The last week before the Christmas break is chaos. Funding reports are due, the end-of-year event needs wrapping up, and half the team is already mentally at the beach. IT is the last thing anyone wants to think about.
Then everyone logs off for two or three weeks. The office is empty, nobody is reading the alerts, and the one person who would notice a strange login is out of reach on purpose. For a scammer, that's a gift.
The good news: most of what keeps you safe over the break takes an afternoon, and you can do it with the team you already have. Here's what to sort before you close, and what to check on your first morning back.
Why the summer break suits scammers
Nothing about the technology changes in December. What changes is who's watching.
Fewer people are around to ask “does this look right to you?” A finance manager who would normally walk over to the CEO's desk to check an urgent payment request can't. Out-of-office replies tell anyone who emails exactly who's away and for how long. Laptops travel to holiday homes and airports. And updates that would usually install quietly on a Tuesday sit waiting until someone turns the machine back on in January.
You don't need to panic about any of it. A few habits that work fine during the year just need a stand-in while people are away.
Two weeks before you close
Install updates now, not on 5 January
Ask everyone to restart their laptop and install waiting updates before the break, including phones they use for work. If you run a website, check it's up to date too. New Zealand's Own Your Online service has warned businesses to update websites quickly after a serious security flaw (Own Your Online).
Check two-factor authentication on the accounts that matter
Passwords get guessed and stolen. Two-factor authentication (2FA) adds a second check, so a stolen password alone won't get someone in. Own Your Online recommends turning it on for email, banking, finance systems, remote access and cloud services, and using an authenticator app or security key rather than text messages where you can (Own Your Online 2FA guide).
Pay special attention to shared logins, like a general admin account or the finance inbox. They're often the ones that slipped through when 2FA was rolled out.
Test that your backups actually restore
Having backups and being able to use them are two different things. Pick one important file or folder and ask whoever manages your backups to restore it. If nobody is sure who manages them, you've found your most useful job for the week.
Tidy up who has access
December is when contracts end, interns finish and volunteers drift away. Before you close, remove access for anyone who has left, and check that people who are staying only have access to what they need. An old account nobody uses is an easy way in, because nobody notices when it's used.
The week you close
Agree a rule for payments and bank details
When we asked our IT support team what they watch for over the break, fake emails came up straight away. One looks like an invoice from a supplier you know. Another is dressed up as a charity e-gift, the kind supporters send at Christmas, with a link to open it. Over the break, there's nobody down the hall to check with.
The Australian Cyber Security Centre lists the warning signs: an unexpected change of bank details, an urgent payment request, or an unusual request from someone senior (ACSC).
The rule: no new bank details or urgent payment gets approved on the strength of an email alone. Phone the person on a number you already have, not one in the email.
Agree it with everyone who can approve or make payments, write it down and send it round before people leave.
Keep your out-of-office message short
Say when you're back and give a general contact for anything urgent. Leave out who's covering for whom, their mobile numbers and where you're going. Every extra detail helps someone write a more convincing fake email.
Make a “who to call” list
If something does go wrong on 28 December, who does your team ring? Own Your Online suggests keeping a contact list of your IT provider, bank, website host and lawyer as part of a simple incident response plan (Own Your Online incident response guide). Put it somewhere people can find it without logging in, and include holiday hours if your providers have them.
Look after devices that travel
Make sure every work laptop and phone locks with a PIN or password, and ask people to report a lost or stolen device straight away, even on holiday. The sooner your IT support knows, the sooner they can lock it or wipe it.
Your first morning back
The first day back is when people are most likely to click something they shouldn't. Inboxes are full, everyone's catching up, and an email from three weeks ago saying “urgent” feels like it needs doing now.
- Read anything urgent that arrived over the break with extra suspicion, especially invoices, e-gifts, payment requests and password reset emails you didn't ask for
- If your phone asks you to approve a sign-in you didn't start, decline it and tell your IT support. It can mean someone has your password
- Restart laptops and let any waiting updates finish before diving in
- Expect a printer or two to need reconnecting after weeks switched off, and add it to the list for your IT support rather than working around it
- Check the finance and admin inboxes for messages that look out of place, like supplier emails with new bank details
- If something looks odd, report it to your IT support before deleting it
Your summer IT checklist at a glance
Two weeks before you close
- Install updates on laptops, phones and your website
- Check 2FA on email, banking and finance systems, including shared logins
- Test that a backup restores
- Remove access for people who have left
The week you close
- Agree the payment rule: no bank detail change or urgent payment on an email alone
- Set a short out-of-office message
- Share the “who to call” list
- Check every device that travels locks with a PIN or password
Over the break
- Report a lost or stolen device straight away
- Phone to check any payment request before acting on it
Your first morning back
- Treat urgent emails, invoices, e-gifts and sign-in prompts with suspicion
- Restart laptops and let updates finish
- Reconnect printers
- Report anything odd before deleting it
Someone keeping an eye on things all year
All of this is easier when you're not doing it alone. Highbury Community House, a neighbourhood organisation running childcare and classes, found IT problems were getting in the way as their services grew.
“What appealed to us was the one stop shop of helpdesking, back-ups, information and advice.”
Angela Spooner, Highbury Community House
With that support in the background, the team spends less time on IT and more on their community (read Highbury House's story).
Whoever looks after your IT, the checklist works the same way. Work through it, then actually switch off.
Sources