Most cyber attacks on small businesses are not clever. They succeed because a password was reused, an update was skipped, or nobody noticed that a former employee still had access. The good news is that the fixes are just as ordinary. If you only do five things this month, do these.
1. Turn on multi-factor authentication everywhere it is offered
Multi-factor authentication (MFA) means that signing in needs something you have — usually a code or a prompt on your phone — as well as your password. If a password is stolen, the attacker still cannot get in.
Start with the accounts that would hurt most if someone else controlled them:
- email, especially Microsoft 365 or Google Workspace;
- online banking and payment platforms;
- your website, domain name and hosting accounts;
- accounting software and anything holding customer data.
Use an authenticator app rather than text messages where you can. It is quicker for staff and harder to intercept.
2. Give everyone a password manager
People reuse passwords because remembering dozens of different ones is impossible. A password manager remembers them instead, creates long random passwords for every account, and fills them in automatically. It also makes shared logins — the supplier portal everyone uses, for example — something you can control and revoke rather than a password written on a sticky note.
Pick one business password manager for the whole team, so that when someone leaves you can remove their access in one place.
3. Keep every device up to date
Updates fix security holes that attackers already know how to use. The longer a laptop goes without them, the easier it is to break into.
- Turn on automatic updates for Windows, macOS, phones and tablets.
- Do not forget routers, printers and CCTV recorders — they need updates too.
- Replace anything that no longer receives security updates. Windows 10, for example, no longer gets free security updates; computers that cannot run Windows 11 should be planned out.
4. Back up, and prove the backup works
A backup is the difference between ransomware being a bad week and the end of the business. But we regularly meet businesses whose backups had silently stopped months earlier.
A sound approach is three copies of important data, on two different types of storage, with one copy kept away from your main systems so an attack on the office cannot reach it. Then, every few months, actually restore a few files to check you can get them back. A backup you have never tested is a hope, not a plan.
5. Know who has access to what
Write down which people can get into which systems, and review it whenever someone joins, changes role or leaves. Two quick wins:
- Remove leavers on their last day — email, shared drives, software subscriptions, building access and any shared passwords they knew.
- Do not work day-to-day as an administrator. Give admin rights only to the accounts that need them, and use a separate account for admin tasks.
Where to go next
These five steps line up closely with the UK government’s Cyber Essentials scheme, which also covers firewalls, secure configuration and malware protection. If you work with larger organisations or the public sector, they may ask whether you hold the certificate. The National Cyber Security Centre’s small organisations guide is also well worth half an hour.
If you would like a second pair of eyes, we offer a free 15-minute security review. We will tell you which of these steps you already have covered and which one to fix first.