This is the Sunday Signal, the weekly roundup that goes out as a blog post and as the weekly Web Managers letter. Same content, one written, one sent. It lands on Saturday with the quick win so the weekend task and the week's reading arrive together.
Week three of Security Month ran the defenses that matter most when something has already gone wrong: the backup you can actually restore, the first hour after a hack, the companies that hold your site's keys, and the chapter of the book that argues all of it. Next week turns to the most common way things go wrong in the first place, which is a password handed to the wrong page, and to the baseline that makes a small organization more trouble than it is worth to attack.
If you did nothing else this week but the restore test and the breach check, you are ahead of most organizations your size.
What ran this week
Monday's web check asked whether your backup is real. The fifteen-minute restore test confirms the archive holds both the site's files and its database, with a date you could live with.
Tuesday's Emergency File walked through the first hour after a hack, in order: confirm and document, contain, rotate passwords from a clean device, then call the host and say "my site is compromised." Do not delete anything yet.
Wednesday was Episode 5 of The Web Managers Podcast, Hosting Without the Headaches. The renewal price is the real price, the padlock is something you verify rather than buy, and "my host does backups" is only half of being covered.
Thursday separated the registrar, the host, the DNS provider, and the platform, and showed what each one can take away. The registrar can take the most, so it gets the strongest protection.
Friday was Book Friday, Chapter 4: a backup has four properties, frequency, retention, custody, and verification, and the quarterly restore test with a signed log is what turns it into a plan.
Saturday's quick win was a breach check at haveibeenpwned.com for every organizational address, with rotation for any password that was ever reused.
The one thing to do this weekend
Turn on two-factor authentication (2FA) for your registrar account. The registrar is the single account that, if taken, takes the website, the email, and the organization's name with it. It takes five minutes, and the 2FA should live on an organizational device or in the shared vault, not on one person's phone.
If that is already done, run Monday's restore test. You will either learn the backup works or learn it in time.
What is coming
Monday's web check turns on 2FA everywhere that touches the website. Tuesday's Emergency File is "Someone Clicked the Link," the fifteen minutes after a colleague enters a password on a fake page. Wednesday is Episode 6, on choosing a platform you can actually run. Thursday explains why small organizations get hacked, and why it is never personal. Friday is Book Friday, Chapter 5: before you pick a platform, ask what it costs to leave. Saturday's quick win reviews the connected apps that still hold keys to your accounts.
One more thing
If a colleague ever tells you they clicked something, thank them first. The person who reports within the hour is the best security news of your week. Tuesday explains why.
~ Bryan
If a friend got handed the website, forward this. They can join the weekly Web Managers letter with a free account at https://webmanagers.com/register, and the chapter worksheets come with it.