Small Business Cyber Security: 6 Fixes to Make This Week

How to Protect Your Small Business from a Cyber Attack

It’s a Tuesday afternoon. An email lands from a supplier you’ve used for years. Their bank details have changed, could you update them before paying this month’s invoice? The logo’s right. The tone’s right. Even the signature is right.

Except it isn’t from your supplier.

That’s what most cyber attacks on small businesses look like. Not a hooded hacker breaking through firewalls, but a convincing message landing on a busy person’s screen at the wrong moment.

The good news? The things that stop most attacks aren’t complicated or expensive. Here’s what’s out there, and what you can do about it this week.

Why small businesses are firmly on the radar

It’s tempting to think you’re too small to bother with. Surely the criminals are after banks and big retailers?

Some are. But most attacks aren’t aimed at anyone. They’re sent to thousands of inboxes at once, and they work best wherever there’s no IT team double-checking things. That makes a busy 15-person firm an easier target than a bank, not a harder one.

The UK government’s latest Cyber Security Breaches Survey found that nearly half of small businesses spotted a breach or attack in the past year. Phishing emails were by far the most common.

That’s not a reason to panic. It’s a reason to get the basics right, because the basics stop most of it.

The 5 attacks most likely to land in your inbox

1. Phishing and email account takeover

An email that looks like it’s from Microsoft, your bank or a colleague asks you to log in somewhere. The page looks real. It isn’t. Once they have the password, they’re reading your emails, and often sending some of their own.

2. Fake invoice fraud

The scenario at the top of this post. A supplier’s details “change”, or an invoice arrives that looks exactly like the real thing. It’s especially common once an attacker is already inside someone’s email account, because they can reply to genuine threads.

3. Reused passwords

When a website you once signed up to gets breached, those email and password combinations get tried everywhere else. If your team reuses passwords, one old leak can unlock your Microsoft 365.

4. Ransomware

Software that locks up your files until you pay. It’s less common than phishing, but it’s the one that can stop a business for days. It usually gets in through one of the routes above.

5. Out-of-date software

Those update reminders you keep postponing often fix known security holes. Attackers know about the holes too and look for machines that haven’t been patched.

6 things you can do this week

None of these need a big budget. Most of them need an afternoon.

1. Turn on two-step sign-in for everyone. It’s the code from your phone when you log in. Even if someone steals a password, they can’t get in without it. If you only do one thing on this list, do this.
2. Make a “call to check” rule for payments. Any change to bank details, or any urgent payment request by email, gets confirmed with a phone call to a number you already have. Not the one in the email.
3. Stop the password reuse. A password manager lets your team use a different strong password for everything without having to remember them.
4. Let the updates happen. Switch on automatic updates for laptops, phones and browsers, and stop hitting “remind me tomorrow”.
5. Check your backups are real backups. Files in OneDrive or SharePoint aren’t automatically backed up in the way most people assume. Our post on whether your Microsoft 365 data is backed up explains the difference.
6. Have a five-minute team chat. Tell everyone it’s fine to ask, “does this look right?” before clicking. The most expensive mistakes happen when people feel too awkward to check.
   
   

What a properly managed setup does for you

The list above is a great start. But it relies on you remembering to do it, checking it’s still working, and keeping up as things change. That’s a lot to carry when you’ve got a business to run.

With managed IT support, most of it happens in the background without you thinking about it:

• Email and device protection catches dodgy attachments, fake login pages and malware before they reach your team.
• Updates are applied for you across every laptop and device, so nothing gets left behind.
• Daily backups of your emails and documents mean a deleted file or locked-up folder can be brought back.
• Two-step sign-in and sensible access settings are set up properly from day one, not left half-finished.

If you want proof, you’ve got the basics covered, Cyber Essentials is the UK government-backed certification for exactly that. It’s increasingly asked for by clients and in tenders, and we can take you through it.

All of this comes as standard in our Core plan, which is where most small teams start. You can read more about our approach on our cyber security page.

Do you know where you stand on security? Book a free 15-minute security chat. We’ll talk through your setup in plain English and point out anything worth fixing. No jargon, no scare stories, no pressure.