Cybersecurity for SMEs: 8 basic measures you can start on today

Small businesses often assume they are not a target for attackers, but in reality poorly protected systems are the easiest targets, whether for ransomware that encrypts files to demand a ransom or for emails that pose as a business partner to trick staff into transferring money. The good news is that just a few basic measures cut the risk considerably.

1. Turn on multi-factor authentication (MFA)

Turn it on for email, the accounting system, online banking and every cloud service that supports it. Even if a password leaks, attackers will still find it hard to get in.

2. Use unique passwords and a password manager

Passwords reused across several systems are a major weakness: when one system leaks, the others are put at risk too. A password manager for business makes it possible to use long, unique passwords without having to remember them.

3. Keep systems and devices up to date

Install security patches for operating systems, software and network devices such as routers and firewalls. Plan to replace devices that have reached the end of the manufacturer's support.

4. Back up your data and test restores

Back up important data following the 3-2-1 rule, and keep at least one copy where ransomware cannot reach it. Above all, test real restores regularly, because a backup that cannot be restored is as good as no backup at all.

5. Grant only the access people need

Staff should have access only to the systems and data they need for their work. Administrator accounts should be used only when necessary, and when an employee leaves, their accounts must be closed and any shared passwords changed straight away.

6. Firewalls and network segmentation

Configure the firewall to allow only the services you need, and keep guest Wi-Fi separate from the network used for work, so that outside devices cannot reach the business's computers and files.

7. Guard against email scams

• Set up SPF, DKIM and DMARC for your email domain to reduce spoofed emails sent in the company's name
• Train staff to spot suspicious links and attachments
• Make it a rule that any change to a business partner's bank account details is always confirmed by phone on a number you already know, never the number given in the email

8. Have an incident response plan

Decide in advance who does what when an incident occurs, who to contact and how to isolate infected machines from the network, and keep the logs of key systems for investigation.

The link to personal data protection law

If a security breach leaks personal data and poses a risk to the rights of data subjects, the business must notify the Office of the Personal Data Protection Committee within 72 hours of becoming aware of it. The basic measures above therefore help both to prevent incidents and to show that the business takes proper care of data.

Frequently asked questions

Does a small business need its own IT team?

No. Many businesses use consultants or outside service providers to look after their systems, but there should be someone in-house who knows what the key systems are and can reach the providers immediately.

Is antivirus software on its own enough?

No. Antivirus software is only one layer. Most attacks start with leaked passwords or with tricking users, so it has to be combined with MFA, updates and training.

How often should we assess our risks?

At least once a year, and whenever there is a significant change, such as moving systems to the cloud, opening a new branch or letting staff work from outside the office.

Let us assess the security of your systems

Kerwin & Vance assesses risks, sets up firewalls, manages access rights to data and protects against cyber attacks to recognised standards. Find out more about our Technology services, or book a consultation with us.