The Scariest Things in Your Office Aren’t Wearing Costumes

Six cybersecurity problems hiding in plain sight — and what you can do before they come back to haunt your business.

October is Cybersecurity Awareness Month, and by Halloween we’ve usually seen enough pictures of hackers in hoodies to last us another year.

I’ve been working with business technology for a long time, and I’ll tell you something: the things that really worry me aren’t nearly that dramatic: It’s the employee who left six months ago but can still log into company email. The computer where everyone has administrator privileges because it’s easier that way. Or the backup system that reports success every morning, even though nobody has actually tried restoring anything.

Not exactly the stuff of Hollywood horror movies. But if your business suddenly can’t access customer records, process orders, or run payroll, it gets pretty frightening in a hurry.

The worst technology problems often start with little things that nobody thought were a big deal.

So, in the spirit of Halloween, let’s look at six things that might be lurking around your business. Most are fairly straightforward to address, and you don’t necessarily need to spend a fortune fixing them.

1. The password that’s the only thing standing between you and disaster

Passwords are like the locks on your front door. They’re important, but they aren’t much help if somebody has a copy of the key.

That’s why we keep talking about multi-factor authentication, or MFA.

Even if somebody manages to steal your password, MFA provides another hurdle before they can access your accounts.

If your business uses Microsoft 365, Google Workspace, online banking, payroll services, or any application containing sensitive customer information, MFA should already be part of the picture.

And not all MFA is created equal. Text messages are better than passwords alone, but phishing-resistant options such as passkeys and security keys offer stronger protection where supported.

Here’s what I’d ask: Are we requiring MFA for everyone, including administrators, or did we just turn it on for a few people and call it good?

You might be surprised by the answer.

2. The former employee who never really left

Here’s one that makes the hair on the back of my neck stand up.

Somebody leaves the company. Their desk gets cleaned out, their keys get turned in, and everyone wishes them well.

But what about their computer accounts?  Can they still access email? SharePoint? Your accounting system? What about the remote access software somebody installed three years ago?

It isn’t necessarily that a former employee has bad intentions. Most don’t. The problem is that an account nobody is watching can become an opportunity for somebody else.  The same goes for old contractors, outside vendors, and temporary employees.

Here’s what I’d ask: Can somebody show me a current list of everyone who can access our business systems, and explain why they’re still there?

If nobody can produce that list, you’ve found something worth fixing.

3. Everybody has the keys to the kingdom

Imagine giving every employee a master key to your building because somebody occasionally needs to get into the supply closet.

Sounds ridiculous, doesn’t it?

Yet businesses do something very similar with their computers.  Administrator privileges allow somebody to install software, change critical settings, and potentially disable security protections. Sometimes those permissions are necessary. Most of the time, they aren’t.

And if an employee’s account gets compromised, the person on the other end may inherit those same privileges.

At BitworksIT, we’re pretty particular about who gets administrative access and why. It’s not about making life difficult for people. It’s about maintaining control over the systems the business depends on.

Here’s what I’d ask: Who has administrator rights in our organization, who approved them, and do they really need them?

“Because we’ve always done it that way” isn’t a particularly comforting answer.

4. The computer that’s been putting off updates since last Halloween

We’ve all seen it.

A computer asks to install updates. Somebody clicks “Remind me later.” Then later comes around, and they do it again. Eventually, that computer becomes a little time capsule of security vulnerabilities.

Software manufacturers regularly discover and correct problems that criminals may exploit. Installing updates is one of the simplest ways to reduce that exposure.

But there’s an important distinction here.

Just turning on automatic updates everywhere isn’t necessarily a good business strategy either.

Some business applications, servers, and specialized systems need controlled updates. I’ve seen plenty of situations where an update causes an operational problem because nobody considered what depended on that machine.

The answer is to have a process. Routine updates should happen automatically where appropriate. Critical systems need somebody responsible for testing, scheduling, and verifying updates. And don’t forget the firewalls, network equipment, and remote access systems. They need attention too!

Here’s what I’d ask: Who is responsible for keeping all this equipment updated, and how do we know it’s actually happening?

Feeling ghosted?

5. Your password strategy involves a spreadsheet and a lot of wishful thinking

I understand why people reuse passwords.

Nobody wants to remember 47 different combinations of letters, numbers, and punctuation just to get through a normal workday.  But using the same password for email, banking, business applications, and everything else is asking for trouble.

And sharing passwords in emails, spreadsheets, or sticky notes isn’t much better.

A properly managed business password manager solves a lot of these problems. It can generate unique passwords, store them securely, and allow employees to share access when necessary without passing credentials around and can ensure that passwords that employee controls go back to the company.

There’s another benefit businesses often overlook: control.

When somebody leaves, you can revoke their access to company credentials rather than wondering which passwords need to be changed. A decent business password manager may cost a few dollars per user each month. That’s money I’d much rather see a business spend than deal with the consequences of a compromised account.

Here’s what I’d ask: If an employee left tomorrow, would we know which company passwords they could access and how to revoke that access?

Don’t leave your keys in the ignition.

6. The backup that works perfectly — until you need it

I saved my favorite (and scariest) for last.

Few things give a business owner a false sense of security quite like a backup system that faithfully reports “Successful” every morning.  That’s nice.  But have you ever tried restoring something?

A backup that hasn’t been tested is a bit like having a fire extinguisher you’ve never inspected. You certainly hope it works, but finding out during an emergency isn’t ideal.

And here’s another misconception worth clearing up: storing files in OneDrive, Dropbox, or another cloud service doesn’t automatically mean you have a complete, independent backup and recovery strategy.

What happens if files are accidentally deleted, compromised, or encrypted by ransomware? Can you recover an earlier, usable version? Are there protected backup copies that an attacker can’t easily reach?

More importantly, how long would it take to get the business running again?

An hour? A day? A week?

For an automobile dealership, that might mean not being able to process repair orders. For a manufacturer, perhaps production drawings become inaccessible. For a professional office, it could mean missing critical deadlines or losing access to client records.

Suddenly, this isn’t really a technology problem anymore.

It’s a business problem.

Here’s what I’d ask: When was the last time we tested restoring our critical business systems, and how long would it actually take us to recover?

That’s a question worth answering before you need the answer.

The real monster is the stuff nobody is responsible for

Here’s what I’ve learned after more than 25 years in the technology business.

You can buy all sorts of cybersecurity products. Some are excellent, and some are absolutely necessary.  But you can also spend a pile of money and still have a business that’s poorly protected.

Why?

Because nobody has taken responsibility for making sure everything works together.

Who’s reviewing employee access? Who approves changes? Who makes sure updates happen? Who checks backups? Who decides what gets restored first when something goes wrong?

That’s why we talk so much about governance and control at BitworksIT. It’s not particularly glamorous. You won’t find too many Halloween costumes depicting an IT governance policy. But knowing who’s responsible, what systems are critical, and how the business will keep operating when something goes wrong matters a whole lot more than another shiny security dashboard.

Here’s my Halloween challenge to you

Pick just one of the six things we’ve talked about and ask whoever manages your technology about it.

Don’t settle for “I think we’re good.”

Ask them to show you.

If they can, that’s great. If they can’t, you’ve probably identified something worth a closer look.

And if you’re not comfortable with the answers, I’d be happy to have a conversation. Not a scary cybersecurity sales presentation or a lecture about everything you’re supposedly doing wrong.

Just a practical discussion about your business, the technology it depends on, and where you might have some unnecessary exposure.

Because the only thing that should be frightening around your office this Halloween is the candy bill.