Cybersecurity Basics for Small Businesses

Cybersecurity basics for a small business come down to five habits: strong unique passwords with two-factor login, staff who can spot a phishing email, backups you have tested, software that is kept up to date, and a one-page plan for what to do when something goes wrong. None of these needs a big budget. This guide covers each one, then explains the point at which it makes sense to get expert advice online from a security consultant instead of handling it yourself.

Why small businesses are targets

Attackers do not pick targets by size. They pick by ease, and a business that skips the cybersecurity basics is easy. A small firm with one shared email password, no backups and an accounting login reused from a personal account is far easier to break into than a large company with a security team. Most attacks on small businesses are automated: a bot tries leaked passwords on thousands of accounts, or a phishing email goes to every address it can find. You are not being singled out. You are being included.

The cost is also higher than most owners expect. A locked-out system means days without invoicing. A compromised email account can be used to send fake payment instructions to your customers, and that damages trust long after the account is recovered.

Passwords and two-factor login

Start here, because this one change stops most account takeovers.

1. Turn on two-factor authentication for email, banking, payroll, cloud storage and any admin account. An authenticator app is better than a text message, and a hardware key is better still for the owner's accounts.
2. Use a password manager for the whole team. It generates a different long password for every site and removes the excuse for reuse.
3. Stop sharing logins. If three people share one "office@" email password, you cannot tell who did what and you cannot remove one person's access when they leave.
4. Make a leaver checklist. When someone leaves, change shared passwords and remove their access the same day.

Take a worked example. A four-person design studio reused one password across email, their file storage and their invoicing tool. One of those services leaked its password database. Within a week, someone logged into the email account, read the invoicing threads, and sent a client a "we have updated our bank details" message. Two-factor login on the email account alone would have stopped it.

Phishing

Phishing is the email, text or call that tricks someone into clicking a link, opening an attachment or sending money. It is the most common way in, and training beats technology here.

Teach the team to pause on anything that:

• Creates urgency: "your account will be suspended today."
• Asks for a password, a gift card or a change to payment details.
• Comes from a known contact but reads slightly wrong.
• Has a link whose real address does not match the text.

Set one rule that is easy to remember: any request to send money or change payment details is confirmed by phone, using a number you already have, not one in the email. That single rule has saved many businesses from wire fraud. The Federal Trade Commission publishes plain-language guidance on recognizing scams at ftc.gov.

Backups and updates

Backups are what make a ransomware attack an inconvenience instead of a disaster. The rule of thumb is three copies of your data, on two different kinds of storage, with one copy somewhere the attacker cannot reach, such as an offline drive or a cloud backup with its own separate login.

A backup you have not restored from is a hope, not a backup. Once a quarter, pick a file and actually restore it. Note how long it took.

Updates close the holes attackers use. Turn on automatic updates for operating systems, browsers and phones. For the software your business depends on, such as your point-of-sale or booking system, check monthly that it is on a supported version. Old routers and printers count too.

A simple incident plan

You do not need a 40-page document. You need one page, printed, that answers:

• Who do we call first? (An IT contact, your bank's fraud line, your insurer.)
• What do we disconnect? (Unplug the affected computer from the network; do not turn it off.)
• Where are the backups and who has the login?
• What do we tell customers, and who decides?
• Which accounts do we change passwords on immediately?

Walk through it once with the team. Twenty minutes now saves panic later. Some states require you to notify customers if their personal data is exposed, so note that a lawyer may need to be on the list.

When to call a security consultant

The cybersecurity basics above are within reach of any owner. A security consultant earns their fee when:

• You handle card payments, health information or other regulated data and need to know which rules apply to you.
• You have already had an incident and want to know how it happened and what else is exposed.
• You are choosing between security tools and vendors and want an independent view.
• A large customer has sent you a security questionnaire and you do not know how to answer it.
• You want someone to review your setup once a year and tell you the three things to fix next.

A single session is enough for a review of your current setup or a second opinion on an incident. Prepare a list of the systems you use, who has access to what, and the questions you want answered. Our guide to tech consultant online covers how to describe a technical problem clearly, and avoid online consultation scams explains why you should never hand over passwords to anyone, including a consultant. Share screenshots and settings instead.

Cybersecurity basics are not about buying tools. They are about a few habits practiced by everyone on the team, and knowing when a problem is bigger than those habits can handle. Read our questions to ask before booking a consultant, then book a session on ConsultChat with a security consultant for a review that fits the size of your business.