Cyber security basics for very small businesses

What actually happens to small businesses

Small businesses are not usually targeted by name. They are caught by automated attacks that scan for whatever is reachable and weak, and by fraud that works equally well on a company of five or five thousand. That means the defences worth having are unglamorous and mostly free.

Three things cause the large majority of real losses:

• Invoice fraud. Someone gets into an email account — often a supplier's rather than yours — reads the conversation, and sends a genuine-looking message changing the bank details on an invoice. No malware, no suspicious link, nothing for a filter to catch.
• Account takeover. A reused or phished password gets someone into a mailbox, a cloud drive, or an accounting system.
• Ransomware. Files encrypted, business stopped, payment demanded. Usually arriving through a phished login or an unpatched remote access service.

Notice that none of these is a sophisticated technical attack. They are all, at root, someone getting a password or someone believing an email.

Do these five things first

1. Two-factor authentication on every business account

Email first, then accounting, banking, cloud storage, and your domain registrar. This is free, takes an afternoon across a small team, and prevents the single most common cause of loss. If you do nothing else on this page, do this.

Use an authenticator app or passkeys rather than text messages where the option exists. Keep the backup codes somewhere the business can reach if a staff member loses a phone or leaves.

2. A payment verification rule, written down

Any change to bank details on any invoice must be confirmed by phoning a number you already had on file — never a number in the email, and never by replying to it. Any payment over a threshold you set needs a second person to approve.

This single rule prevents most invoice fraud. It costs nothing, and it works precisely because it does not depend on anyone spotting a convincing fake. Write it down, tell every person who can make a payment, and make clear that following it is never something they will be criticised for, even when it turns out to be a real supplier.

3. Backups that are actually tested

Keep three copies of anything you cannot lose, on two different kinds of storage, with one of them offline or in a form that cannot be altered. Ransomware specifically seeks out connected backups, so a drive permanently plugged into the same machine is not a backup.

Then test a restore. A backup nobody has ever restored from is a hope, not a plan. Do it once now and once a year afterwards, and note how long it actually takes — that number is your real recovery time.

4. Updates on automatic

Operating systems, browsers, phones, and anything exposed to the internet — routers, firewalls, remote access, and any website software you run. Most successful intrusions use flaws that were fixed months earlier. Turn on automatic updates and stop thinking about it.

5. A password manager for the team

Business plans are inexpensive and solve several problems at once: no shared passwords in spreadsheets or chat, unique credentials everywhere, and — importantly — the ability to revoke access instantly when someone leaves. That last point alone justifies it.

Then these

• Separate administrator accounts from daily-use accounts. Nobody should browse the web and read email while logged in as an administrator.
• Remove access promptly when people leave. Keep a short list of every system a staff member can reach, so offboarding is a checklist rather than a memory exercise.
• Limit who can move money, and keep that list as short as the business allows.
• Turn on login alerts for email and financial systems.
• Check your email domain's anti-spoofing records — the standards that stop others sending mail that appears to come from your domain. Your web or email provider can usually do this quickly, and it protects your customers as much as you.
• Encrypt laptops and phones with full-disk encryption, which is built in and free on current systems. A lost laptop then becomes an inconvenience rather than a data breach.
• Know your obligations. Most countries require notification if personal data is exposed. Find out what applies to you before you need to know.

Training that works

Annual compliance slideshows achieve very little. What works is short, specific and repeated. Fifteen minutes every couple of months on one real thing — a phishing email that actually reached your team, a supplier fraud attempt, a new scam in your industry — sticks far better than an hour once a year.

The most important cultural point is this: staff must never be punished for reporting a mistake. The expensive scenario is not someone clicking a link. It is someone clicking a link and saying nothing for three days because they are afraid. Make reporting fast, blameless, and visibly appreciated.

Have a plan before you need one

Write one page and keep a printed copy, because the digital one may be encrypted when you need it. It should answer:

1. Who is called first, with mobile numbers.
2. Which systems must come back first for the business to function.
3. Who talks to customers, and roughly what they say.
4. Your bank's fraud line, your insurer, and your IT support.
5. Where the backups are and who knows how to restore them.
6. Who reports to the regulator or the national cyber agency, and by when.

Half an hour producing this page is worth more than any product you could buy, because the failure mode in a real incident is confusion rather than a lack of tools.

A realistic order of work

Week one: two-factor authentication everywhere, and the written payment verification rule. Week two: backups configured and a restore tested. Week three: updates set to automatic, password manager rolled out. Week four: the one-page incident plan, and the offboarding checklist.

That is a month of modest effort with no meaningful spend, and it removes most of the realistic risk to a business of this size. Anything beyond it is refinement.