Cybersecurity Basics Every Small Business Should Implement

Small businesses often assume that attackers only target banks and large corporations. In reality, smaller organisations are attractive precisely because their defences tend to be weaker. The good news is that a handful of basic measures stop the most common attacks, and most of them cost little or nothing.

1. Turn on two-factor authentication everywhere

Stolen passwords are behind a large share of account takeovers. Two-factor authentication (2FA) adds a second step, such as a code from an app or SMS, so a stolen password alone is not enough. Switch it on for email, banking, social media, your website admin panel and any cloud tools your team uses.

2. Use a password manager

People reuse passwords because remembering dozens of them is impossible. A password manager generates and stores a unique, strong password for every account. It is one of the most effective security upgrades you can make for your whole team.

3. Keep software up to date

Updates fix security holes that attackers actively look for. Enable automatic updates on computers and phones, and make sure your website, its plugins and server software are patched regularly. An outdated website plugin is one of the most common ways small business sites are compromised.

4. Train your team to spot phishing

Most attacks start with a convincing message: an “urgent” email from the boss, a fake delivery notice, or an SMS asking someone to confirm an M-Pesa reversal. Teach your team to:

• Pause before clicking links or opening attachments they did not expect
• Verify payment or password requests through a second channel, such as a phone call
• Report suspicious messages instead of quietly deleting them

You can read more about these tactics in our earlier article on social engineering.

5. Back up, and test your backups

Ransomware, hardware failure and simple mistakes can all destroy data. Follow the 3-2-1 rule: three copies of important data, on two different types of storage, with one copy offsite or in the cloud. Then test that you can actually restore from it; a backup you have never restored is only a hope.

6. Give people only the access they need

Not everyone needs to be an administrator. Give staff access to the systems and data their role requires, remove access promptly when people leave, and use separate admin accounts for administrative tasks. Business systems we build include role-based permissions and audit trails for exactly this reason.

7. Secure your website and customer data

• Use HTTPS on every page, not just checkout
• Protect forms against spam and bots
• Store passwords properly hashed and never in plain text
• Collect only the personal data you genuinely need

Start this week

You do not need a large security budget to be much safer. Turning on 2FA, adopting a password manager and setting up tested backups will put you ahead of most attackers’ easy targets. If you would like an independent review of your systems, our IT consultancy team offers short, practical security assessments with clear recommendations.