IT security for small businesses: the measures that prevent most attacks
Small businesses are attacked not because they are interesting but because they are easy targets. Most incidents start with a stolen password, a phishing email or an outdated system. A handful of measures prevents the majority of attacks, and none of them requires a large IT department.
Accounts: two-factor login and a password manager
Enable two-factor authentication for email, cloud storage, banking, booking platforms and the website. Use a password manager so that every account has its own strong password. Remove the accounts of former employees on their last day.
Phishing: the most common entry point
Fake invoices, delivery notices and supposed messages from booking platforms are the usual traps. Hotels, for example, regularly receive messages that imitate booking portals and lead to fake login pages. Train the team to check senders and links, and to confirm payment changes by phone using a number they already know.
Updates and backups
Install updates for operating systems, browsers and the website promptly. Back up data so that a single incident cannot destroy everything:
- Several copies of important data, in at least two places.
- At least one copy offline or immutable, protected against ransomware.
- Automatic backups with a notification if they fail.
- A restore test every few months.
Access rights and devices
Give each person only the access they need, and use separate admin accounts. Encrypt laptops and phones, lock screens automatically and keep a list of devices that hold company data. Shared accounts at the reception or the till should have limited rights.
When something happens
Write down in advance who decides, whom to call and how systems are isolated. If personal data is affected, the data protection authority must generally be informed within 72 hours (Art. 33 GDPR). Medium-sized and larger companies in certain sectors also fall under the NIS2 rules; the Federal Office for Information Security offers a check. We secure websites and automations and set up backups and monitoring; tell us your systems, and you will receive a fixed price.
Frequently asked questions
- Do small businesses really get attacked?
- Yes, mostly through automated attacks and phishing that hit everyone. Small businesses often have fewer protections, which makes them easy targets.
- Is cloud storage safe enough?
- Reputable providers are often safer than a server in the office, provided two-factor login, access rights and an independent backup are in place.
- Do we need cyber insurance?
- It can cover costs after an incident, but insurers usually require basic measures such as two-factor login and backups. Implement those first.
Sources
Tell us which systems and accounts your business depends on. We will check the basics and set up backups, monitoring and secure access.
Request a security check