Guide
How do I keep my small business safe from hackers?
Most attacks on small businesses are automated. Nobody picked your shop. A program tries millions of doors a day and walks through the ones left unlocked: an old password, a laptop that skipped its updates, an invoice email someone paid without checking.
You don't need a security department to lock those doors. The steps below are the ones we walk clients through, in order of what each one buys you for the effort. Most of them are free.
How small businesses get broken into
Four routes cover nearly every case we see:
- A stolen or reused password. Someone's email password leaked from an unrelated site years ago, and it still works on the business account.
- An email that looks routine. A supplier's banking details have changed, or the boss needs gift cards before noon. Someone pays it.
- Software that missed its updates. A laptop, a router, or a website with a known hole that was fixed months ago, on a machine that never installed the fix.
- Access nobody took back. A former employee, or the contractor who set up the website, still has a working login.
None of these needs a skilled attacker. Each step below closes one or more of them.
Eight steps, most useful first
Turn on two-step sign-in, starting with email.
Every password reset for every other account lands in your inbox, so whoever controls your email can take the rest. Turn on two-step sign-in there first, then on your bank, accounting software, payroll, and the company that holds your domain name. Where you get a choice, use an authenticator app on your phone rather than text messages. It's free and it takes an afternoon.
Use a password manager for everyone.
One long, different password per account, stored in the manager so nobody has to remember them. Business plans cost a few dollars per person per month and let you share the logins the crew needs without a sticky note on the monitor or a password in a group chat.
Turn on automatic updates, and replace what can't update.
Most updates exist to close holes that have already been published. Once a fix is public, so is the description of the hole, and automated attacks start looking for machines that haven't installed it. Set phones, computers, browsers, and the office router to update on their own. If a computer has to stay old because it runs a machine on the shop floor, unplug it from the internet.
Back up your files, and test getting them back.
Keep at least one copy off-site, and one that a person on the office network can't change or delete. Ransomware encrypts every drive it can reach, including a backup drive left plugged in. Once a quarter, restore one real file from the backup to confirm it works.
Confirm every payment change by phone.
When an email asks you to pay a new account, call the person at a number you already had, not one from the email. Tell your own customers the same thing about your banking details. That one call stops payment-redirection fraud, which is among the most expensive scams a small contractor faces.
Give each person their own login, and remove it the day they leave.
A shared login can't be switched off for one person, and when something goes wrong you can't tell who did it. Keep a short list of which accounts each person has, so the leaving checklist is already written.
Keep a list of the software you run.
Every app, subscription, website, and add-on, who looks after it, and who has admin access. Modern software is built from hundreds of smaller pieces written by other people, and any of them can turn out to have a hole. You can't update something you forgot you have.
Write down who to call.
One printed page: your bank's fraud line, whoever handles your computers, your insurance broker, and how to reach your staff if email is down. Most of the damage in an incident happens in the first few hours, while people work out who to phone.
Software we'd start with
Established picks for a small office, grouped by the step they cover. Most are free or built into what you already own. Where we name two, either is a good choice; pick one and use it everywhere.
Two-step sign-in
Step 1
- Microsoft Authenticator or Google Authenticator. Free phone apps that show the six-digit code. Either works with nearly every service, including the ones not made by Microsoft or Google.
- YubiKey. A physical key on your keyring that you tap to sign in. A fake sign-in page can't trick it, which makes it the best choice for the owner's email and the bank. Buy two per person and keep the spare somewhere safe.
Password manager
Step 2
- 1Password. What we use. Easy for people who don't like computers, shared vaults so the crew gets the logins they need and nothing else, and one switch to cut off someone who leaves.
- Bitwarden. Costs less, has a free plan for one person, and its code is public for anyone to inspect. A little plainer to use than 1Password.
The password saving built into your browser beats reusing passwords, but it can't share a login with one person and take it back later.
Web browser
Step 3
- Firefox. Made by a non-profit with no advertising business to feed. Add uBlock Origin (free) and it blocks the scam ads and fake download buttons that ride in on ad networks.
- Brave. Built on the same engine as Chrome, so every site works, with ad and tracker blocking already on. Turn off the crypto wallet and rewards extras in settings; you don't need them.
Chrome, Edge, and Safari are safe choices too, provided they update. Whichever browser you pick, make it the same one on every office computer so there's one thing to keep current.
Email and files
Steps 1 and 6
- Google Workspace or Microsoft 365. Use a business plan on your own domain, not a free Gmail or Outlook address. A business plan lets you require two-step sign-in for everyone and shut off an account the day someone leaves.
- Fastmail. An independent, paid email service with no ads, if you'd rather keep your mail away from the two big companies. It covers email, calendars, and contacts, without the document and spreadsheet tools.
Backups
Step 4
- Backblaze. Backs up everything on a computer to the cloud for a flat yearly fee per computer. You install it once and it runs on its own.
- Time Machine (Mac) or File History (Windows). Free and built in, for the local copy on an external drive. Unplug the drive between backups so ransomware can't reach it.
Dropbox, Google Drive, and OneDrive sync files, which means a deleted or scrambled file is deleted or scrambled on every device. They keep old versions for a while, but count them as a convenience, with a real backup alongside.
Computers and the office network
Step 3, plus laptop encryption
- Microsoft Defender. The antivirus built into Windows. With updates on, it's enough for most small offices, so a paid antivirus suite is usually money you don't need to spend.
- BitLocker (Windows Pro) or FileVault (Mac). Free and built in. Turn it on for every laptop, so a laptop left in a truck can't have its files read without the password.
- Quad9. A free service from a Swiss non-profit that refuses to connect to known scam and malware sites. Set it once in the office router and every device in the building gets it.
Ask whoever looks after your software
If someone else built your website, hosts your app, or runs your computers, part of this list is their job. Ask them these questions and expect plain answers:
- Who applies security updates, and how soon after a fix is published?
- How do you find out that a piece of our software has a known problem?
- Where are the backups kept, and when did you last restore one?
- Who has admin access to our server and our code, and do they all use two-step sign-in?
- If we stop working together, how do we get our data and our code?
A vague answer to the first question is the one to worry about. Fixes for known problems come out every week, and someone has to apply them.
Where to go from here
Cyber insurance applications now ask about most of the items above, and some insurers won't quote a business without two-step sign-in and working backups. Working through the list first means you can answer yes to most of the application.
For a fuller checklist, the Canadian Centre for Cyber Security publishes baseline security controls for small and medium organizations. It's written for an office with some IT help, and it covers the same ground in more depth.