If you run a business, there’s a good chance that you rely on computers and the internet for almost everything you do, whether that’s communicating with customers, processing orders, managing finances or simply storing important documents. However, while most businesses recognise the importance of protecting their physical premises, I’m not convinced that the same level of attention is always given to protecting their computers and online systems. I’ve come across plenty of smaller companies that spend hundreds of pounds on security cameras and alarm systems, but don’t think twice about using the same password for every online account or storing their entire customer database on a laptop that hasn’t been backed up for months.
Unfortunately, cyber attacks aren’t something that only happens to enormous multinational companies. In fact, smaller businesses can be particularly attractive targets because they often lack the resources or technical expertise required to implement more sophisticated security measures. The good news is that improving your cyber security doesn’t necessarily involve spending thousands of pounds on specialist software, and there are several relatively straightforward things that almost any business can do to reduce its risk.
Make Sure Your Software Is Up to Date
Probably one of the simplest ways to improve your security is to make sure your computers, websites and other software are regularly updated. Software developers frequently release updates to fix security vulnerabilities, and once those vulnerabilities become publicly known, criminals can potentially exploit them to gain access to systems that haven’t been patched.
This is particularly important for websites running content management systems such as WordPress, where outdated plugins and themes can create opportunities for attackers. However, the same principle applies to Windows, Microsoft Office, web browsers and almost any other software your business uses. I’d recommend enabling automatic updates wherever practical, although it’s worth having a backup and testing particularly significant updates before applying them to business-critical systems.
It’s also important to stop using software that no longer receives security updates. For example, Microsoft ended support for Windows 7 in January 2020, meaning businesses still relying on it could be exposing themselves to vulnerabilities that are no longer being fixed through normal updates.
Stop Using the Same Password Everywhere
Despite years of warnings about password security, I’m still surprised by how frequently people reuse the same passwords across numerous websites and services. I can understand why they do it, particularly when almost every application requires an account, but it creates an obvious problem if one of those services suffers a data breach.
Imagine somebody obtains your email address and password from a compromised website. If you’ve used exactly the same details for your Microsoft 365 account, website administration area and online banking, you’ve potentially given them access to several completely unrelated systems.
Fortunately, password managers such as Bitwarden, LastPass and 1Password make it relatively straightforward to generate and store unique passwords without having to remember them all. I’d also strongly recommend enabling two-factor authentication wherever it’s available, particularly for email accounts, financial services and website administration systems. Requiring somebody to provide an additional verification code or approve a login through their phone makes it considerably more difficult for criminals to access an account using a stolen password alone.
Back Up Your Data Properly
One of the biggest threats to businesses in recent years has been ransomware, where malicious software encrypts files and demands payment in exchange for restoring access to them. These attacks can be devastating, particularly if important customer records, financial information or business documents suddenly become inaccessible.
Regular backups are one of the most effective ways to reduce the potential damage, although it’s important to understand that simply copying everything to an external hard drive occasionally isn’t necessarily sufficient.
Ideally, you should maintain automated backups that are stored separately from your main systems, including at least one copy that can’t be easily modified or deleted if your network is compromised. You should also periodically test whether those backups can actually be restored, because discovering that your backup system hasn’t been working properly for six months isn’t particularly useful after you’ve already lost everything.
Cloud services such as Microsoft OneDrive and Google Drive can help protect important files, but synchronisation isn’t necessarily the same thing as having a proper backup. If somebody accidentally deletes or encrypts files, those changes can sometimes be synchronised too.
Be Careful with Emails
Email remains one of the most common ways criminals attempt to compromise business systems, particularly through phishing messages designed to trick people into revealing passwords, downloading malicious attachments or transferring money to fraudulent accounts.
These messages are becoming increasingly convincing, and they don’t always contain the obvious spelling mistakes and suspicious formatting that people traditionally associate with scams. Some are specifically targeted at individual employees, using information about the business to make the message appear legitimate.
For example, somebody working in your accounts department might receive an email that appears to come from a regular supplier, explaining that their bank details have changed and requesting that future payments be sent to a different account. Rather than simply accepting the instructions, I’d recommend verifying changes like this through an established telephone number or another trusted communication channel.
Employee awareness is particularly important here, because even the most sophisticated security software can’t guarantee that somebody won’t be persuaded to hand over sensitive information.
Don’t Give Everybody Administrator Access
Another relatively straightforward improvement is making sure employees only have access to the systems and information they actually need.
For example, somebody responsible for updating blog posts probably doesn’t need administrator access to your entire WordPress website, while an employee working in customer service might not need access to your company’s financial records.
This principle is commonly referred to as ‘least privilege’, and it helps limit the potential damage if an individual account is compromised. It’s also worth regularly reviewing user accounts, particularly when employees leave the business or change roles.
I’ve encountered websites with administrator accounts belonging to people who left the company several years earlier, which is an unnecessary security risk that’s usually straightforward to resolve.
Consider Cyber Essentials
For UK businesses, I’d also recommend looking at Cyber Essentials, a government-backed certification scheme designed to help organisations protect themselves against common cyber threats.
The scheme concentrates on five fundamental areas: firewalls, secure configuration, access control, malware protection and security updates. These aren’t particularly revolutionary concepts, but implementing them properly can significantly reduce the likelihood of falling victim to relatively straightforward attacks.
Certification can also be useful commercially, particularly when dealing with larger organisations or public sector contracts where demonstrating appropriate security measures might be a requirement.
Even if you don’t intend to obtain certification, the National Cyber Security Centre provides a free small business guide containing practical advice that’s worth reading.
Have a Plan for When Something Goes Wrong
Finally, it’s worth considering what would actually happen if your business suffered a serious cyber attack. Would employees know who to contact? Could you restore your systems from backups? Would you be able to continue operating while your computers or website were unavailable?
There’s also the question of data protection. Under UK GDPR, certain personal data breaches need to be reported to the Information Commissioner’s Office within 72 hours of becoming aware of them, where feasible, so it’s important to understand your responsibilities before something happens.
Personally, I don’t think smaller businesses need to become experts in cyber security, but they should at least understand the risks and take reasonable precautions to protect themselves.
Most of the measures I’ve discussed don’t require particularly sophisticated technology or enormous budgets, but they can make a substantial difference to how vulnerable your business is.
Ultimately, I’d suggest treating cyber security in much the same way as protecting your physical premises: you probably can’t eliminate every possible risk, but that’s hardly a reason to leave the front door unlocked.