Small Business Cyber Security Help
Practical cyber security help for small businesses that want better protection without the cost, complexity or jargon of enterprise IT.
The aim is simple: identify the obvious weaknesses, improve the security of the systems you already use and make sensible changes that are easy to understand and maintain.
Start With the BasicsSmall Businesses Often Have More Risk Than They Realise
A small business may only have a few computers, a router, email, cloud storage and some shared files, but those systems can still contain valuable information and become essential to day-to-day operations.
The most common problems are often not highly technical. They are things like weak passwords, missing multi-factor authentication, old equipment, poor backups, shared administrator accounts and remote access that was never properly reviewed.
Improving those basics can make a meaningful difference to small business cyber security without turning the business into a complicated IT environment.
Ask These Questions
- Are important accounts protected with MFA?
- Do staff share passwords or administrator accounts?
- Are backups actually tested?
- Is the router or firewall still supported?
- Do old staff still have access?
- Is remote access properly secured?
- Could the business recover from ransomware?
The Main Areas Worth Checking
Most small businesses can improve their security significantly by reviewing a handful of important areas.
Router, Firewall & Wi-Fi
Review router firmware, administrator access, Wi-Fi security, firewall rules, remote management and unnecessary port forwarding.
Windows Security
Keep Windows and applications updated, confirm security protection is active and remove unnecessary software and old remote access tools.
Passwords & MFA
Use unique passwords, a password manager and multi-factor authentication for important business accounts wherever possible.
Email Security
Email remains one of the most common ways attackers reach a business. Secure the main email accounts carefully and review recovery settings, MFA and suspicious login activity.
Backup & Recovery
Backups should exist in more than one place and should be tested. A backup is only useful if important files can actually be restored.
Users & Permissions
Review who has access to business systems, remove old users and avoid giving administrator access to people who do not need it.
Many business compromises begin with a password rather than someone breaking through a firewall.
Email, cloud storage, accounting systems and remote access accounts are especially important because they can provide access to other systems or sensitive information.
Strong account security is one of the simplest and most effective improvements a small business can make.
Use unique passwords
Use a password manager
Enable multi-factor authentication
Review recovery email and phone details
Remove old staff accounts
Avoid shared administrator accounts
Protect the Business Email Accounts
Business email is often one of the most valuable accounts in the organisation. If someone gains access to it, they may be able to reset other passwords, impersonate staff or access sensitive conversations and documents.
Strong passwords, MFA and sensible user habits are essential. Staff should also be cautious with unexpected login links, attachments, payment requests and messages designed to create urgency.
Email Security Checklist
- Enable multi-factor authentication
- Use unique passwords
- Review forwarding rules
- Check recovery settings
- Remove old user accounts
- Review suspicious login alerts
- Be cautious with unexpected attachments and links
Keep Business Computers Simple and Current
Small business computers often accumulate years of software, old user accounts and remote access tools that are no longer required.
Updates
Keep Windows, browsers and installed applications updated and remove unsupported software where practical.
User Accounts
Avoid using administrator accounts for normal day-to-day work where possible and remove accounts that are no longer required.
Security Protection
Confirm Windows Firewall and security protection are enabled and working correctly.
Be Careful About What is Exposed to the Internet
Remote access can be useful, but it should be reviewed carefully. Old remote desktop settings, unused port forwarding and forgotten support software can create unnecessary exposure.
If remote access is required, it should be intentionally configured rather than simply left open because it was set up years ago.
Review
- Remote desktop access
- VPN configuration
- Remote support software
- Router port forwarding
- NAS remote access
- Camera and NVR access
- Old services that are no longer required
Backups are one of the most important parts of small business security.
Hardware fails, files get deleted and ransomware can encrypt data. A good backup plan provides more than one copy of important information and keeps at least one copy protected from the main system.
The most important step is testing the backup occasionally to make sure the files can actually be restored.
Local backup
Cloud or offsite backup
Versioned backups where possible
Offline or isolated copy for important data
Test recovery periodically
Protect Shared Business Data
Network storage and shared folders can be convenient, but they may contain some of the most valuable information in the business.
User permissions, updates, backups and remote access should all be reviewed. Shared storage should not automatically be exposed to every user or device on the network.
- Review user permissions
- Update NAS firmware
- Secure administrator accounts
- Review remote access
- Back up important shared data
- Remove unused accounts
Camera & NVR Security
- Change default passwords
- Keep firmware updated
- Review cloud and P2P access
- Avoid unnecessary port forwarding
- Use separate networks where practical
- Review remote viewing access
Cameras Are Part of the Network Too
Network cameras and recorders are computers in their own right. They run software, connect to the network and may communicate with external cloud or remote access services.
They should be treated like any other network device and kept current, secured and appropriately isolated where practical.
Give People the Access They Need, Not Everything
Small businesses often grow informally, and user access tends to accumulate over time.
- Use individual user accounts
- Avoid shared passwords
- Limit administrator access
- Review access when roles change
- Remove departed staff promptly
- Review cloud account permissions
- Protect shared files
- Document important access details
Not every small business needs a full cyber security consultant.
I offer a straightforward security review aimed at finding common weaknesses and improving the security of the systems your business already uses.
The focus is practical: identify the obvious risks, fix what can be fixed sensibly and explain any remaining issues in plain English.
Review router and firewall settings
Check Windows security
Review user and administrator accounts
Check MFA and password practices
Review email security
Check backup arrangements
Review remote access
Provide practical recommendations
This is a Practical Security Review
This service is not penetration testing, compliance certification, incident response or enterprise cyber security consulting.
It is designed for small businesses that want someone technically capable to review their existing setup, identify common weaknesses and help improve the basics without making the environment unnecessarily complicated.
Small Business Cyber Security Questions
Straightforward answers to common questions from small businesses looking to improve their security.
1. Does a small business need cyber security?
Yes. Even a very small business may rely on email, cloud storage, online banking, accounting software, Windows computers and customer information. Protecting those systems helps reduce the risk of data loss, account compromise and disruption.
2. What are the most important things to secure first?
Start with important accounts, email, multi-factor authentication, router and firewall configuration, Windows updates and reliable backups. These basics usually provide more value than adding complicated tools that nobody understands.
3. Should staff have administrator access?
Not unless they genuinely need it. Administrator access allows significant changes to a computer or system, so normal users should generally work with standard accounts where practical.
4. Are backups enough to protect against ransomware?
Backups are an important part of ransomware recovery, but they should not be the only protection. Systems still need to be kept updated, accounts secured and unnecessary access removed. Backups should also be protected so they cannot easily be encrypted along with the main files.
5. Do we need an expensive cyber security consultant?
Not necessarily. Many small businesses can improve their security substantially by fixing common weaknesses in the systems they already use. More specialised services may be required for businesses with regulatory, compliance or advanced security requirements, but a practical security review is often a sensible starting point.
If you are not sure whether your current setup is secure, I can work through the basics with you, identify the obvious weak points and recommend practical improvements.
Contact Owen