SOCtoberfest: The Four Habits That Stop Most Attacks - Passwords, MFA, Phishing and Patching

The basics beat the buzzwords: four habits that block most attacks.

Every October, the Cybersecurity and Infrastructure Security Agency (CISA) uses Cybersecurity Awareness Month to remind everyone from individuals to Fortune 500 security teams that most breaches do not start with an exotic zero-day exploit. They start with one of four everyday gaps: a weak password, a missing second factor, a convincing phishing email, or a patch that never got applied.

CISA’s “4 simple steps” boil decades of security research down to a checklist anyone can act on:

• Use strong, unique passwords and a password manager.
• Turn on multi-factor authentication (MFA).
• Recognize and report phishing.
• Keep software updated

For a small business without a dedicated security team, that’s genuinely good news. You don’t need a seven-figure security budget to close the gaps attackers rely on most; instead, you need consistent habits. Below is a practical breakdown of each habit, what it takes to implement with limited IT staff, and where a layer like SonicWall Cloud Secure Edge (CSE) picks up the slack when a habit slips.

1. Strong Passwords and a Password Manager

CISA’s guidance is specific: passwords should be long, random, unique per account, and mix character types. In practice, almost no one can memorize passwords that meet that bar across dozens of accounts, which is exactly why a password manager is part of the recommendation, not an optional add-on.

For a small business, this looks like:

• Standardize on one password manager (business-tier, not the free consumer version) and require every employee to use it.
• Turn on a company password policy where your systems allow it: minimum length, no reuse, no shared logins.
• Retire any shared “admin” or “team” account passwords that multiple people know.

Where this habit tends to break down: even with a strong password policy, a single set of stolen credentials can still be enough to get into a VPN or application if that’s the only thing standing guard. SonicWall’s research on this exact scenario, Stolen Credentials Don’t Have to Mean a Breach, argues that the real question isn’t whether a password is strong, but whether your systems verify anything beyond the password. A leaked password alone should never be enough to reach your applications. Cloud Secure Edge applies Zero Trust Network Access (ZTNA) with Defense in Depth. On every access request, it checks the device certificate before the identity provider verifies the user. These are two independent, required gates: stolen credentials cannot bypass the device check, and a stolen device cannot bypass the credential check. The outcome is that a leaked password alone cannot reach your applications.

2. Turn on Multi-Factor Authentication

MFA is the single highest-leverage control on this list. CISA notes it makes an account “significantly less likely” to be compromised, and it’s free or low-cost on nearly every platform your business already uses.

For a small business, this looks like:

• Enable MFA on email, financial accounts, and any cloud admin consoles first. Attackers want these accounts most.
• Prefer an authenticator app or hardware token over SMS codes, which attackers can intercept via SIM-swap attacks.
• Make MFA enrollment part of Day One onboarding, not an optional step new hires can skip.

Where this habit tends to break down: MFA isn’t invincible. Attackers have learned to steal session tokens, exploit “MFA fatigue” by spamming approval prompts, or target VPN appliances where MFA seeds themselves can be compromised. That’s the scenario SonicWall walks through in VPN Vulnerabilities Don’t Have to Become Breaches, a reminder that MFA is necessary but not sufficient. Cloud Secure Edge removes the need for a publicly exposed VPN gateway, which reduces the attack surface, and it layers device posture and context checks alongside MFA rather than instead of it.

3. Recognize and Report Phishing

CISA calls phishing the number one way data gets compromised. For small businesses, it is among the most common ways an attack reaches an employee, because phishing targets people rather than technical defenses.

For a small business, this looks like:

• Train every employee to pause on unsolicited requests for credentials, payments, or sensitive data, especially urgent ones.
• Establish a simple, known way to verify suspicious requests (call the sender on a known number, don’t reply to the email itself).
• Give employees a one-click way to report suspicious messages to whoever handles IT, even if that’s an outside MSP.

Where this habit tends to break down: training reduces clicks, but it never gets click rates to zero. Someone, eventually, will click. SonicWall’s A Click Shouldn’t Lead to a Breach makes this the design principle: assume the click happens and build so it doesn’t turn into a breach. Cloud Secure Edge’s Secure Web Gateway checks web destinations in real time and blocks known-malicious sites. For remote users with SIA Advanced licenses, file downloads are also analyzed with Capture ATP sandboxing and RTDMI before they reach the device. The result is that a single click is far less likely to become a breach. It is a safety net beneath the training, not a replacement for it.

4. Keep Software Updated

Patching is the least glamorous item on CISA’s list and often the first to slip when there’s no dedicated IT staff watching for updates. Attackers actively scan for unpatched, internet-facing systems; firewalls and VPN appliances are frequent targets precisely because they sit on the edge of the network.

For a small business, this looks like:

• Turn on automatic updates wherever they’re available, such as operating systems, browsers, and antivirus.
• Keep an inventory of what can’t auto-update (firmware on network appliances, line-of-business software) and check it on a set schedule.
• Prioritize patches for anything exposed to the internet first.

Where this habit tends to break down: patching always lags reality; a critical fix might be days or weeks from being applied, and in that window, an exposed VPN or firewall is a live target. This is the core argument in Your Firewall Cannot Follow Your Employees Home — But Cloud Secure Edge Can: once work happens outside the office, the perimeter you patch and maintain stops being the whole picture. CSE is cloud-delivered and enforces the same Zero Trust access policy regardless of location, whether a user is in the office, at home, or traveling. It also extends firewall-grade web protection to off-premises users. Employees receive the same protection away from the office as behind the firewall, and security does not depend entirely on how current a single appliance’s firmware is. For the firewalls and appliances that remain, SonicWall’s Managed Protection Security Suite (MPSS) helps you patch and update quickly, removing much of the stress that businesses and partners face keeping devices current.

The Pattern Across All Four

Each of CISA’s four steps is a best practice on its own, and each can still fail. A password still gets phished, MFA still gets bypassed, a link still gets clicked, a patch still ships late. None of that argues against the habits; it’s why security works in layers. CISA’s four steps close the gaps that cause most incidents. Add a Security Service Edge layer like SonicWall Cloud Secure Edge to close the gap left when one of those habits has a bad day.

For a small business, the combination matters: get the basics right with four simple habits, and add a backstop that helps when one habit slips. Together, these habits and this backstop make the model complete.

Learn more about SonicWall Cloud Secure Edge. See how CSE supports these habits and completes the model.

Source: CISA’s 4 core cybersecurity steps, part of Cybersecurity Awareness Month.