are \[and capitalize on them\].” (Jim Love, ITWC via[ IT World Canada](https://www.itworldcanada.com/article/bulk-to-stealth-security-covering-all-points-of-attack/408317))
Business leaders need to also understand that cyber-security is more than an IT problem, it should be implemented as a company-wide effort that requires everyone to be involved. Your security team should manage the technical aspects, however the entire team should receive regular training and real-time communication about past, present, and emerging threats.
To help you get started, SIRKit has put together a list of common pitfalls and best practices your business should look into. This is not a complete list, you should absolutely consult your IT security professionals for more.
### 1. Updates. Updates. Updates!
Many recent and highly publicized breaches were the result of missing updates. For example, Equifax was the victim of [a vulnerability](https://arstechnica.com/information-technology/2017/09/massive-equifax-breach-caused-by-failure-to-patch-two-month-old-bug/) contained within Apache Struts. A critical flaw was discovered in the software, however, Equifax neglected to patch its systems in a timely manner and as a result, over 140 million U.S. and approximately 100,000 Canadian consumers’ names, addresses, SINs, and credit card numbers were compromised.
Unfortunately, too many organizations around neglect to perform regular updates to their systems.
Our advice? Update everything. Repeat – EVERYTHING. This includes (but is not exclusive to) the following:
- Windows Operating Systems (Monthly)
- Apple Operating Systems (Monthly)
- 3rd party applications (eg. chrome, Mozilla, iTunes, java, etc.) (Weekly)
- Routers, Switches, Printers, Firewalls, Wireless APs, Phones, etc. (Monthly)
- Firmware and BIOS (Semi-Annually)
- Internet of Things (IoT) – All web-connected devices and equipment such as cars, phones, thermostats, surveillance systems. (Weekly)
In the event of a major security issue, update your systems very quickly. Applying updates to everything can be time-consuming, use built-in automatic updates where possible, or subscribe to a good MSP ([Managed Services Provider](https://www.sirkit.ca/managed-it-services/)) that can take care of it all for you. Their services typically include a preventative maintenance process and zero-day updates.
### 2. Passwords. Passwords. Passwords!
[Recent data](https://www.verizonenterprise.com/verizon-insights-lab/dbir/) shows that over 80 percent of breaches succeed through stolen or weak passwords, yet many users continue to use dangerous password methodologies. Did you know a password that is 8 characters long can be broken in less than 18 milliseconds?
Going forward, mandate stringent password measures throughout the organization:
- Configure systems to force passwords updates after 3-4 months
- Never use similar password (eg. “MyKidsAreAwesome1”, “MyKidsAreAwesome2”)
- Use [Passphrasing](https://www.useapassphrase.com/) instead of complex passwords
- Use passphrases that are at least 16 characters in length and include a minimum of 4 words
- Passphrases should never contain anything that relates to you
- Passphrases shouldn’t create a proper sentence; randomize the words
- Never reuse passwords or passphrases on multiple systems (this is critical!)
- Never use the default passwords (eg. routers, cameras, etc.)
- Never send passwords by e-mail (consider using [pwpush.com](https://pwpush.com/))
- Never write passwords down; Use a password manager like LastPass or Dashlane
### 3. Multi-factor Authentication (MFA)
By definition, multi-factor authentication (MFA) is a system that requires more than one method of authentication from independent categories of credentials to verify a given user’s identity for a login or other transaction.
In plain english, this means in addition to a password, you need to provide a secondary piece of information during the login process.
There are numerous types of MFA, including (but not exclusive to):
- Text messages (unique code is sent)
- E-mail (unique code is sent)
- Mobile Applications (eg. google authenticator)
- Physical items – Magnetic strip cards, smart cards, carded security codes, USB drives
- Biometrics – Voice recognition, fingerprint scans, retina scans, facial recognition, etc..
If you’ve used text messages for MFA in the past (most likely two-factor authentication), you should stop, as the messages can be intercepted under the right circumstances. Instead, we recommend the Google Authenticator app (if it works with the particular application), it proves you are you by generating a unique code on your mobile device. It’s a test that doesn’t involve any communication between the two computers, and thus prevents interception.
### 4. User Lockdown
In many situations, malware and ransomware are effective because the user was provided administrator privileges or unrestricted access to shared content. Users should be locked down to prevent substantial risk to the entire organization.
In ransomware scenarios, the infection is generally contained to information the user has access to.
In a business environment, ensure UAC (User Access Control) is enabled, avoid giving users administrator privileges, and ensure all shared content is locked down to an “as needed” basis.
This includes locking down the senior management team.
### 5. An Antivirus is Not Sufficient
First and foremost, an antivirus solution is not an all-encompassing answer to cyber-security. An antivirus offers some protection for the machine it’s running on, and even in that fashion, it has its own limitations. You need much more than an antivirus to protect the entire network.
Additionally, modern threats need modern solutions. Traditional antivirus (AV) technologies require definitions built on predefined patterns to identify most threats. As the number of threats released daily continue to climb, the traditional antivirus can’t keep up because most of these patterns are created in some fashion by humans.
Modern security solutions are emerging that use AI, machine learning, and real-time behavioral analysis to get ahead of the curve. This is essential for zero-day exploits. Instead of waiting for updates to arrive, these systems analyze the system for suspicious activity instead.
Lookup Intercept-X by Sophos, an advanced endpoint security system that we highly recommend.
### 6. Isolate Networks (including wireless)
Certain types of equipment or systems should be isolated.
For example, guest wireless and staff smartphones, IoT such as surveillance, door access control, and audio, should not be positioned on the same network as your servers or users.
Isolating equipment to specific networks prevents compromised systems from being able to attack critical servers that house sensitive information.
Setting this up requires the right equipment and expertise, ensure you use an experienced technician.
### 7. Shred Everything
This “old school” tactic is commonly overlooked. Not all hackers focus exclusively on digital channels to access your information. Dumpster diving through recycling is an easy way to secure documents that have sensitive information. We recommend following this practice at home too, to combat identity theft.
Long live the paper shredder people! If you printed anything with ANY of your information on it, shred it.
---
As you can see, cybersecurity can be complicated, and any attempt to manage it yourself can leave you vulnerable to advanced threats. Don’t let your business become another statistic.[ Learn more about our services](https://www.sirkit.ca/managed-it-services/) and how SIRKit can put together a custom package to serve your unique cyber-security needs.[ Contact us today](https://www.sirkit.ca/contact/).
**Tags:**
[Technical Pro-tips and How-to,](https://www.sirkit.ca/blog/tag/technical-pro-tips-and-how-to) [Cyber-Security Advisories](https://www.sirkit.ca/blog/tag/cyber-security-advisories)
### Related Posts
##### [ Technical Pro-tips and How-to • Aug 4, 2025 Is Your Cloud Secure? Common Security Gaps & How to Fix Them 3 min read](https://www.sirkit.ca/blog/is-your-cloud-secure-common-security-gaps-how-to-fix-them)
##### [ Technical Pro-tips and How-to • Jun 30, 2025 What's New in Microsoft Teams: June 2025 Update 2 min read](https://www.sirkit.ca/blog/microsoft-teams-update-june-2025)
##### [ Technical Pro-tips and How-to • May 14, 2025 How to compare MSP Offers: Price vs. Value – Making the Right Choice for Your Business 12 min read](https://www.sirkit.ca/blog/comparing-msp-offers-price-vs-value)
### Stay connected.
Join our newsletter to stay informed with the latest technology insights, market and business updates, and Sirkit news and events.
###### Categories
- [Cyber-Security Advisories](https://www.sirkit.ca/blog/tag/cyber-security-advisories)
- [Technical Pro-tips and How-to](https://www.sirkit.ca/blog/tag/technical-pro-tips-and-how-to)
- [Knowledge Base (KB)](https://www.sirkit.ca/blog/tag/knowledge-base-kb)
- [SIRKit News](https://www.sirkit.ca/blog/tag/sirkit-news)
- [Product Reviews](https://www.sirkit.ca/blog/tag/product-reviews)
###### Recent Posts
- [6 AI-Related Cybersecurity Risks Businesses Can’t Ignore](https://www.sirkit.ca/blog/ai-related-cyber-risks)
- [What Is Agentic AI in Cybersecurity?](https://www.sirkit.ca/blog/what-is-agentic-ai-in-cybersecurity)
- [AI Cyber Attacks: What Business Leaders Need to Understand Right Now](https://www.sirkit.ca/blog/ai-cyber-attacks-business-leaders)
- [Vulnerability Assessment vs Penetration Testing](https://www.sirkit.ca/blog/vulnerability-assessment-vs-penetration-testing)
- [Why MFA Alone Is No Longer Enough: How to Prevent Token Theft and AiTM Attacks](https://www.sirkit.ca/blog/prevent-token-theft)
[](https://www.sirkit.ca)
[1-780-758-5200](tel:17807585200) (Support)
[1-587-404-9002](https://www.sirkit.ca/blog/15874049002) (Sales)
Unit 217, 236 91 Street SW
Edmonton AB, T6X 1W8
- [Managed IT Services](https://www.sirkit.ca/managed-it-services)
- [Cybersecurity](https://www.sirkit.ca/cybersecurity)
- [About Us](https://www.sirkit.ca/about)
- [Contact Us](https://www.sirkit.ca/contact)
©2026 Sirkit. All rights reserved. [Privacy Policy](https://www.sirkit.ca/privacy-policy) | [Terms of Use](https://www.sirkit.ca/terms-of-use)
Sirkit® is a registered trademark.
-
-
-
×
×
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Kris Wilkinson",
"url" : "https://www.sirkit.ca/blog/author/kris-wilkinson"
},
"dateModified" : "2025-05-14T18:27:11.588Z",
"datePublished" : "2021-03-11T22:02:15.000Z",
"headline" : "Business Cybersecurity: Pitfalls to Avoid | SIRKit",
"image" : [ "https://www.sirkit.ca/hubfs/IT-Security-Tips-for-Every-Business-Common-Pit.width-800.jpg" ],
"mainEntityOfPage" : {
"@id" : "https://www.sirkit.ca/blog/it-security-tips-for-every-business-common-pitfalls-to-avoid",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://www.sirkit.ca/hubfs/Logos/SirkitBadge%20(2).png"
},
"name" : "Sirkit"
}
}
```