Cybersecurity 
The holidays move work out of the office, and often out of the house, onto whatever network is nearby. Employees answer messages from airports and relatives’
The end of the year is a good time to close security gaps before they become bigger problems. Seasonal workers may still have access, old API keys may still be active and old accounts may retain admin rights long after a project has ended.
A year-end reset helps your team start January knowing who has access, which systems need attention and where risks remain.
Here are 10 tasks to complete before the holiday break:
- Review who has access to what. Start with your most important systems, such as email, cloud storage, finance tools and customer data. Confirm that each person still needs their current level of access.
- Offboard former employees and seasonal staff. Check the accounts of anyone who left this year or was hired for a short period. Remove access, collect company devices and confirm that nothing is still being shared through personal accounts.
- Rotate shared and privileged passwords. Change passwords for shared accounts, service accounts and admin logins, especially after staff changes. These credentials can be particularly sensitive, especially when stored in unsecured spreadsheets or other locations that lack appropriate access controls.”Keeper’s shared vaults give IT one place to store, rotate and control access to them, so a password changed once is updated for everyone who uses it.
- Check Multi-Factor Authentication (MFA) coverage. Confirm that MFA is enabled for every admin account and remote access service. Look for exceptions, such as legacy accounts that bypass MFA.
- Review admin rights. Reduce the number of accounts with elevated privileges. Administrative privileges should be limited to users and tasks that require elevated access, following the principle of least privilege.
- Audit third-party access. Review integrations, OAuth apps, API keys and vendor accounts. Remove anything no longer in use and document who owns each remaining connection.
- Confirm that your backups work. Without regularly testing restoration, organisations may not know whether their backups can be recovered successfully when needed. Test a recent restore for a critical system and confirm that backups are stored separately from the main environment.
- Patch and retire outdated software. Install outstanding security updates and identify any software that has reached end of life. Plan replacements for anything that can no longer be patched.
- Check logging and alerts. Make sure logs are collected from key systems and that someone is reviewing alerts. Confirm that retention periods meet your policies and any regulatory requirements.
- Record lessons from the year. Note any incidents, near misses or recurring issues. Update your incident response contacts while people are still available. The January version of your team will thank you.
While some of these tasks can be completed relatively quickly, others may require additional planning, resources or coordination across teams. Together, these tasks help establish more consistent security practices and identify areas requiring further attention.
Several of these tasks come back to the same question: who has access to what, and can you prove it? Keeper helps IT teams securely manage passwords, shared credentials and access across the organization, so next year’s reset starts with the answer already in hand. See what Keeper can do for your team with a free trial.
