Cybersecurity for Small Business: A Baseline That Actually Works
A small company rarely loses money to a sophisticated targeted attack. It loses money to an email asking for an urgent payment to new bank details, to a password that was also used on three other sites, and because the bookkeeper opened an attachment from “the tax office”.
The good news: a baseline defence against all of that requires neither budget nor an IT department. It requires a handful of decisions made once.
How money is actually lost
| Scenario | What it looks like | What closes it |
|---|---|---|
| Swapped bank details | An email saying “we changed banks” from a supplier | A double-confirmation rule |
| Mailbox compromise | Someone reads your threads and joins them | Two-factor authentication |
| Reused password | A breach elsewhere opens your email | A password manager |
| Ransomware | Files encrypted, payment demanded | Backups kept off the network |
| Lost laptop | Access to every system in someone else’s hands | Disk encryption, remote wipe |
| Departed employee | Their access is still active | An offboarding procedure |
The first row is the most expensive and the simplest technically. The attack requires no hacking at all: getting into a thread or spoofing a sender address is enough.
Five measures that close most of it
1. Two-factor authentication everywhere possible
Email, banking, hosting, domain registrar, CRM, social accounts. This is the single most effective measure: even a leaked password will not get anyone in without the second factor. Email is the priority, because it is how access to everything else gets recovered.
2. A password manager
Not for elegance, but so passwords stop repeating. One breach on an unrelated forum should not open your accounting system. It also ends the practice of sending passwords over chat.
3. Backups following the rule of three
Three copies of the data, on two different media, one of them off-site and off the network. A backup reachable from the same machine gets destroyed by ransomware along with the original.
4. Updates
Operating systems, browsers, phones. Most mass attacks exploit vulnerabilities whose patches were released months earlier.
5. Separated access
Not everyone needs administrator rights. A bookkeeper should not have hosting access, and a developer should not have banking access. This is not about distrust; it is so that one compromised account does not open everything at once.
Email is the main vector
Most incidents run through email, so it deserves separate attention.
Technically, configure the records that confirm mail sent from your domain really comes from you. Without them anyone can send your clients a message with your address in the sender field, and mail services will let it through.
Organisationally you need one rule that prevents the most expensive scenario: any change of payment details is confirmed by voice using the number from the contract. Not the number in the email announcing the change. The rule should be written down and apply to everyone, the owner included.
What to do about staff
Training with a forty-slide deck does not work. What works is different:
- A short rule instead of a manual. “Bank details change only after a phone call” is memorable; a twelve-page policy is not.
- Permission to ask. People must be able to write “this looks like phishing to me” without fear of looking foolish if they were wrong.
- Permission to report a mistake. The worst scenario is an employee who clicked a link and says nothing for two days out of fear. Fast reporting often makes it possible to stop everything.
- An offboarding procedure. A list of systems to remove access from, written once and then simply followed.
An incident plan
It should fit on one page and live somewhere findable without a computer:
- Who to call first. A name and a phone number, not “contact IT”.
- What to disconnect: network access, specific accounts.
- Where the backups are and who can reach them.
- Bank contacts for blocking transactions.
- Who speaks to clients if their data was exposed.
- Who must be notified by law and within what deadline, clarified with a lawyer in advance rather than during the incident.
A one-weekend checklist
- Enable two-factor authentication on email, banking, hosting and the domain.
- Check whose name the domain is registered in.
- Install a password manager and replace reused passwords.
- Review the user list in every system and remove the leftovers.
- Verify a backup exists and can actually be restored.
- Introduce the written rule about confirming payment details.
- Write the one-page incident plan.
This is not complete protection and does not replace specialists where the risks are high. But this set covers the scenarios through which small companies genuinely lose money. Sophisticated attacks are rare; an email asking for urgent payment to new details arrives for everyone sooner or later.
