Seven security basics every small business should have in place

Small businesses sometimes assume that cybercriminals only go after large organisations. In reality, smaller firms are often easier targets because they have fewer protections, and attackers frequently use automated tools that do not care how big you are.

The good news is that most of the risk can be reduced with a handful of sensible habits. None of these require specialist knowledge or a big budget. Here are seven that we would put in place first.

1. Use strong, unique passwords

Reusing the same password across several services is one of the most common weaknesses. If one service is breached, attackers try the same password everywhere else. Every account should have its own long, hard-to-guess password.

Nobody can remember dozens of those, which is why a reputable password manager is worth using. It creates and stores the passwords for you, so staff only need to remember one strong passphrase.

2. Turn on multi-factor authentication

Multi-factor authentication asks for something more than a password, such as a code from an app on your phone. Even if a password is stolen, the attacker still cannot get in. Switch it on for email, banking, cloud storage, your website admin area and anything else that offers it. Email accounts matter most, because they can be used to reset the passwords of everything else.

3. Keep everything up to date

Software updates often fix security flaws that have already become public. Delaying them leaves a known door open. Turn on automatic updates wherever you can, for computers, phones, routers and the plugins and themes on your website. Retire anything that is no longer supported, because it will not receive fixes.

4. Back up your data, and test the backups

Backups are your safety net against ransomware, hardware failure, mistakes and theft. Keep copies of important data somewhere separate from your main systems, so that one problem cannot affect both. Just as importantly, try restoring from them from time to time. A backup you have never tested is a hope rather than a plan.

5. Give people only the access they need

Not everyone needs to be an administrator. Give each person access to what their job requires, and no more, so that a single compromised account does less damage. When someone leaves, remove their access promptly, including shared accounts and any passwords they knew.

6. Help your team spot phishing

Many attacks begin with a convincing message rather than clever technology. Staff should know the warning signs, and feel comfortable checking before they act.

• Unexpected requests to pay an invoice or change bank details.
• Messages that create urgency or fear.
• Links or attachments you were not expecting, even from someone you know.
• Sender addresses that look almost right but are slightly different.

When in doubt, contact the sender using a phone number or address you already trust, not the one in the message. Make it normal for people to report suspicious messages without fear of blame.

7. Protect your devices and your network

Laptops and phones get lost and stolen, so turn on screen locks and device encryption. Use reputable security software where it is appropriate, and change the default passwords on routers and other equipment. If you have guests or customers who use your wifi, give them a separate network from the one your business systems use.

And have a simple plan for when things go wrong

Even with good habits, something may eventually go wrong. Write down, in a page or less, who to call, what to switch off, and who needs to be told. Knowing the first three steps in advance makes a stressful day much easier to handle. If personal data is involved, you may also have legal duties to report a breach, so it helps to know where to look for guidance.

You do not have to do everything at once. Pick the habit that would make the biggest difference to your business, put it in place, and then move on to the next. If you would like help reviewing where you stand, we offer security reviews and practical advice, explained in plain language.