Cyber security for small businesses is mostly about closing the easy doors. Criminals rarely pick a particular company. Much of what hits you is automated, with software testing thousands of businesses for the same few weaknesses. If yours is not one of them, the attacker usually moves on.
The UK’s National Cyber Security Centre (NCSC) publishes free guidance for small organisations, and it is well worth a read. Here is a practical order of work that fits a busy team.
Know what you are protecting
You cannot protect what you have not listed. Spend an hour writing down your laptops, phones, servers, cloud services, shared mailboxes and who has access to each. Note where customer data lives and which systems would stop the business if they went offline.
This short list guides every later decision, and it helps to spot forgotten accounts, such as a former employee’s login that was never closed.
Make account takeover hard
Stolen passwords are one of the commonest ways in. Two things make a big difference:
- Turn on multi-factor authentication (MFA). This asks for a second proof, such as a code on a phone, when someone signs in. Start with email, Microsoft 365 and banking.
- Use a password manager. It lets staff have a long, unique password for every service without remembering them all.
NCSC advice favours longer passwords made of three random words over short, complicated ones that people reuse.
Tackle phishing at the inbox
Phishing means fake emails or texts designed to trick someone into clicking, paying or handing over a login. It works because it targets people, not machines.
Good email security filters out much of the junk before it arrives. Pair it with regular cyber security training so staff know the warning signs: unexpected urgency, changed bank details, odd sender addresses and requests to bypass normal procedures. Tell people clearly that it is fine to stop and ask, and nobody will be blamed for reporting a suspicious message.
Keep devices patched and watched
Software updates often fix security holes that criminals already know about. Switch on automatic updates for operating systems and apps, and replace equipment that no longer receives them.
Modern security tools go beyond old-style antivirus. Endpoint detection and response watches laptops and servers for suspicious behaviour and can isolate a problem device quickly. A regular vulnerability scan can then show weak spots in your systems before someone else finds them.
Back up and practise restoring
Ransomware is malicious software that locks your files and demands payment. The best protection is a recent backup that criminals cannot reach. Keep at least one copy separate from your main network, and test that you can restore it. A backup you have never tried to restore is only a hope.
Our backup and restore service is built around exactly this: copies that are monitored, kept safe and tested.
Decide your plan before trouble starts
When something goes wrong, people panic. A one-page plan avoids that. It should say:
- Who to call first, and their out-of-hours number.
- How to disconnect a suspected device from the network.
- Who contacts customers, your insurer and, where personal data is involved, the ICO.
- Where to find your backups and key passwords.
Print it, because you may not be able to open files on the day.
Show customers you take it seriously, and ask for help
Many larger customers now ask suppliers how they handle security. The government-backed Cyber Essentials scheme sets out a clear list of basic controls, and certification gives you something concrete to show when a tender or questionnaire arrives.
If you would like a straightforward review of where your business stands, our Pulborough-based team can help you decide what matters first and what can wait. You do not have to do everything at once, because steady progress beats a rushed overhaul. Contact us for a friendly, jargon-free conversation.