Most of the technology a small business buys arrives set up to be easy, not safe. A new laptop comes with software nobody asked for. A router comes with an admin password printed on a sticker. A Microsoft 365 or Google Workspace account comes with sharing settings that assume everyone can be trusted. None of that is a scandal. Manufacturers want things to work the moment you switch them on. But it does mean the job of making them safe falls to you, and that job has a name: secure configuration.
What it actually means
Secure configuration means changing the settings on your devices and accounts so they do what your business needs and nothing more. Default passwords get changed. Software nobody uses gets removed. Features that run things automatically get switched off unless there is a reason for them. Screens lock when people walk away. It is one of the five technical controls in Cyber Essentials, and in our experience it is the one people most often assume someone else has already done.
Why it matters more than it sounds
A lot of attacks on small firms are not clever. They rely on finding something still in its factory state: a router using the password from the sticker, an old admin account nobody closed, a folder shared with anyone who has the link. Automated tools scan the internet for exactly these things all day, every day. Fixing the defaults will not make you untouchable, but it takes you out of the easy pile, and the easy pile is where most of the damage happens.
Where the defaults usually hide
- Routers and firewalls. The admin password, remote management left switched on, and firmware that has not been touched since the day it was installed.
- Laptops and desktops. Pre-installed software, auto-run for USB sticks, and staff doing their everyday work while logged in as an administrator.
- Microsoft 365 and Google Workspace. Sharing links that work for anyone, accounts belonging to people who left months ago, and multi-factor authentication that was never turned on for everyone.
- Phones and tablets. No screen lock, or a very short one, and no way to wipe the device if it goes missing.
- Printers, cameras and other connected kit. These get forgotten completely, and plenty still have the password they shipped with.
Five things to check this week
- Change every default password you can find, starting with the router, and keep the new ones in a password manager rather than on a sticky note.
- Remove software and apps nobody uses. Each one is something else that needs updating and another possible way in.
- Give everyone a normal user account for daily work, and keep admin rights for the moments they are genuinely needed.
- Set screens to lock after a few minutes of inactivity, and make sure every laptop and phone needs a PIN, password or fingerprint to open.
- Look at how files are shared in your cloud account. Turn off anyone-with-the-link sharing as the default, and close the accounts of people who have left.
The part people forget: keeping it that way
Getting the settings right once is the easy bit. Keeping them right is harder, because things drift. A new starter gets a laptop set up in a hurry. Someone installs a handy free tool. A supplier asks for admin access for a day and nobody takes it back. Six months later you are not where you thought you were. The fix is a short written baseline: a list of how a laptop, phone or account should be set up in your business, used every time something new arrives and checked against every so often.
This is where secure configuration and everyday IT meet. If whoever looks after your IT builds every device and account from the same baseline, most of the work happens without anyone having to think about it. If nobody owns it, it quietly slips.
How it fits with Cyber Essentials
Secure configuration sits alongside firewalls, user access control, malware protection and security update management as one of the five controls the Cyber Essentials self-assessment asks about. The questions are specific: whether default passwords have been changed, whether software you do not need has been removed, whether auto-run is off, and how devices are unlocked. Work through the checks above and you will have honest answers ready for that part of the questionnaire.
If you would rather hand it over, we can help in two ways. Our Cyber Essentials Readiness Sprint gets you ready for the assessment, secure configuration included. Our Managed IT Support service then keeps every device and account set up to a written baseline from that point on. Both are priced per engagement, with a fixed quote agreed before any work begins.
