Before the holidays: prepare, protect, delegate

1. Review and limit accounts and access

• Remove temporary or unused access
• Review permissions assigned to external providers
• Restrict privileged access and ensure traceability
• Apply clear rules for governing bodies, where necessary
• Record everything — future deactivation and reactivation actions

Minimum access. Limited time. Everything traceable.

2. Define substitutes and clear procedures

• Who replaces whom?
• What decisions may be taken?
• What should be done in the event of an incident?

Continuity is not only presence — it is preparation and response.

3. Strengthen vigilance against fraud and phishing

• Urgent payments allegedly requested in the name of an absent CEO
• Fake requests to change an IBAN
• Urgent messages threatening penalties
• Fake prizes or competitions
• Fraudulent delivery links
• Beware of deepfakes: fake voice or video messages requesting access, transfers or extortion payments

Stay extra alert. Apply cyber hygiene. Always report.

4. Review continuity and incident response plans

• Are the plans updated and tested with a reduced team?
• Who activates the plan in August?
• Do suppliers remain ready during that period?

A plan that does not work during the holiday period… is not a plan.

During the holidays: keep the essentials working

5. Be careful with public networks and Wi-Fi

• Switch off networks and equipment that are not needed
• Avoid public Wi-Fi when accessing systems
• If unavoidable, use the organisation’s VPN

Today’s convenience may become tomorrow’s incident.

6. Protect and automate without switching off completely

• Automate backups (preferably immutable)
• Activate alerts and notifications for incidents
• Ensure minimum visibility even during holidays

Smart automation protects even when you switch off.

7. Avoid exposing your absence on social media

• Avoid phrases such as “away until September”
• Avoid photos and videos with real-time location
• Prefer closed groups for personal sharing

A larger digital footprint means more opportunity for social engineering attacks.

After the holidays: validation and reactivation

8. Revalidate access and changes made

• Is any temporary account still active?
• Were any settings changed without being reversed?
• Was any incident not detected?
• Review logs and security reports

Post-holiday period = mandatory check-up.

9. Update and validate systems

• Apply pending security updates
• Check backups and reports
• Confirm the integrity of logs, including antivirus and firewall logs

Start with confidence. Without technical doubts.

Author: Behaviour
Published on: 4 August 2025
Copying or reproduction of this article is not authorised.