Something from a report Anthropic posted last year has bothered me for a while now, and I’m finally able to put it into words.
The report outlined how a single person was able to attack 17 different organizations through a variety of large-scale theft and extortion attempts of personal data within a month’s time frame.
Not a crime ring. Not a syndicate. One person sitting behind a terminal using AI.
As a small business owner, what this means to me is that cybercriminals no longer have to target any particular organization.
Instead, all they have to do is find a door into yours.
Using AI, a cybercriminal can “vibe” code, automate reconnaissance, harvest victims’ credentials, and penetrate your network and decide what can be exploited for their gain.
We are all targets now.
What this has meant to how I run my small business is that I’ve built some core principles ingrained in me from my days in corporate America.
Early on, our security team rolled out a least privilege policy for every employee.
At the time, my team had admin rights to many of the systems they supported, rights they didn’t need.
We worked to build automation systems that replaced the need for admin access. The tools were purpose-built with only the permissions needed to do the job.
We gathered logs in central repositories, stripped of sensitive data, so nobody had to log in to a server and grep through a log anymore.
It was fine. And other groups followed suit.
Today, in my own business, the email account I use for all my communication with customers and clients is not the one I use for my bank and payment platforms.
The email addresses I use to manage my farm’s YouTube channel and The Weekly Tinkerer Substack are different too.
On each of these platforms, I keep separate account holder and content creator roles. I never publish content from the account holder role. And I never use the content creator role for account-level changes: monetization settings, security changes, anything destructive.
And yes, you guessed it, each role has its own email and login.
I only stay logged in as the content creator, which is also the account I use to interact with other channels and newsletters.
The logs and metrics from the infrastructure running my applications are sent to a central monitoring system that sends alerts to my phone, so I never have to log in to the servers directly.
Does this setup feel extreme and obtrusive?
Not really.
Using a good password manager to access different resources with the appropriate credentials is seamless and requires minimal thought.
Whose login owns your business’s Facebook page, your Google Workspace, your bank portal? Is it the one you answer email from all day?