Introduction

Outsmart hackers and cybercriminals! That’s our mission. We’re ready to guide you with straightforward advice; you don’t need to be a tech expert! Together, we’ll strengthen your digital defenses!

How to Keep Your Small Business Safe from Cyber Threats

Are you a small business owner worried about cyber attacks? You’re not alone. In a previous post, we discussed cybersecurity tips for medium and large businesses provided by the UK’s National Cyber Security Centre (NCSC). While many of those tips apply to small businesses, they face unique challenges and have different requirements compared to larger organizations. Luckily, the NCSC has also released guidelines specifically tailored for small businesses looking to improve their cybersecurity.

The 5-Step Plan for Small Business Cybersecurity

The NCSC has organized its small business cybersecurity guidelines into 5 easy-to-follow steps, with 5 practical tips for each step. While these guidelines are aimed at UK-based businesses, they can be implemented by small companies anywhere in the world. Let’s dive into each step and see how these tips boost your small business cybersecurity.

Step 1: Back Up Your Data Regularly

Backing up your business-critical data is crucial. Could your business still function without losing access to customer details, orders, and payment info? Regular backups ensure you can recover from incidents like flooding, fire, equipment damage, or theft. It also protects against ransomware attacks. Here are 5 tips for effective data backups:

1. Identify what data is essential to back up. Figure out what data is critical for your business to function, like customer info, orders, and financial records. Make a list of the files and folders that contain this essential data so you know exactly what needs to be backed up regularly.
2. Keep backups separate and restrict access. Store backup copies of your data separately from your main computer or network, so if your main system is compromised, your backups aren’t affected, either. Restrict access to your backups only to those who absolutely need it, preventing accidental (or intentional) deletion or alteration.
3. Consider using cloud storage for off-site backups. Cloud storage services let you automatically back up your data to secure servers in another location over the Internet. Popular services like Google Drive, Dropbox, or Microsoft OneDrive make this easy—just install their app, select what data to back up, and let it run automatically.
4. Read the NCSC’s cloud security guidance. The UK’s National Cyber Security Centre provides helpful advice on securely choosing and configuring cloud services. Check out their “Cloud Security Guidance” publication for practical tips on keeping your cloud-based backups safe and recoverable.
5. Automate backups to save time and stay current. Don’t rely on remembering to do manual backups – automate the process so your backup is always up to date. Most backup software or cloud services let you schedule automatic backups daily or weekly. So, set it and forget it for peace of mind.

Step 2: Prevent Malware Infections

Viruses and other malware can wreak havoc on your business. WannaCry is a famous example. But there are some simple, free steps you can take to reduce the risk of infection:

1. Install and enable antivirus software on all devices. Antivirus software helps detect and block malware that could harm your devices or data. Install reputable antivirus software on all your computers and mobile devices, and keep it on and updated regularly.
2. Prevent staff from installing dodgy apps. Malicious apps can install malware or steal data, so it’s essential to prevent staff from installing unknown or untrusted apps on work devices. Set up policies and permissions to block app installations by default, only allowing approved apps from trusted sources.
3. Keep all IT equipment and software updated. Software updates often include critical security fixes and improvements that protect against the latest threats. Set your operating systems, software, and devices to auto-update wherever possible, and regularly check that everything is running the latest versions.
4. Control the use of USB drives and memory cards. If infected, USB drives and memory cards can easily spread malware, so it’s best to control their use in your business. Consider blocking access to USB ports by default or only allowing approved USB drives that are scanned for malware before use.
5. Enable operating system firewalls. Firewalls help prevent unauthorized network access to your devices, blocking many attacks. Please ensure the built-in firewall is enabled on all your business computers and laptops and configure it to block unnecessary incoming connections.

Step 3: Keep Mobile Devices Safe

Tablets and smartphones are now essential business tools, but their portability makes them vulnerable to loss or theft. Here are 5 quick tips to keep those devices (and the data on them) secure:

1. Enforce PIN/password/fingerprint protection. All your business smartphones and tablets require a PIN, password, or fingerprint scan to unlock. This simple step prevents unauthorized access to the device and data if it is lost or stolen. Anyone who gets the device can get in without a PIN or biometric.
2. Enable tools to track, lock, or wipe lost devices. Ensure you can remotely track, lock, or erase data on your mobile devices if they go missing. Most devices have free, built-in tools for this (like Find My for iPhone/iPad or Find My Device on Android) – make sure they’re set up before you need them.
3. Keep the device operating systems updated. Mobile operating systems like iOS and Android release regular updates to fix security holes and add new protections. Keep your devices set to auto-update so you don’t have to worry about it, and replace devices that are too old to get updates anymore.
4. Ensure apps are regularly updated, too. Apps can have security flaws or introduce new vulnerabilities, so it’s just as essential to keep them updated as your operating system. In the app store settings, set apps to auto-update over Wi-Fi, so they always have the latest security fixes and features.
5. Avoid connecting to unknown Wi-Fi hotspots. While public Wi-Fi hotspots at cafes, airports, and hotels are convenient, they’re risky—attackers can intercept data or trick you into connecting to a malicious lookalike network. Stick to mobile data when you’re out and about, or use a trusted VPN app to encrypt your connection.

Step 4: Use Strong Passwords

Your devices contain critical business data, customer info, and account access. Strong passwords, used correctly, are a free and effective way to prevent unauthorized access. Here are 5 password tips to keep in mind:

1. Enable password/PIN protection on all devices. Password-protect all your business devices, including computers, smartphones, tablets, and laptops. Set a strong PIN or password that locks the device after a short period of inactivity, and make sure all staff do the same.
2. Use 2-step verification for essential accounts. Turning on 2-step verification (2SV) adds an extra layer of security to your most important accounts, like email and banking. With 2SV enabled, you’ll need to enter a code from an app or text message in addition to your password, making it much harder for hackers to break in.
3. Avoid predictable or common passwords. Passwords that are easy to guess, like “123456” or “password,” are also the easiest for attackers to crack. Instead, use long, unique passwords or passphrases for each account, and avoid including personal info like birthdays or names.
4. Help staff manage passwords without reusing them. Remembering dozens of unique passwords is almost impossible, so provide staff with a secure way to store and manage their passwords. Consider using a reputable password manager tool that securely generates and stores strong passwords so staff don’t have to reuse or write passwords down.
5. Change all default passwords on new equipment. Many new devices, from routers to smart TVs, come with a default password like “admin” or “password” that attackers can guess easily. Whenever you set up a new device, immediately change this default password to a strong, unique one.

For even more help with passwords, the NCSC has provided a helpful infographic, which you can download here.

Step 5: Avoid Phishing Attacks

Phishing emails are getting more sophisticated, tricking people into sending sensitive info, clicking malware links, or transferring money. Your small business will be targeted at some point. These tips can help you identify and prevent common phishing attacks:

1. Set up accounts with the fewest privileges to limit damage. When setting up user accounts, give staff the bare minimum permissions they need to do their jobs. If their account is compromised, the attacker can’t access or damage as much.
2. Verify any unusual requests through other channels. If you receive an unexpected email asking for sensitive info or urgent action, double-check if it’s legit through another method. Call the supposed sender or talk to them to ensure the request is real before acting on it.
3. Check for common signs of phishing in emails. Phishing emails often have telltale signs like lousy grammar, generic greetings, urgent demands, or mismatched links. Hover over links (without clicking) to see if the URL matches what’s written, and beware of attachments or requests for personal info.
4. Encourage staff to report attacks and ask for help. Create a culture where staff feel comfortable reporting potential phishing attacks or asking for help if unsure about an email. Make it clear that it’s better to report a suspected attack than to ignore it and risk a breach.
5. Check what company information is exposed online. Attackers can use publicly available information about your company and staff to make phishing emails more convincing. Search your company name and check your website and social media profiles to see what information is out there, and consider removing anything that’s not essential to minimize the risk.

The NCSC has also provided a helpful infographic against phishing attacks, which you can download here.

Don’t Let Cybersecurity Threats Sink Your Small Business

By following these straightforward steps from the NCSC, you can significantly improve your small business cybersecurity and protect against digital threats. Many of these measures can be implemented at little or even no cost. While no security is perfect, this layered approach makes it much harder for cybercriminals to harm your business, minimizing risks to your reputation, data, and bottom line. Stay ahead of cyber threats – they might not be targeting you today, but you’ll always be prepared with us.

If you found this post helpful or interesting, remember to LIKE and share immediately. While at it, go ahead at the end of this post, type in your email, and hit SUBSCRIBE now!

What cybersecurity challenges have you faced in your small business? Which tips would make the most significant difference for your company’s digital safety?

Start the conversation in the comments below – we’d love to hear your thoughts and experiences!