Many small business owners believe cyber criminals only target large companies. In reality, small and mid-sized businesses are attractive targets because they often have weaker defences. A single phishing email, a stolen password or a ransomware attack can stop billing, leak customer data and damage trust. The good news is that most attacks can be prevented with a set of basic measures that do not need a large budget. This checklist explains them.
1. Strong passwords and multi-factor authentication
Weak and reused passwords are the most common way attackers get in. Use long, unique passwords for every account, store them in a reputable password manager, and turn on multi-factor authentication (MFA) for email, banking, accounting software, cloud storage and social media accounts. MFA alone blocks a large share of account takeover attempts.
2. Keep software updated
Attackers exploit known weaknesses in old software. Turn on automatic updates for operating systems, browsers and business applications, replace devices and software that no longer receive security updates, and keep website platforms and plugins up to date. This includes routers and other network devices.
3. Back up your data, and test it
- Back up critical data such as accounts, customer records and designs regularly.
- Keep at least one backup offline or in a separate cloud account that ransomware cannot reach.
- Test restoring files every few months; an untested backup may fail when needed.
4. Be careful with email and messages
Most attacks start with a message: a fake invoice, a courier alert, a bank warning or a message that appears to come from the owner asking for an urgent payment. Train staff to check the sender, avoid clicking unknown links, verify payment requests by phone using a known number, and report suspicious messages. Never share OTPs or passwords.
5. Control who can access what
Give employees access only to the systems and data they need for their role. Remove access immediately when someone leaves. Avoid sharing one login among many staff; individual accounts make it possible to see who did what. Admin rights on computers should be limited to IT staff.
6. Secure your network and devices
- Change default router passwords and use strong Wi-Fi encryption.
- Keep a separate guest Wi-Fi network for visitors.
- Install reputable security software on computers.
- Encrypt laptops and mobile phones and enable remote wipe.
- Be cautious with USB drives from unknown sources.
7. Protect customer data and follow the law
India’s Digital Personal Data Protection Act, 2023 and its rules place obligations on businesses that handle personal data, including security safeguards and breach notification. CERT-In, India’s national cyber agency, has also issued directions on reporting certain cyber incidents within short time limits. Collect only the data you need, protect it carefully and know whom to inform if something goes wrong. ATTPL Legal can help businesses understand their legal obligations.
8. Plan for incidents
Write a simple incident response plan: whom to call, how to isolate affected systems, how to restore from backup and how to inform customers and authorities. Keep it printed as well as online. The national cyber crime helpline 1930 and the cybercrime.gov.in portal are available for reporting cyber fraud. Larger groups can include cyber risk in their wider business continuity planning, as explained by ATTPL HOLDCO.
How ATTPL IT can help
ATTPL IT builds secure web applications, cloud apps and CRM systems with security built in, and helps businesses review their IT setup. Read our ERP implementation guide for related advice, or contact us for a security review.
Frequently asked questions
What is the most important cybersecurity step for a small business?
Turning on multi-factor authentication for email, banking and key business systems, along with strong unique passwords, blocks many common attacks.
How often should a small business back up data?
Critical data should be backed up at least daily or weekly depending on how often it changes, with one copy kept offline and restores tested regularly.
Where can I report cyber fraud in India?
Call the national cyber crime helpline 1930 or report on the cybercrime.gov.in portal.
Pingback: Firewall and Network Security for Small Offices: A Guide - ATTPL IT