Québec SMB Security Baseline 10 Controls You Can Do This Month
What Is a Cyber Threat 164.68 Million Records Exposed
A cyber threat is any attempt to steal data or disrupt business operations. In 2019, the United States recorded 1,473 data breaches and 164.68 million sensitive records exposed. Small and midsize businesses (PMEs) are especially at risk. As PayPal CEO Dan Schulman noted, there are companies that have been hacked and those that do not know they have been hacked.
Phishing 90% of Breaches Start Here
Phishing emails, texts, or chats trick employees into sharing passwords or financial details. With over 90% of breaches tied to phishing or social engineering (Verizon DBIR), one click can compromise an entire network. See our short guide in Resources.
Watering Hole Attacks 1 Compromised Site Can Infect Many
A watering hole attack targets trusted websites used by specific industries. Guidance from CISA shows how one infected site can spread malware to many businesses that regularly visit.
Drive By Downloads 60% Exploit Unpatched Systems
Drive by downloads happen when outdated or unpatched systems allow silent installs of malicious software. Studies attribute a large share of breaches to unpatched vulnerabilities (IBM Cost of a Data Breach). AET Managed IT can automate patching and updates.
Malware Ransomware Costs SMBs 1.85M on Average
Malware includes viruses, ransomware, spyware, worms, and Trojans. The Sophos State of Ransomware reports average ransomware impacts for SMBs measured in the millions. Protect endpoints with AET Cybersecurity.
Why SMBs Need Cybersecurity 50% Close After an Attack
According to the U.S. SEC, about half of small businesses close within six months of a major cyberattack due to reimbursements, downtime, emergency IT spend, and reputation loss. Keep teams operational with AET Helpdesk.
10 Security Controls Do Them in 30 Days
- Multi-Factor Authentication (Microsoft 365 MFA)
- Password Manager (1Password Business)
- Endpoint Detection and Response (CrowdStrike Falcon)
- Patching Routine (NIST Patch Management Guide)
- DNS Filtering (Cisco Umbrella)
- Least Privilege Access (NIST Glossary)
- 3-2-1 Backups (Veeam Backup Rule)
- Awareness Training (KnowBe4 Training)
- Email Filtering (Proofpoint Security)
- Incident Drill (CISA Guidance)
Prioritize Fast 4 Weeks 10 Controls
- Week 1: MFA + password manager
- Week 2: Patching + DNS filtering
- Week 3: Awareness + email filtering
- Week 4: Backups + drill + least privilege
Download the full 30-Day Security Playbook (EN/FR PDF) to follow step by step.
Who Does What 3 Roles to Assign
- Owner / Leadership: Approves MFA, drives culture, joins drills
- IT/Vendor: Deploys patching, filtering, EDR (Managed IT Services)
- Employees: Use password manager, complete training, follow rules
Final Word 86% of Breaches Are Financially Motivated
According to the Verizon Data Breach Investigations Report, 86% of breaches are financially motivated. By applying these 10 baseline controls, SMBs in Québec can reduce risk, protect customer trust, and avoid being another statistic.