Be vigilant about passwords. “Most intrusions happen through the front door versus technical back doors”. Password is often the front door key so it is best to have a strong password and change it periodically. You can also set expiration dates on passwords, and enforce password histories so users can’t toggle between the same few open sesames.
Be strict about employee access. Don’t give anyone permissions unrelated to their role. “When someone no longer needs access, delete that user”. Shared user accounts and passwords are inherently insecure and a cause for break-ins.
Be just as strict about remote access. Make your company’s IP the sole IP allowed to reach sensitive information.
Be hyper-aware of phishing attempts. As phishes become savvier, their emails look more credible. Check URLs closely, and go to a company’s website to look for downloads if you’re even slightly suspicious.