DEV Community: ZIA Networks

Git Is Not a Backup: Cloud Backup vs Local Backup for Developers

ZIA Networks — Fri, 23 Oct 2026 11:10:06 +0000

A few years ago I would have told you my code was "backed up" because it was on GitHub. Then I started thinking about everything that isn't in the repo: the .env files, the local database, the client assets, the notes, and the config that only exists on my laptop.

If you freelance, run a small agency, or look after IT for a small business, the cloud backup vs. local backup question is worth ten minutes of your time. Here's a developer-friendly way to think about it, plus a setup you can copy.

First, a myth: Git is not a backup

Git is great at history and collaboration. It is a poor backup for the whole machine because:

Untracked and ignored files (.env, local databases, and build artefacts you can't regenerate) aren't in it.
A force-push or deleted remote can wipe history.
If your remote account is locked or compromised, your copy is only as safe as that account.
Your documents, client files, and system config aren't in any repo.

Keep using Git. Just don't call it your backup plan.

Local vs cloud in one minute

Local backup copies data to hardware you control: an external SSD, a NAS, another machine.

✅ Fast restores, works offline, no monthly storage bill
❌ Same building as the original, so theft, fire, flood, or a power surge can take both

Cloud backup sends encrypted copies to a provider's storage.

✅ Offsite, automatic, scalable
❌ Slow for huge restores, ongoing cost, depends on credentials and the vendor

Neither is enough alone. They cover different failures.

The 3-2-1 rule

3 copies of your data (the original plus two backups)
2 types of storage (local disc plus cloud, for example)
1 copy offsite

A simple dev workstation setup

Here's a minimal version using tools that are already on most Linux and macOS machines, plus rclone for cloud storage. Adjust paths to suit.

Local: versioned snapshots with rsync

This keeps dated snapshots, using hard links so unchanged files don't take extra space.

#!/usr/bin/env bash
set -euo pipefail

SRC="$HOME/projects/"
DEST="/mnt/backup/projects"
TODAY="$(date +%F)"

mkdir -p "$DEST"

rsync -a --delete \
  --exclude 'node_modules/' \
  --exclude '.cache/' \
  --link-dest="$DEST/latest" \
  "$SRC" "$DEST/$TODAY/"

ln -sfn "$DEST/$TODAY" "$DEST/latest"

Skipping node_modules saves a lot of space because you can rebuild it from your lockfile. Don't exclude anything you can't regenerate.

Offsite: encrypted copy with rclone

Configure a remote once with rclone config (many providers are supported, and you can layer a crypt remote on top for client-side encryption). Then:

rclone copy "$HOME/projects" remote:backups/projects \
  --exclude 'node_modules/**' \
  --exclude '.cache/**' \
  --progress

I used copy rather than sync on purpose. sync mirrors deletions, so an accidental delete or a ransomware encryption could propagate to the cloud. If you do use sync, turn on versioning or object lock at the provider, or use --backup-dir so overwritten and deleted files are kept.

Schedule it

crontab -e
# Local snapshot at 1:30 AM, cloud copy at 2:30 AM
30 1 * * * /home/you/bin/local-backup.sh >> /home/you/backup.log 2>&1
30 2 * * * rclone copy /home/you/projects remote:backups/projects --exclude 'node_modules/**' >> /home/you/backup.log 2>&1

Then add something that tells you when it fails: a notification, an email, or a health-check ping. Silent failure is how people discover three months later that nothing has run.

The part everyone skips: test the restore

# Restore a folder from the latest local snapshot to a scratch location
mkdir -p /tmp/restore-test
rsync -a /mnt/backup/projects/latest/my-important-project/ /tmp/restore-test/

# Try to open and run it
cd /tmp/restore-test && ls

Do the same from the cloud copy at least twice a year, and time it. That number is your real recovery time, and it's usually longer than you'd guess.

Things worth thinking about if you're a small business or work in a region like northern New Mexico

I live with a few real-world hazards in mind when advising local businesses: summer storms and power surges, wildfire season, dry dust, and older buildings. They all argue for the same thing: keep at least one copy somewhere other than your office, and put surge protection on anything that stores data.

If you handle client health or financial data, check which regulations apply and whether your backup provider meets them.

Quick checklist

[ ] Code is in Git, and Git is not my only backup.
[ ] I have a local snapshot with some version history.
[ ] I have an encrypted offsite copy
[ ] Deleted files can't instantly vanish from every copy.
[ ] Secrets are stored in a password manager, not just a local``
[ ] Backup failures notify me.
[ ] I've restored from backup in the last six months.

Wrap-up

For the cloud backup vs local backup question, the practical answer is both. Local for speed, cloud for survival, and a restore test to prove it works.

What's in your backup setup? Let me know what tools you use in the comments.

Passkeys vs. Passwords: What Small Business Teams Should Actually Do

ZIA Networks — Thu, 22 Oct 2026 06:47:18 +0000

Most small businesses have no security team. They have a handful of people, fifty-ish logins, and one person who happens to be "good with computers." If that person is you, this post is for you.

The passkeys vs. passwords debate has moved past theory. Passkeys are supported across Apple, Google, and Microsoft platforms, and many major services now offer them. The real question is how to adopt them without breaking your team's workflow.

I'm writing this on behalf of ZIA Networks, where we help small businesses make practical security decisions, so I'll keep it grounded.

Why passwords keep failing small teams

Passwords have three problems that training only partly fixes:

Reuse. One leaked password from an unrelated site can unlock a business account.
Phishing. A convincing fake login page can capture a typed password in seconds.
Overhead. Resets, lockouts, and shared spreadsheets cost time every week.

The weakness is structural: a password is a shared secret that can be typed anywhere, real or fake.

How passkeys work (the short version)

Passkeys are built on the WebAuthn and FIDO2 standards and use public-key cryptography.

During registration, the user's device creates a key pair.
The private key stays on the device (or in a synced credential manager).
The public key is stored by the service.
At sign-in, the service sends a challenge; the device signs it after the user verifies with a biometric or PIN, and the service checks the signature.

Two properties matter for security:

The credential is bound to the site's domain (the relying party ID), so a lookalike domain can't use it.
A server breach exposes public keys only, which are useless to an attacker.

What registration looks like in code

If you build or maintain a web app for your business, here is a simplified browser-side registration call. The options come from your server, and the challenge must be random and single-use.

const credential = await navigator.credentials.create({
  publicKey: {
    challenge: challengeFromServer,        // ArrayBuffer, generated server-side
    rp: { name: "Example Co", id: "example.com" },
    user: {
      id: userIdBytes,                     // stable, opaque user handle
      name: "dana@example.com",
      displayName: "Dana",
    },
    pubKeyCredParams: [
      { type: "public-key", alg: -7 },     // ES256
      { type: "public-key", alg: -257 },   // RS256
    ],
    authenticatorSelection: {
      residentKey: "required",             // creates a discoverable passkey
      userVerification: "preferred",
    },
  },
});
// Send the result to your server, which must verify it and store the public key.

One important note: don't write the server-side verification yourself. Use a well-maintained library (SimpleWebAuthn is a popular option for Node.js) and review its documentation carefully. Cryptographic code is easy to get subtly wrong.

Where passkeys win

Area	Passwords	Passkeys
Phishing resistance	Weak	Strong (domain-bound)
Breach impact	Reusable secrets can leak	Only public keys stored
Reuse and guessing	Common problem	Not applicable
Sign-in speed	Typing and resets	Touch or glance

Where passkeys fall short

I'd rather be honest than hype this:

Not universal. Older software and niche tools may only support passwords, so you'll run both for a while.
Recovery needs design. Synced passkeys (iCloud Keychain, Google Password Manager) make device loss easier to handle, but that account becomes a high-value target. Protect it well.
Shared accounts are awkward. Passkeys are built around individuals. Shared logins are better handled with a business password manager or separate user seats.
Adoption takes a little training. A short walkthrough prevents confusion.

A practical rollout plan

You don't need a big-bang migration:

Inventory your accounts and mark which ones would hurt most to lose: email, cloud storage, accounting, and banking.
Enable passkeys on those first, and test sign-in before removing anything else.
Keep a business password manager for tools without passkey support, with long, unique passwords.
Keep MFA on every account that still uses a password.
Write a recovery plan: who helps when a phone is lost, and where recovery info is stored.
Brief the team in 15 minutes. Keep it simple.
Review quarterly, since more services add support all the time.

Takeaway

Where they're supported, passkeys are the safer choice: they resist phishing, leave nothing reusable in a breach, and make sign-in faster. Passwords still have a place as a backup for tools that haven't caught up.

If you'd like help deciding which accounts to move first or setting up recovery without disrupting your team, ZIA Networks can walk you through it.

Discussion

Have you rolled out passkeys for a team or a product yet?
Which tools in your stack still don't support them?
How do you handle shared accounts and recovery?

HIPAA Security Rule Updates 2026: A Developer's Guide for Santa Fe Clinics

ZIA Networks — Mon, 12 Oct 2026 07:04:28 +0000

If you build or maintain systems for healthcare clinics, the HIPAA Security Rule updates 2026 probably landed in your backlog as a vague "we need to be ready". Here is what is actually happening and what to do about it, from the team at ZIA Networks.

TL;DR

The big security rule overhaul is still only proposed.
The current rule stays enforceable until a final rule replaces it.
The proposal points to encryption, MFA, network segmentation, and documentation. Build for those now.

Where the rule stands

HHS's Office for Civil Rights published the proposed update on January 6, 2025. A final rule was targeted for May 2026, but HHS has delayed final action until at least July 2027.

The existing security rule remains fully in effect and enforceable until a final rule replaces it. And penalties are real: after the 2026 inflation adjustment, they run from $145 to over $73,000 per violation, with annual caps above $2.1 million per category.

What is already mandatory in 2026

The updated Notice of Privacy Practices requirement, tied to the 42 CFR Part 2 final rule, became mandatory on February 16, 2026. If your clinic's patient portal or website links to an old notice, update it.

What the proposal signals for your stack

The proposal would require specific technical standards such as encryption, multifactor authentication, and network segmentation. It would also convert several "addressable" safeguards into "required" controls. And it would require written documentation for all policies, procedures, plans, and analyses.

In engineering terms, that looks like this:

Proposed direction	What to build or check
Encryption	TLS in transit, encrypted storage and backups, encrypted endpoints
MFA	Enforce on email, EHR, VPN, admin consoles, cloud dashboards
Network segmentation	VLANs or separate subnets for clinical systems, guest Wi-Fi isolated
Asset inventory	Auto-discovered list of devices, servers, and SaaS tools touching ePHI
Documentation	Policies, runbooks, and risk analysis kept in version control or a managed wiki

A starter checklist

hipaa_readiness_2026:
  risk_analysis: documented, reviewed at least annually
  mfa: enabled on all remote and admin access
  encryption:
    at_rest: true
    in_transit: true
    backups: true
  asset_inventory: maintained and current
  network_segmentation: clinical vs guest vs office
  backups: tested restores, not just scheduled jobs
  incident_response_plan: written and rehearsed
  business_associates: agreements reviewed
  staff_training: phishing and data handling
  nm_breach_rules: confirmed with legal counsel

Inadequate risk analysis is the most common security rule deficiency OCR cites in enforcement investigations. If you only do one thing from this list, do that one, and write it down.

Why not wait until 2027?

The delay gives organisations more time to build asset inventories, encryption coverage, and MFA rollouts. Ransomware and phishing won't wait for a final rule, and every item above reduces your breach risk today.

How ZIA Networks can help

Small clinics rarely have a dedicated security team. ZIA Networks helps review network and security setups, spot compliance gaps, and prioritise fixes in a practical order.

Have questions about HIPAA Security Rule updates 2026 or your clinic's setup? Drop them in the comments.

Disclaimer: This post is general information, not legal advice. Consult a qualified HIPAA compliance professional or healthcare attorney for guidance specific to your clinic.

Your Backups Probably Haven't Been Tested: The 3-2-1 Rule and a Simple Restore Check

ZIA Networks — Thu, 08 Oct 2026 06:47:03 +0000

Almost everyone has backups. Far fewer people have ever restored one.

That gap is where backup plans fail. The job ran every night, the dashboard showed green, and then the day came when someone needed the data and the files were empty, corrupted, or missing the one folder that mattered.

This post covers the 3-2-1 rule, a few ways backups quietly fail, and a small script you can adapt to check that your restores actually work.

The 3-2-1 rule

It's an old rule because it holds up:

3 copies of your data (the live copy plus two backups)
2 different types of storage (for example, a local disc and the cloud)
1 copy off-site, so a fire, theft, or flood can't take everything

A common modern addition is that at least one copy should be immutable or offline. Ransomware can encrypt anything it can reach, including a backup drive mounted on the same network.

How backups fail without anyone noticing

The job runs but backs up the wrong thing. A moved folder or a new drive that was never added to the selection.
The backup is corrupt. Silent errors on disk or in transit.
Credentials expired. The cloud target rejects uploads and the alert goes to an unused inbox.
Ransomware reaches the backup. It's writable from the same machine, so it gets encrypted too.
Nobody knows the restore procedure. The data exists, but the one person who knew how to recover it left.
Recovery is too slow. A full restore takes three days and the business can't wait that long.

Most of these only show up when you try a restore.

A simple restore check

The idea: restore the latest backup into a scratch folder, pick a few random files from the live data, and compare checksums against the restored copies.

Adjust the paths and the restore command for your tool. The example assumes a tool like restic that restores files under their original path inside the target folder.

#!/usr/bin/env bash
set -euo pipefail

SOURCE_DIR="/srv/company-data"
RESTORE_DIR="/tmp/restore-test"
SAMPLE_SIZE=5

rm -rf "$RESTORE_DIR"
mkdir -p "$RESTORE_DIR"

# 1. Restore the latest backup into a scratch folder.
#    Replace this line with your backup tool's restore command.
# restic restore latest --target "$RESTORE_DIR"

# 2. Pick random files that haven't changed in the last day,
#    so recent edits don't cause false alarms.
mapfile -t FILES < <(find "$SOURCE_DIR" -type f -mtime +1 | shuf -n "$SAMPLE_SIZE")

if [ "${#FILES[@]}" -eq 0 ]; then
  echo "FAIL: no sample files found in $SOURCE_DIR"
  exit 1
fi

failures=0

for f in "${FILES[@]}"; do
  restored="$RESTORE_DIR$f"

  if [ ! -f "$restored" ]; then
    echo "MISSING: $f"
    failures=$((failures + 1))
    continue
  fi

  live_sum=$(sha256sum "$f" | awk '{print $1}')
  backup_sum=$(sha256sum "$restored" | awk '{print $1}')

  if [ "$live_sum" != "$backup_sum" ]; then
    echo "MISMATCH: $f"
    failures=$((failures + 1))
  else
    echo "OK: $f"
  fi
done

rm -rf "$RESTORE_DIR"

if [ "$failures" -gt 0 ]; then
  echo "Restore check FAILED ($failures problem(s))"
  exit 1
fi

echo "Restore check passed"

Run it from cron or a scheduled task, and send failures somewhere a human will actually see them, such as email, a chat channel, or a monitoring tool.

What this script doesn't prove

It checks a sample, not every file.
It doesn't test databases or application consistency.
It doesn't measure how long a full restore takes.
It doesn't cover bare-metal recovery (rebuilding a whole machine).

Treat it as a smoke test, and still do a full recovery drill on a schedule.

A short checklist

[ ] At least one copy is off-site.
[ ] At least one copy can't be modified from your everyday network or accounts.
[ ] Backup credentials are separate from daily-use admin accounts.
[ ] Failure alerts go to a monitored channel.
[ ] A sample restore runs automatically.
[ ] A full restore drill happens at least a couple of times a year.
[ ] The recovery steps are written down where someone else can find them.
[ ] You know how long recovery takes and how much data you could lose

Where this shows up outside engineering

Small teams without a dedicated ops person often assume "the cloud" is handling it. That's worth checking. Many SaaS tools have limited retention or no easy way to recover from accidental deletion, and "synced" isn't the same as "backed up".

For a non-technical take you can share with a manager or client, see Cloud Backup vs Local Backup: Which Is Better for Small Businesses? and Is Your Business Data Really Backed Up?. If you'd rather hand it off, Zia Networks manages backups for small businesses in New Mexico.

Takeaway

Don't trust a backup until you've restored from it. Automate a small check, alert a human on failure, and practice the full recovery before you need it.

What does your restore testing look like today? Let me know in the comments.
Before you publish
Cover image: add one, since posts with images tend to get more clicks. A simple diagram of "3 copies, 2 media, 1 off-site" works.
Set published: true only after you've previewed it.
Don't set a canonical URL. This is original content, so it shouldn't point to your blog.
Test the script on a throwaway folder before you tell readers it works. Make sure the restore command matches your tool.
Tags: dev.to allows 4. Backup, security, DevOps, and beginners are all active.
Tips
Engage in comments. Replying to the first few comments helps the post get seen.
Keep the promotion light. I kept it to one short paragraph near the end, since Dev.to readers dislike ads.
Check link behaviour. Inspect the published page to see whether your links are followed.
Add a series. A follow-up on offboarding access or patching would build your profile.

How to Audit Microsoft 365 Mailboxes for Hidden Forwarding Rules

ZIA Networks — Tue, 06 Oct 2026 07:52:31 +0000

When a business mailbox gets compromised, resetting the password is only half the job. Attackers often leave behind forwarding rules that quietly copy every new email to an outside address, even after the password has changed.

This guide shows how to audit for those leftovers in Microsoft 365 using PowerShell.

Why this matters

Common persistence tricks after account takeover:

Inbox rules that forward or redirect mail externally
Mailbox-level forwarding (ForwardingSmtpAddress)
Rules that move replies to hidden folders so the owner never sees them
OAuth apps with mailbox permissions

If you only reset the password, these can keep working.

Prerequisites

An admin account with permission to read mailbox settings
The Exchange Online module

Install-Module ExchangeOnlineManagement -Scope CurrentUser
Connect-ExchangeOnline

Test in a non-production tenant or on a single mailbox first, and follow your organization's change policy.

1. Check mailbox-level forwarding

This lists every mailbox that forwards mail somewhere else:

Get-Mailbox -ResultSize Unlimited |
  Where-Object { $_.ForwardingSmtpAddress -ne $null -or $_.ForwardingAddress -ne $null } |
  Select-Object DisplayName, ForwardingSmtpAddress, ForwardingAddress, DeliverToMailboxAndForward

Anything pointing to an external address you don't recognise deserves a closer look.

2. Check inbox rules for one mailbox

Get-InboxRule -Mailbox user@yourdomain.com |
  Where-Object { $_.ForwardTo -or $_.ForwardAsAttachmentTo -or $_.RedirectTo } |
  Select-Object Name, Enabled, ForwardTo, ForwardAsAttachmentTo, RedirectTo

3. Check inbox rules across all mailboxes

For larger tenants, loop through mailboxes (this can take time):

Get-Mailbox -ResultSize Unlimited | ForEach-Object {
  Get-InboxRule -Mailbox $_.UserPrincipalName |
    Where-Object { $_.ForwardTo -or $_.ForwardAsAttachmentTo -or $_.RedirectTo } |
    Select-Object @{n='Mailbox';e={$_.MailboxOwnerId}}, Name, Enabled, ForwardTo, RedirectTo
}

4. Remove a suspicious rule

Remove-InboxRule -Mailbox user@yourdomain.com -Identity "Rule Name"

To clear mailbox-level forwarding:

Set-Mailbox -Identity user@yourdomain.com -ForwardingSmtpAddress $null -ForwardingAddress $null

5. Sign out active sessions

Using the Microsoft Graph PowerShell module:

Connect-MgGraph -Scopes "User.ReadWrite.All"
Revoke-MgUserSignInSession -UserId user@yourdomain.com

Post-incident checklist

[ ] Reset the password from a trusted device.
[ ] Enforce MFA for the account.
[ ] Remove unknown forwarding rules and mailbox forwarding.
[ ] Revoke active sessions.
[ ] Reviewed connected apps and consented to OAuth permissions
[ ] Review recently sent items for fraud attempts.
[ ] Check whether regulated data was exposed (e.g., HIPAA, PCI-DSS).

Prevent it next time

Block automatic external forwarding with an outbound spam policy
Turn on audit logging and alerts for new inbox rules.
Require MFA for every user
Run this audit on a schedule, not only after incidents.

Wrapping up

Hidden forwarding is one of the most common ways account takeovers continue silently. A short scheduled audit catches it early.

I'm Paul, founder of Zia Networks, a managed IT provider supporting small businesses across New Mexico. We also publish a free version for non-technical owners.

What other persistence tricks have you seen after mailbox compromises? Share in the comments.

LinkedIn Scams Are Targeting Your Employees: How to Stop Them

ZIA Networks — Mon, 05 Oct 2026 10:06:56 +0000

LinkedIn scams are no longer just a problem for HR or the sales team. Developers, sysadmins, and IT staff are now top targets, because one compromised laptop or stolen token can open the door to code repositories, cloud consoles, and production systems.

At ZIA Networks, we often see the same pattern: the breach doesn't start with a clever exploit. It starts with a friendly LinkedIn message.

Why LinkedIn works so well for attackers

Public profiles reveal job titles, tech stacks, coworkers, and company news. A scammer can read a profile for ten minutes and write a message that feels personal and relevant.

LinkedIn messages also arrive outside your company email, so many filters and security tools never see them.

Common LinkedIn scams

The fake recruiter with a "coding test"

A "recruiter" offers a great role and asks you to clone a repo, run a project, or install a package for a "technical assessment." The code can contain malware, steal credentials, or grab SSH keys and API tokens.

The cloned executive

Someone copies a real manager's name and photo, then asks an employee for a quick payment, gift cards, or a confidential file.

Phishing links

A hacked account shares a fake "document" or "invoice" that leads to a counterfeit login page.

Investment and crypto schemes

A friendly stranger builds trust over weeks, then pushes a "guaranteed" return.

Quiet information gathering

Some scammers ask for nothing at first. They collect details about your company and tools to plan a bigger attack later.

Red flags to know

A new profile with very few connections
A job offer for a role you never applied for
Pressure to act fast
A request to move the chat to WhatsApp, Telegram, or personal email
Unknown people sending files, repos, or links
Writing or details that feel slightly off
A quick safety checklist

[ ] Never run unknown code on a work machine.
[ ] Use a sandbox or virtual machine for any "coding test".
[ ] Never log in through a link in a message
[ ] Use unique passwords and a password manager.
[ ] Turn on multi-factor authentication (MFA).
[ ] Verify odd requests by phone or through IT.
[ ] Report suspicious messages right away.

How to protect your team

Train with real examples. Short and practical beats long and boring.
Set clear rules. No files from strangers, no logins through messages.
Require MFA on every business and developer account.
Use endpoint protection to block harmful downloads early.
Make reporting easy. Fast reports mean smaller damage.
Monitor 24/7. Attackers don't keep office hours.

How ZIA Networks can help

ZIA Networks helps businesses with 24/7 security monitoring, endpoint protection, employee security awareness training, and rapid incident response. We act as an extension of your team, spotting threats early so they don't become costly problems.

Final thoughts

LinkedIn scams keep getting smarter, but a prepared team can stay ahead. Your people are your first line of defence, so give them the knowledge and tools to use it.

Want to protect your people and network? Contact ZIA Networks today.

How Much Does IT Downtime Really Cost a Small Business in Santa Fe?

ZIA Networks — Thu, 01 Oct 2026 07:22:09 +0000

IT downtime is easy to underestimate.

A computer stops working. The internet goes down. Employees can't access a shared application. Email suddenly becomes unavailable.

At first, it may seem like a small technical inconvenience.

But for a small business, even a few hours of disruption can affect employee productivity, customer service, sales, project deadlines, and data access.

So, what does IT downtime actually cost?

A Simple Way to Calculate Downtime Cost

One useful starting point is to calculate the productivity lost while employees cannot work normally:

Affected employees × hourly labour cost × downtime hours

For example, imagine a business has 10 employees affected by an outage for three hours, with an average labour cost of $30 per hour.

10 employees × $30 × 3 hours = $900

That's approximately $900 in employee productivity costs.

But the real cost may be higher.

The business could also lose sales, delay customer work, miss appointments, pay overtime, or spend additional hours recovering from the outage.

What Are the Hidden Costs of IT Downtime?
Lost Employee Productivity

When employees can't access their computers, business applications, files, email, or network, they may be unable to complete their normal responsibilities.

And productivity doesn't always return immediately after the system is restored. Employees may still need time to catch up on delayed tasks.

Missed Revenue Opportunities

Technology problems can affect customer communication and sales.

For example, an outage could prevent customers from:

Contacting the business
Making an appointment
Completing an online payment
Accessing a customer portal
Receiving a timely response

For a small business, these missed opportunities can add up.

Delayed Projects

An IT outage can interrupt projects that depend on digital systems.

A short technical problem can therefore create a longer business delay, particularly when several employees or customers depend on the same work.

Recovery Time

Fixing the original IT problem is only part of the recovery process.

Employees may need to restore files, recreate lost work, check systems, respond to customers, and catch up on tasks that were postponed during the outage.

Customer Experience

Customers expect businesses to be available and responsive.

Repeated technology interruptions can make it harder to provide a consistent customer experience and communicate effectively.

Why Small Businesses Can Be More Vulnerable

A small business may not have a large internal IT department or redundant systems for every critical service.

That means one network problem, hardware failure, software issue, or security incident can affect a significant part of the business.

This is why IT management should focus on prevention as well as troubleshooting.

How Can a Santa Fe Business Reduce IT Downtime?

There isn't one solution that prevents every outage, but several basic practices can reduce risk and improve recovery.

Keep Systems Updated

Operating systems, applications, network devices, and security tools should be maintained and updated regularly.

Back Up Important Data

Business-critical information should have reliable backups.

A backup strategy can help a business recover from accidental deletion, hardware failure, data corruption, or certain security incidents.

Monitor Important Systems

Proactive monitoring can help identify certain technical problems before they become larger disruptions.

Improve Cybersecurity

Cybersecurity is also part of business continuity.

Businesses should consider practices such as:

Multi-factor authentication
Endpoint protection
Firewall management
Security updates
Strong password policies
Employee security awareness

Have a Recovery Plan

Ask an important question before an outage happens:

"What would we do if our most important system stopped working today?"

A basic recovery plan can help employees respond more quickly and reduce confusion during an incident.

Have Reliable IT Support

When a technical problem occurs, having access to experienced IT support in Santa Fe can reduce troubleshooting delays and help employees return to normal operations.

How Much Is One Hour of Downtime Worth to Your Business?

Every company is different.

To estimate your potential cost, consider:

Employees affected
+
Lost productivity
+
Potential lost sales
+
Recovery time
+
Additional business costs

You don't need a perfect number.

Even a rough estimate can help you understand how much your business depends on reliable technology.

Where Managed IT Services Can Help

For businesses that don't have a large internal IT team, managed IT services can provide ongoing technology support and maintenance.

This can include areas such as:

IT help desk support
Network management
System monitoring
Cybersecurity
Data backup
Disaster recovery
Software and patch management
Cloud support

ZIA Networks provides IT support and managed technology services for businesses in Santa Fe and across New Mexico.

The focus is on helping businesses maintain reliable, secure, and productive technology environments.

Final Thoughts

IT downtime isn't simply a computer problem.

It can become a business problem when employees can't work, customers can't reach you, projects are delayed, or important information becomes unavailable.

For a small business in Santa Fe, understanding the potential IT downtime cost is a useful first step toward improving IT reliability.

Regular maintenance, backups, cybersecurity, monitoring, recovery planning, and dependable IT support can all contribute to a more resilient business environment.

The goal isn't to assume that IT problems will never happen. The goal is to be prepared when they do.

About ZIA Networks

ZIA Networks provides IT support, managed IT services, cybersecurity, network support, backup and recovery, and other technology services for businesses in Santa Fe and across New Mexico.

Learn more about the company's business IT services at ZIA Networks.

AI-Generated Emails Are Getting Better. How Should Developers Detect Them?

ZIA Networks — Wed, 30 Sep 2026 07:41:01 +0000

AI can now generate emails that look surprisingly normal.

The grammar is clean. The tone sounds professional. The request may even match something your company actually does.

That creates an interesting security problem:

How do we distinguish a legitimate vendor email from an AI-assisted phishing attempt?

Why traditional red flags are becoming less useful

For years, people were told to look for things like:

Poor grammar
Strange wording
Urgent requests
Suspicious attachments
Unprofessional formatting

Those checks are still useful, but AI makes some of these signals much harder to rely on.

An attacker can use an LLM to rewrite an email, improve its tone, translate it into another language, and make the message look more natural.

So instead of asking:

"Does this email sound suspicious?"

We may need to ask:

"Can I independently verify what this email is asking me to do?"

A simple verification workflow

When an email requests something sensitive, I think the safest approach is to separate the email itself from the verification process.

1. Check the sender domain

Don't only look at the display name.

For example:

John from Example Company john@example-company-support.com

Remote & Hybrid Work Security: What Small Businesses in New Mexico Get Wrong

ZIA Networks — Mon, 28 Sep 2026 08:09:35 +0000

If you're the developer, freelancer, or "computer person" at a small business, you probably also became the IT department. Remote and hybrid work made that job bigger: company data now lives on home routers, personal laptops, and cloud accounts nobody audits.

I'm writing this with New Mexico small businesses in mind, but the fixes apply anywhere. Most small business breaches aren't sophisticated. They come from the same five gaps.

1. Passwords are the only lock

A stolen or reused password is the easiest way in. Whoever controls email can reset nearly everything else.

Fix it this week:

Turn on MFA for email first, then banking, payroll, and cloud storage.
Prefer authenticator apps or hardware keys over SMS where possible.
Roll out a business password manager so nobody reuses passwords.

2. Unmanaged devices and home Wi-Fi

An outdated laptop and a router with its default admin password are an open door.

Fix it this week: require updates, a screen lock, and full-disc encryption on every device that touches company data. Quick status checks:

# macOS: is FileVault on?
fdesetup status

# Linux: look for crypto_LUKS in the FSTYPE column
lsblk -f

# Windows (run as administrator): check BitLocker status
manage-bde -status

Also send staff a short home Wi-Fi checklist: change the router admin password, use WPA2 or WPA3, update the firmware, and put guests and smart devices on a separate network.

3. "Urgent" requests get through

At home, there's no coworker nearby to ask, "Did you get this weird email too?" Fake invoices and messages that look like the boss are common.

Fix it this week: make it a written rule that any request to send money or change payment details is confirmed by phone, using a number you already have. Make reporting a mistake safe, because delays make incidents worse.

4. Backups nobody has tested

A backup you've never restored is a hope, not a backup. Use the 3-2-1 rule: three copies, two storage types, and one offline or off-site.

Fix it this week: restore something. For example, with restic:

# Confirm snapshots exist and the repository is healthy
restic snapshots
restic check

# Restore one folder to a scratch location and verify it opens
restic restore latest --target /tmp/restore-test --include "/path/to/important/folder"

Put a recurring reminder on the calendar to repeat this twice a year.

5. Legal duties are unclear

New Mexico's Data Breach Notification Act expects businesses that hold residents' personal information to use reasonable security and to notify affected people after a breach. HIPAA, PCI DSS, or federal contractor requirements (like NIST SP 800-171 and CMMC) may also apply depending on the industry.

Fix it this week: write a one-page incident response plan with phone numbers for your IT provider, cyber insurance carrier, and an attorney. Confirm current requirements with legal counsel, since laws and thresholds change.

If you only have an hour

Turn on MFA for your business email. It's the highest-impact change most small businesses can make.

Free help

Small Business Development Centers (SBDC) in New Mexico
CISA's free resources for small organisations
Your cyber insurance carrier, which may offer free risk assessments

General education only, not legal advice.

Discussion

What's the one security gap you keep finding at small businesses? Share it in the comments, and I'll cover the most common ones in a follow-up.

IT Support for Construction Companies in New Mexico: Managing Job Sites, Devices & Data

ZIA Networks — Thu, 24 Sep 2026 07:23:50 +0000

Construction technology has changed significantly over the last decade.

A construction project today may depend on cloud applications, tablets, laptops, smartphones, digital plans, project-management platforms, communication tools, and large amounts of shared data. The challenge is that much of this technology has to work outside a traditional office environment.

For construction companies, especially those managing multiple projects and remote job sites, IT support isn't simply about fixing a computer when something breaks. It is about keeping people connected, devices manageable, and business information secure.

Why Construction IT Is Different

A traditional office typically has a relatively predictable IT environment. Employees work from the same location, use managed networks, and connect to a centralised set of systems.

Construction teams can have a very different setup.

A project manager may work from an office in the morning, visit a job site in the afternoon, and access project files from a mobile device later in the day. Field workers may use tablets to access plans, submit information, communicate with the office, or update project-management systems.

That creates several IT challenges:

Multiple locations and networks
Mobile and shared devices
Unreliable connectivity at some job sites
Remote employees and contractors
Sensitive project and business information
Different levels of technical knowledge among users

A good IT strategy needs to account for all of these factors.

Keep Job Sites Connected

Connectivity is one of the foundations of a modern construction project.

When workers cannot access the systems they need, even a short outage can interrupt communication and slow down workflows.

Depending on the location and project requirements, construction companies may need a combination of:

Reliable internet connections
Business-grade Wi-Fi
Cellular connectivity
Secure remote access
Network monitoring
Backup connectivity options

The right approach depends on the site, the applications being used, and how critical connectivity is to daily operations.

The important point is to treat connectivity as part of the project infrastructure rather than an afterthought.

Manage Field Devices

Laptops, tablets, and smartphones can quickly become difficult to manage when employees are working across multiple projects.

Without a consistent device-management process, companies may face problems such as outdated software, missing security updates, inconsistent configurations, or employees using unauthorised applications.

A basic device-management strategy should include:

Standardised device configurations
Regular operating-system and application updates
Endpoint security
User authentication
Remote monitoring
Procedures for lost or damaged devices
Secure device disposal and replacement

Centralised management becomes increasingly important as the number of devices and job sites grows.

Protect Construction Data

Construction companies generate and exchange a significant amount of digital information.

Project documents, contracts, financial information, employee records, designs, schedules, customer information, and communications may all be stored digitally.

Protecting this information requires more than installing antivirus software.

Companies should consider:

Multi-factor authentication
Strong password policies
Role-based access
Endpoint protection
Secure cloud configurations
Regular backups
Employee security awareness
Incident-response procedures

Access should also be based on what a person actually needs to do their job.

Not every employee, contractor, or temporary user needs access to every system or file.

Build a Reliable Backup Strategy

A backup is useful only if it can actually be restored.

Construction companies should regularly review what data needs to be protected, where backups are stored, how frequently they run, and whether restoration has been tested.

A practical backup strategy can include:

Identify → Back Up → Protect → Test → Recover

Testing is particularly important.

A company may discover that a backup process isn't working properly only after data has already been lost. Periodic restoration tests can help identify problems before an actual incident occurs.

Support Cloud-Based Collaboration

Cloud platforms allow construction teams to access information from different locations.

Project managers, office employees, field teams, and authorised external partners can collaborate without relying entirely on a single physical office.

But moving applications to the cloud doesn't eliminate IT responsibilities.

Organisations still need to manage:

User accounts
Permissions
Authentication
File-sharing policies
Device access
Data retention
Security settings

Cloud technology can make collaboration easier, but it still needs proper administration.

Don't Forget the Human Element

Technology is only part of cybersecurity.

Employees interact with email, files, applications, mobile devices, and external users every day. A convincing phishing message or compromised password can create problems even when technical security controls are in place.

Short, practical security training can help employees recognise:

Suspicious emails
Unexpected login requests
Malicious attachments
Fake invoices
Social-engineering attempts
Unusual requests for sensitive information

The goal isn't to turn every employee into a cybersecurity expert.

It is to help people recognise situations that deserve additional attention.

Create an IT Plan Before Problems Occur

One of the biggest mistakes a growing construction company can make is treating IT as something that is addressed only when something stops working.

A better approach is proactive.

Start by documenting:

What devices the company owns
Which applications do employees use?
Where important data is stored
Who has access to critical systems?
How backups are handled
How new employees receive devices and accounts
What happens when an employee leaves?
Who responds when technology fails?

This creates a foundation for a more predictable IT environment.

The Bigger Picture

Construction technology isn't limited to software or hardware. It is part of how projects are coordinated, information is shared, and teams communicate.

As construction companies become more digitally connected, IT support needs to address the entire environment:

Job sites + Devices + Connectivity + Cloud + Security + Data

A reliable IT strategy helps construction teams spend less time dealing with technology problems and more time focusing on their projects.

For organisations operating across New Mexico and other distributed markets, this can be especially important because each project may introduce different connectivity, device, and support requirements.

The most effective approach isn't simply having someone available when a computer breaks.

It's building an IT environment that is secure, manageable, resilient, and ready to support the way construction teams actually work.

How to Choose an MSP in Albuquerque: 8 Questions Most Business Owners Forget to Ask

ZIA Networks — Fri, 18 Sep 2026 06:35:50 +0000

If you're a founder, dev lead, or the person who ends up owning "IT stuff" at a small company, you've probably weighed outsourcing infrastructure and support to a managed service provider (MSP). Most evaluations stop at price and scope. The questions below are the ones that actually predict whether the relationship holds up once something breaks in production — or at 2am on a Saturday.

What's the actual SLA—not the marketing version?

"Fast response" isn't a number. Get response and resolution times broken down by severity, and confirm they apply outside business hours. If there's no distinction between a P1 outage and a stuck printer, that's a red flag.

Do they understand your compliance surface?

If you're touching HIPAA, PCI-DSS, SOC 2, or similar, ask for concrete examples of clients they support under the same requirements — not a checkbox "yes, we do compliance".

Dedicated engineer, or ticket queue roulette?

Some MSPs route every ticket through a shared queue with no continuity. Others assign someone who actually knows your stack. For anything beyond commodity helpdesk work, this matters more than price.

What's excluded from the contract?

Ask explicitly about:

Employee onboarding/offboarding automation
Hardware procurement
After-hours emergency escalations
Security incident response

Undocumented scope is billed scope, later, as a surprise.

Walk me through your actual incident response process.

Not "if" — when. Ask for the real sequence: detection, containment, notification, and recovery. A team that can't answer this in specifics probably hasn't run the drill.

What's the offboarding story if we migrate providers?

Get clarity in writing on data portability and credential handoff before you need it — this is the equivalent of checking you can actually export your data before you commit to a SaaS vendor.

Can you connect me with a current client running a similar stack/size?

References beat marketing copy every time.

What does proactive communication actually look like?

Good MSPs surface findings before you ask — patch cadence reports, vulnerability scans, and capacity trends. If all communication is reactive (i.e., only when something's on fire), you're paying for a helpdesk, not a partner.

Final Thoughts

Outsourcing IT/infra support is an architecture decision as much as a business one — it affects uptime, security posture, and how much on-call burden your team actually carries. These eight questions are a reasonable filter before signing anything.

Disclosure: I work with ZIA Networks, an MSP based in New Mexico — happy to answer questions on any of the above in the comments.

10 Essential Questions to Ask Before Signing an IT Support Contract

ZIA Networks — Mon, 07 Sep 2026 11:33:09 +0000

Choosing an IT support provider isn't simply a matter of comparing monthly prices.

For a small or growing business, an IT support contract can affect everything from system uptime and cybersecurity to employee productivity and disaster recovery.

The problem is that many contracts can look straightforward until something goes wrong.

A business might discover that emergency support costs extra, certain security services aren't included, response times aren't guaranteed, or critical systems aren't covered by the agreement.

At ZIA Networks, we believe the best IT support relationships start with clear expectations.

Before signing an IT support contract, here are 10 questions worth asking.

What exactly is included in the monthly fee?

Start with the basics.

Ask the provider to clearly define what your monthly payment covers.

Depending on the agreement, this might include:

Help desk support
Remote troubleshooting
On-site support
Network monitoring
Endpoint management
Software updates
Security monitoring
Backup monitoring
Device management
User onboarding and offboarding

Don't assume that a service is included simply because the provider mentioned it during a sales conversation.

Tip: Ask for a written list of included and excluded services.

What are the guaranteed response times?

When an employee can't access an important system, the difference between a 15-minute response and a four-hour response can be significant.

Ask about the provider's Service Level Agreements (SLAs).

You should understand:

What counts as a critical issue?
How quickly will critical issues receive a response?
What happens with medium- and low-priority tickets?
Is there a guaranteed resolution time?
Do SLA times change outside normal business hours?

A strong support agreement should define these expectations clearly.

Is support available 24/7?

Not every company operates on a traditional 9-to-5 schedule.

If your business operates outside standard working hours, ask how after-hours incidents are handled.

For example:

What happens if our network goes down at 10 PM?

The answer should be clearly documented in the contract.

Also check whether 24/7 support is included in the monthly price or treated as an additional service.

How will cybersecurity incidents be handled?

Modern IT support should take cybersecurity seriously.

Ask potential providers how they respond to incidents involving:

Ransomware
Malware
Phishing
Compromised accounts
Unauthorised access
Lost devices
Data breaches

It's also worth asking which security technologies and services are included.

For example:

Endpoint protection
Email security
Multi-factor authentication
Security monitoring
Vulnerability management
Security awareness training
Incident response

Most importantly, understand who is responsible for what if a security incident occurs.

How are backups created and tested?

A backup strategy is only useful if the data can actually be restored.

Ask:

How frequently are backups performed?
Where are backups stored?
Are backups encrypted?
How long are they retained?
Are multiple backup copies maintained?
How often are restoration tests performed?
Who monitors failed backups?

A provider should be able to explain its backup and recovery process in practical terms.

A useful question to ask

"Can you show me how you would restore our critical systems after a major failure?"

The answer can reveal much more than simply asking whether backups exist.

Who owns our data and administrative accounts?

This question is easy to overlook.

Your business should understand who owns and controls its technology environment.

Clarify ownership of:

Business data
Domains
Cloud accounts
Microsoft 365 or Google Workspace accounts
Administrative credentials
Network configurations
Backup data
Software licences
Documentation

This becomes especially important if you eventually change IT providers.

You don't want your business to discover that critical accounts or configurations are controlled entirely by an outside company.

What costs are outside the contract?

A low monthly price can become expensive if many essential services are billed separately.

Ask about additional charges for:

Emergency support
After-hours support
On-site visits
New employee setup
Hardware installation
Software installation
Network changes
Cloud migrations
Major projects
Additional licences

Ask the provider to explain how extra work is approved and billed.

Ideally, there should be no surprises on your invoice.

What proactive monitoring do you provide?

Reactive IT support waits for something to break.

Proactive IT support attempts to identify problems before they become major incidents.

Ask whether the provider monitors:

Servers
Workstations
Network devices
Storage
Backup systems
Security tools
Device health
Software updates

For example, identifying a failing hard drive before it causes downtime is much better than discovering the problem after the server stops working.

What happens if we want to leave?

Nobody likes to think about ending a vendor relationship before it begins.

But you should.

Read the contract carefully and look for:

Contract length
Renewal terms
Cancellation notice
Termination fees
Data return procedures
Credential handover
Documentation requirements
Equipment ownership
Transition assistance

A professional agreement should make the exit process as clear as the onboarding process.

Can you provide references from similar businesses?

Experience matters.

Ask whether the provider can provide references from businesses with similar:

Company size
IT requirements
Number of employees
Security needs
Cloud environment
Industry requirements

When speaking with references, don't just ask:

"Do you like the IT provider?"

Ask more specific questions:

How quickly do they respond?
Are invoices predictable?
How do they communicate during outages?
Have they helped with security incidents?
Do they proactively identify problems?
Would you hire them again?

These answers can provide valuable insight before you sign a contract.

Red Flags to Watch For

Some warning signs should make you slow down before signing.

Be cautious if a provider:

Cannot clearly explain what's included
Avoids putting SLA commitments in writing
Gives vague answers about cybersecurity
Cannot explain its backup strategy
Controls critical accounts without clear ownership terms
Has unclear additional fees
Makes it difficult to understand cancellation terms
Focuses heavily on price instead of outcomes

A good IT provider should be comfortable answering difficult questions.

A Simple IT Support Contract Checklist

Before signing, make sure you can answer yes to these questions:

Do I know exactly what services are included?

Are response expectations documented?

Do I understand after-hours support?

Is cybersecurity clearly addressed?

Are backups monitored and tested?

Does my business retain ownership of its data and accounts?

Are additional charges clearly explained?

Is proactive monitoring included?

Do I understand the cancellation process?

Have I checked relevant customer references?

If several answers are unclear, ask for clarification before signing.

Final Thoughts

An IT support contract isn't just another vendor agreement.

It defines how your business will receive technical assistance, how problems will be handled, what security responsibilities exist, and what happens when something goes wrong.

That's why businesses should evaluate more than the monthly price.

At ZIA Networks, we believe transparency should be part of every IT support relationship. The goal isn't simply to find a provider that can fix problems. It's to find a technology partner that understands your environment, communicates clearly, and helps you reduce avoidable IT risks.

Before signing your next IT support agreement, take the time to ask the difficult questions.