How to secure the accounting department working with different bank accounts and crypto plugins?

Question

Electronic accounting

There are several people working with bank accounts of OOOshka IPshka (no, this was not cashed out, and nothing criminal at all, everything is legal, but I won’t go into details, “the less knowledge the competitors have, the better the business.”)
Having read all sorts of crap lately about virus attacks (encryptors are especially relevant) and draining data and passwords, I would like to somehow secure both personal data and my entire office (although it is not large, only 7-8 PCs)
Hiring a system administrator and raising a server - I don’t see the point for three reasons
1) hardly Can you find a well qualifieda specialist who will seriously administer 7-8 computers, and even if we find it, it’s not a fact that he will provide 100% protection, and even vice versa, if you hire a “stupid”, it will become much easier to lose passwords and money.
In general, we work only with trusted people and would not like to hire x. understand who
2) I don’t plan to expand next year yet, maybe when I expand, I’ll think about hiring an IT specialist with a high salary, etc.
3) all people work with different accounts and different people, even though they sit in the same office.
uniting them all into one network or even to a local network - I think the probability of infection, hacking, etc. much easier (or am I wrong?)
In a word, I don’t trust, our colleagues and I have money for illiterate specialists, and there are a dime a dozen of them on the labor market now, universities are churning out packs of NON-SIS-ADMINS. And there is no way to check whether he knows his job well or not.

spoiler

Кстати об этом: Друг - владелец небольшой компании недавно потерял круглую сумму только потому что доверился идиоту сис.админу который как выяснилось сам себе отправлял скрины с логином и паролем сервера через какой-то файлообменник с открытым доступом, а ведь с виду казался довольно умным парнем. Надеюсь этого оленя никуда больше не устроят.
Еще один случай был у одного моего знакомого директора в начале года, опять же из-за глупости админа: вирус шифровальщик, который положил весь сервер. Глупость админа в данном случае была в неправильной настройке бэкапа сервера. Бэкап файлы тоже зашифровались и в итоге бизнес человеку спас мой "пьяный" совет, на всякий случай загрузить все данные с сервера себе на жесткий диск, к сожалению скопировал он их за 2 месяца до случившегося, поэтому данные за последние 2 месяца пропали.
(прошу прощения если кого-то обижаю из ХАБРА и ТОСТЕРА своими словами, но факт фактом)

<--- Speaking of ridiculous sis admins
And now to the issue of security.
1) VIPnetMonitor from Infoteks was advised , but not quite yet going into details of what it is and did not quite understand through whom and how all this encrypted traffic will pass
2) do I need to install a program that will randomly change mac? (or is this already a level of paranoia?)
3) what is the best way to store passwords?
The main thing:
In general, dear experts and just readers of this issue, I ask for your suggestions on security and comments on the actions taken. I would like to be as safe as possible both from viruses and from the extra eyes of government agencies;)

spoiler

p.s да, я знаю что полностью от гос. органов скрыть незаконные действия невозможно особенно учитывая что работаем с банками, да это и не в приоритете. Поэтому оставим тему об полной анонимности для школы. Тем не менее чем меньше информации о нас будет знать как провайдер так и поисковики тем лучше.
Кроме того я прекрасно понимаю что главная проблема в кибербезопасности находится "между креслом и монитором" опустим тему соц.инженерии. Кстати своим ребятам я описал все что знаю об фишинге и угону паролей, дабы не кликали по документам и картинкам на почте не понятно от кого + дал люлей за легкие пароли и за работу с домашних ПК и андроидов

Answer 1

I agree with all those who unsubscribed in the answers and comments, but still I will answer with one piece of advice, which, perhaps in your case, can help a lot.
Separate and standardize everything and as much as possible. Those. literally, each subtask should be solved in an independent environment, ideally divided by hardware, but this is expensive (that is, roughly speaking, put a computer on a task) - working with banks, working with mail, working with the Internet, working with a client, working analytics, work with reports, work on setting up and administering the environment, lunches, toilets, planning meetings, .. sit down and write it all down on a piece of paper, thoughtfully, why, when, why, how.
Avoid collective hodgepodge, it should not be such that different employees work with different products, if you can do it in one. Those. if mail, then let everyone have one product and not ten (because everyone is used to their own). In no case should personal and work tasks be mixed, I'm not talking about a ban, I'm talking about separation and isolation.
The simplest and cheapest solution for isolation is virtualization and terminal servers. Believe me, if you put users to surf the abstract Internet on a separate machine, connecting to it via a terminal (rdp/vnc/..), which has no access to your local network and machine, then this will become an almost insurmountable obstacle for viruses of any kind (there are some nuances), moreover, these machines can be automatically cleaned up by regular means of virtualization tools (reset to default state, with automatic updates at night), this will be the best antivirus and quite simple to set up.
Let your mail and chats be in one sandbox, and the opening of web pages and documents that came from outside, in another, with closed access to each other not only by files but also by the network (one of the reasons why the software should be unified, setting these restrictions is easier ).
In fact, you really may need to transfer information between these zones, in most cases the usual clipboard buffer of your workplace can handle this (with reservations), but you still have to set up some ways of transferring information, so what and where to transfer should be controlled, ideally by the security department, or at least specialized software (if you are afraid of leaks of classified information, for example), but at least common sense. For example, you received a pdf or docx document, by mail, .. this is already an attack vector, and you need to open such documents in an isolated sandbox, but you need to work with them, so usually this is copying specific information and pasting it into your working documents, less often - loading these documents into your software or saving,
Do the same with other tasks, let them be separated as much as possible. I know people are accustomed to making a shared file cleaner available on the entire local network without any separation of rights, but this is the first attack vector and a huge hole for information leakage. Everyone should have access to exactly as much as he needs. Do not be lazy, set up and delimit, and there is nothing permanent, you won’t be able to set it up once and then not return to this issue, you will have to think and reconfigure (albeit much less than the first time), and this is not about knowledge of computer administration, it’s about the ability to formulate your tasks, because if you have an administrator, you just have to do all this only in human words, communicating with him.
ps I will be popped here now, but I repeat, sandbox isolation (based on virtual machines and several independent network segments) is not the most correct, but the simplest and cheapest solution available to small organizations that are not ready to pay for ready-made ERP solutions.

Answer 2

It's called "cargo cult". The meaning of this term is that people do some things without completely understanding the mechanisms of their work, but treating them as magical rituals, which, according to their belief, should lead to the desired result.
The use of Tor "for anonymity" when performing online actions that in themselves completely deanonymize you is the best example of this, but not the only one.
The rest is just the same magical actions. "I read that cleaning the registry is good for security" is no different from "I read that eating ginger is good for health". Or how someone buys himself the most expensive set of tools and climbs to fix something, despite the fact that the tools do not affect the fact that his hands are growing out of his ass and in the device of what he is going to repair, he does not understand nothing.
Try to hire a person who really understands information security. Although it will be difficult: this one will read your terms of reference, turn around and leave. And it will remain - one that will pour slang words for show-off and also put "magic" programs for you.

Answer 3

I will try to answer this stream of consciousness seriously.
Download and read Ogletree's books on information security, make a normal network, set up a DMZ, install a normal antivirus, set up a firewall. Don't do crap like " I've been reading Habr and Hacker and now I'll defend everything cool, ya cool backup ".
What you've done is overhead and mostly bad for security.