Cybersecurity Basics for a Small Business

Say cybersecurity and Hollywood scenes come to mind: dark rooms, green code. The reality is boring: most businesses get hit not by a sophisticated attack but by simple neglect: the old password, the un-updated system, the careless click, the data without a copy. And that is the good news too: the defence's large share is not expensive technology but cheap discipline; a business without an IT department can build it as well.

This article is that discipline's map: the 10-point hygiene, the backup rule, the team layer and the incident plan.

The base hygiene: 10 points

• 1. The password manager + unique passwords: let one password's leak stay limited to one account.
• 2. 2FA on every critical account: the email, the bank, the social, the cloud; no debate.
• 3. The updates: the system-browser-app updates on; a patch put off to "later" is an open door.
• 4. The admin account split: the daily work on an ordinary-rights account; the admin only when needed.
• 5. The leaver procedure: the departing employee's every access gets closed the same day; the forgotten access is the classic leak road.
• 6. The Wi-Fi rule: the office network on a strong password, the guest network separate; the work devices on open Wi-Fi with a VPN.
• 7. The device encryption + the screen lock: let a lost laptop not become a data tragedy.
• 8. The email attention: the phishing habits in everyone; the technical filters on top.
• 9. The licensed software: installing "a cracked version" is a malware invitation; a free alternative always exists.
• 10. The least-access principle: everyone reaches only what their work needs; the "everyone into everything" comfort is the recipe for a leak's scale.

The backup: the most important insurance

The backup's real rival is ransomware (the attack encrypting the files and demanding money): for a business with a copy that is a bad day; for one without, an existential threat. And paying the ransom is both guarantee-less and keeps you on the target list; the defence lies not in the payment but in the copy.

The team layer: the weakest-link matter

Once the technology is built, the real border is human: most attacks enter through the employee door. What to build: the short starter training (this article's 10 points + the phishing recognition: a one-hour session), the written simple rules (the one-page "our security rules"; among the knowledge base's first documents), the suspicion procedure (whom to write in the "I saw a strange message" case: the reply fast and scold-free) and the payment protocols (the call-back rule, the two-person approval). The culture rule must be repeated: the employee reporting a mistake is a hero, the one hiding it a problem; that one sentence is the key to incidents being caught early.

The incident plan: the bad day's document

The attack probability never zeroes; the preparation determines the damage though. The one-page plan: the isolation step (the suspicious device leaves the network), the assessment (what was touched: the accounts? the data? the payments?), the password-and-access renewal (starting from the critical ones), the restore (from a clean copy; the backup rule pays for itself here), the notifications (the bank, the affected customers, where needed the authorities under the legal obligations) and the lesson session (which door was open, which rule gets added). This plan's phone numbers part (the bank, the technical support, the lawyer) must be printed and stand in a visible place: on the attack's day your password manager may be unreachable too.

Sources and further reading

Where to verify the source

The international guides for small business:

• CISA — Secure Our World: the simple security steps

Continuing the topic

The security line's neighbouring articles:

• The password and 2FA
• The phishing defence
• The cloud and the copy
• The data obligations
• Other articles on this topic

This week's three steps: turn 2FA on for the main accounts, set up the cloud backup, walk the 10-point list with the team. That three-evening work takes you out of the target list's "easy" section; most attacks pick from exactly there.