Just the Facts · Article

Passwords, Backups & VPNs: the security that decides whether a breach sinks you

The four operational habits — a password manager, MFA on the accounts that matter, tested offsite backups, and a VPN when it counts — that decide whether a breach is a bad afternoon or a business-ending event.

Most of what Law-O-Matic flags — pre-consent trackers, missing privacy pages, accessibility gaps — is what regulators and plaintiffs' firms can see from the outside. But the incidents that actually sink small businesses usually start somewhere they can't see: a reused password, a missing 2FA prompt, or a backup that turned out not to work. Fix those and the rest of your compliance work still means something.

1. Use a password manager. Never reuse a password.

The single most common root cause of a small-business breach is credential reuse. One old marketing tool gets breached, the same password unlocks your email, and from your email an attacker resets everything else. A password manager (1Password, Bitwarden, Dashlane, iCloud Keychain) generates a unique, random password for every account and remembers them for you. You only memorize one strong master password.

One unique password per account — no exceptions for "low-value" logins. Attackers don't know they're low value.
Store it in a real password manager, not a spreadsheet, notes app, or your browser's built-in autofill on a shared computer.
Turn on breach alerts inside the manager so you find out when a service you use has leaked.

2. Turn on MFA — on the six accounts that actually matter

Multi-factor authentication (MFA / 2FA) means a stolen password isn't enough on its own. You don't have to enable it everywhere on day one, but there are six accounts where missing MFA is how a small business gets taken apart:

Email (Google Workspace / Microsoft 365 / your provider) — this is the master key; password resets for everything else land here.
Domain registrar (GoDaddy, Namecheap, Cloudflare Registrar, etc.) — losing this means losing your website and email at the DNS level.
Web hosting / server control panel — where your site actually lives.
CMS / site admin (WordPress, Shopify, Webflow, Squarespace, etc.).
Payment processor (Stripe, Square, PayPal) and any bank/finance login.
Social accounts your business posts from (Meta Business, LinkedIn, X, TikTok, YouTube).

Prefer an authenticator app (Authy, Google Authenticator, 1Password, Microsoft Authenticator) or a hardware key (YubiKey) over SMS. SMS 2FA is still much better than nothing, but SIM-swap attacks are real.

3. Backups: follow the 3-2-1 rule, and test a restore

The 3-2-1 rule is the standard: keep 3 copies of your data, on 2 different types of media, with 1 copy offsite. For a small business that usually means: the live site/database, an automated backup stored with your host, and an independent offsite backup somewhere the host can't touch (a separate cloud, an external drive rotated weekly, or a dedicated backup service like BackupBuddy, UpdraftPlus with remote storage, Jetpack VaultPress, or your host's "offsite" tier).

The part almost everyone skips: actually test a restore. A backup you have never restored is a hope, not a backup. Once a year (or after any big change) restore a copy to a staging site and confirm it comes back clean. Ransomware operators specifically target backups because they know most businesses discover their backups are broken on the worst possible day.

4. VPN: for admin over public Wi-Fi, not as a compliance shield

A VPN is useful in one specific situation: when you're logging into admin, hosting, banking, or your CMS from a coffee shop, airport, hotel, or any Wi-Fi network you don't control. It encrypts the network hop between you and the VPN provider so a hostile network can't intercept the session.

What a VPN is not: it isn't a substitute for HTTPS on your website, it doesn't replace MFA, and it doesn't make your site more "compliant." A consumer VPN on your laptop doesn't protect your customers at all — it protects you, when you're the one on the untrusted network. Use one (Mullvad, Proton VPN, NordVPN, 1.1.1.1 WARP) specifically for admin sessions on untrusted networks, and don't oversell what it does.

The connection to everything else Law-O-Matic covers: a weak or reused password, missing MFA on a critical account, or an untested backup is the most common root cause of the breach that then triggers the legal exposure — the breach-notification duty, the CCPA/GDPR investigation, the class action, the demand letter. The rest of the report tells you what a regulator or plaintiffs' firm would see; this article is about not giving them anything to look at in the first place.

If this list feels like a lot: Technology On Call can set this up and monitor it for you — password manager rollout, MFA on the six accounts, real 3-2-1 backups with tested restores, and sensible VPN use for admin work.

This is operational-security best practice, not legal advice. Your specific obligations depend on your industry, jurisdiction, and the data you handle.

Sources

CISA — Multi-Factor Authentication guidance
NIST SP 800-63B (digital identity / passwords)
US-CERT / CISA — 3-2-1 backup rule
EFF — Surveillance Self-Defense (VPNs)

Questions? Contact us