Five security basics for a small business
No security team needed. Five things, in the order I’d do them.
Most attacks on small companies aren’t targeted. They’re automated: leaked passwords tried everywhere, old software scanned for known holes. The basics stop most of it. In order:
- Accounts. MFA on email first, then cloud storage, accounting and every admin panel. A password manager for everyone. Remove leavers the day they leave.
- Updates. Automatic updates on. Anything facing the internet (website, VPN, firewall, remote access) gets patched within days. Replace what no longer gets updates.
- Access. Daily work in normal accounts, not admin. Folders shared with people, not “anyone with the link”.
- Devices. Built-in firewall and antivirus on and current. Disk encryption on laptops. Default passwords changed on routers and cameras. No remote desktop open to the internet.
- Backups. One copy ransomware can’t delete, and a restore you’ve actually tested.
The UK’s Cyber Essentials uses almost the same list, if you want a checklist to follow.
Last thing: make it safe to say “I clicked something weird”. Five minutes later it’s a small problem. Two weeks later it isn’t.