Why small businesses are affected
It is easy to assume attackers only go after large companies. In practice, small firms are often reached by the same widespread, automated attacks as everyone else, such as phishing emails and scans for outdated software. Attackers do not always choose a target by size. They may simply try many and see what works.
Small businesses also tend to have fewer safeguards. There may be no dedicated IT person, staff may use personal devices, and one owner may hold every password. At the same time, the business may hold information that matters to others: customer names, contact details, orders, invoices and sometimes payment information.
The effects of an incident can include lost time, lost records, unhappy customers, unexpected costs and, depending on where you operate, legal or reporting duties. It is hard to predict how serious any single incident would be, which is why basic preparation is worth the effort. The advice here is general good practice, not a guarantee, and not a replacement for a qualified professional or certified services when your situation requires one.
Know what you have
Start by listing what the business holds and where.
- What customer data do you collect, and do you really need all of it?
- Where is it stored: a spreadsheet, an accounting program, an online store, email, a phone?
- Who can see it?
- Which accounts, such as email, banking, domain, website and social media, would hurt most if someone took them over?
Collecting less data means less to protect and less to lose in a breach. Deleting information you no longer need is a legitimate security measure. Understanding what data breaches typically involve helps clarify which of your records would matter most.
Protect accounts
Account takeover is a common route into a business.
- Give every person their own login rather than sharing one.
- Use long, unique passwords, and consider a password manager so staff are not tempted to reuse them.
- Turn on two-factor authentication for email, banking, accounting, website hosting and any admin dashboard. Email deserves priority because it can reset almost everything else.
- Limit admin rights. Most people do not need to be able to change settings or see every record.
- When someone leaves, remove their access promptly, including shared accounts and any devices they held.
Keep software current
Many successful attacks use flaws that already have fixes available. Turn on automatic software updates for operating systems, browsers, plugins, website platforms and point-of-sale or office equipment where you can. Replace products that no longer receive updates from their maker. A list of the devices and programs you use, with their update status, makes this manageable.
Back up on purpose
Backups protect against theft, hardware failure, accidents and ransomware, which locks files until a payment is demanded. A backup you have never tested is a hope, not a plan.
- Follow a simple backup rule: keep more than one copy, on more than one kind of storage, with at least one copy somewhere else.
- Make sure at least one backup is not constantly connected to your main systems, since ransomware can spread to connected drives.
- Decide how often you need backups. Ask how much work you could stand to redo.
- Test a restore occasionally to confirm that the files really come back.
Whether to use cloud storage, local drives or both depends on the business, and each has trade-offs. For beginners, the general guide to a data backup is a good place to see the options. Cloud services also come with their own security settings that need attention; choices about cloud computing include checking who can access shared folders and using strong sign-in.
Train people
Staff are often the first line of defense and also the most common point of entry. A short, regular conversation is usually more effective than a long lecture once a year.
- Show examples of phishing messages and what to do with them. Make it normal to ask before clicking.
- Explain payment-change scams, where someone pretends to be a supplier or the boss and asks for a changed bank detail or an urgent transfer. A rule of confirming such requests by phone, using a number you already have, helps a lot. Synthetic voices and images, as discussed under deepfakes, make this confirmation step more important.
- Teach people to report mistakes quickly without blame. A fast report can limit the damage.
- Set simple rules for removable drives, personal devices and public wifi.
Secure devices and networks
- Use screen locks and device encryption on laptops and phones, so a lost device does not mean exposed data. Everyday encryption is built into many systems.
- Install reputable security protection where appropriate and keep it updated.
- Change the default password on your router and lock down its settings. Home network security steps apply to a small office too.
- Consider a separate guest network for visitors.
- If staff work from home, remote work technology and work device security guidance are relevant: keep business data on managed devices where possible.
- When retiring equipment, wiping old devices properly before sale, donation or recycling protects customer information.
Plan for a bad day
Write a one-page plan before you need it.
- Who do you call first? Keep contact details for your bank, hosting provider, key suppliers and any IT help.
- How would you work without your main system for a day or two?
- Who would tell customers, and what would they say?
- Do you have to notify anyone? Obligations vary by place and by the kind of data, so check with official sources or a qualified professional such as a lawyer or insurance adviser.
Avoiding common slips
Many business tech mistakes are repeats: shared passwords, ignored updates, untested backups and no plan for departing staff. None of them requires expensive tools to fix. Pick one or two items each month, finish them, and move on to the next. Steady progress is more realistic than trying for perfection, and even a modest set of habits can reduce risk meaningfully, though it cannot remove it.