Article Read Time
So what do the holidays have to do with being cyber safe? With the holidays around the corner, your organization is probably focused on year-end deadlines, staff vacations, and maybe a little celebration. Unfortunately, cyber criminals are just as busy, and they love this time of year. People are distracted, inboxes are overflowing with “special offers,” and IT teams are stretched thin.
The good news: a few smart precautions can go a long way. Here are 10 practical tips to help your organization have a cyber safe holiday season.
1. To stay cyber safe, treat every holiday email as suspicious by default
Holiday-themed phishing attacks spike this time of year, with fake shipping notices, charity appeals, gift card offers, “end of year” invoices, and HR messages about bonuses.
Coach your team to:
- Hover over links before clicking
- Be wary of unexpected attachments
- Verify any “urgent” request through a second channel (phone call, Teams/Slack, in-person)
If it tugs at emotions, excitement, panic, guilt, or urgency, slow down and verify first.
2. Lock down gift card and money requests
One of the most common holiday scams: an email or text “from” the CEO or a supervisor asking someone to buy gift cards as staff rewards or customer thank-yous quickly.
To prevent this:
- Create a clear policy: no one should ever purchase gift cards or send payments based solely on an email or text.
- Require voice or in-person confirmation for any unusual financial request.
Make sure everyone, especially finance and admin staff, knows this cyber safe policy before the holidays.
3. Tighten access before people go on vacation
Out-of-office doesn’t have to mean out-of-control. Before staff start taking time off:
- Review who has access to critical systems and data
- Temporarily remove access for seasonal staff who no longer need it
- Disable accounts for former employees or contractors
Fewer active accounts mean fewer doors for attackers to walk through while no one is looking.
4. Require multi-factor authentication (MFA) everywhere you can
If you haven’t turned on MFA yet, the holidays are the time to stop putting it off. MFA adds a second step, like a code sent to your phone, to your login process, making it much harder for attackers to break in, even if they steal your password.
Start with:
- Email and productivity platforms (Microsoft 365, Google Workspace)
- Remote access (VPN, remote desktops)
- Financial and HR systems
It’s one of the highest-impact, lowest-cost cyber safe protections you can put in place.
5. Remind staff to secure their personal shopping devices to stay cyber safe
Even though your organization may not control employees’ personal phones and home computers, their risky behavior can still impact you — especially if they check work email or log into work systems on those devices.
Before Black Friday and the main holiday rush:
- Share a short “Cyber-Safe Holiday Shopping” tip sheet
- Encourage software updates, antivirus, and using official apps (not random download sites)
- Remind them never to reuse their work password on shopping sites
Safer personal devices mean safer connections back into your organization.
6. To stay cyber safe, watch for fake shipping, tracking, and delivery messages
With all the packages flying around, fake tracking emails and texts are everywhere. These often contain links that install malware or lead to credential-stealing sites.
For your staff:
- Train them to go directly to the shipper’s website (UPS, USPS, FedEx, Amazon) or app instead of clicking links in messages
- Make it clear: do not use work email or work devices for tracking personal packages if you can avoid it
One careless click on “track your delivery” can become a doorway into your network.
7. Update and patch before everyone disappears
Attackers love unpatched software. The end of the year is a smart time to:
- Apply pending security updates to servers, laptops, and critical applications
- Update firewalls, routers, and Wi-Fi equipment
- Remove unsupported or “temporary” software that somehow became permanent
If possible, schedule a short maintenance window to get your environment in good shape before your IT staff takes a vacation.
8. Strengthen remote work security for holiday travel
Many people travel with laptops and work from relatives’ houses, hotels, or airports this time of year. That creates extra risk if you don’t plan for it.
Remind your team to:
- Use a VPN when working on public or hotel Wi-Fi
- Avoid using shared computers (like business center PCs) for any work accounts
- Never leave laptops, tablets, or paper files unattended in cars or public spaces
If your organization issues devices, review your ability to wipe them if they’re lost or stolen remotely.
9. Keep an eye on your financial accounts
Year-end is also prime time for fraud. Attackers know finance teams are busy processing donations, closing books, and handling holiday spending.
Put extra controls in place:
- Require dual approval for wire transfers and changes to vendor payment details
- Reconcile bank and credit card accounts more frequently through the holidays
- Be cautious with “new vendor” setups or last-minute payment changes
A quick call to confirm a “new” bank account can prevent a costly mistake.
10. Have a simple incident response plan ready
Despite your best efforts, something may still go wrong: a suspicious email clicked, a lost laptop, or strange behavior on a system. The worst time to figure out what to do is in the middle of a crisis.
Make sure your team knows:
- Who to call first if they suspect a problem
- What systems to disconnect or power down (only if instructed)
- What not to do (like deleting evidence or trying to “fix it” themselves)
Even a one-page checklist can dramatically reduce damage when minutes matter.
A cyber safe holiday season starts with small, smart steps
You don’t need a massive budget or a full-time security team to stay safer during the holidays. Clear policies, a few technical safeguards, and repeatable habits can protect your organization when attackers assume you’re distracted.
If you’d like help reviewing your readiness or training your staff before the holidays hit full swing, Commonwealth Sentinel can work with you to:
- Run a quick security checkup
- Deliver short, engaging staff training
- Build a simple holiday incident response checklist tailored to your organization
With proper preparation, you can enjoy the season and let cybercriminals find an easier target elsewhere.
Commonwealth Sentinel will help you face your organization’s growing cyber security threats. We can assess your existing IT security and collaborate with your team to safeguard your data and assets. At Commonwealth Sentinel, we stay focused on cyber security so you can focus on other things. Contact us today or sign up for a free consultation.
At Commonwealth Sentinel, we are focused on cyber security so that you can focus on other things.