Cybersecurity for Small Businesses: A Practical Guide

Why is a small business a target?

Most attacks do not begin with someone specifically choosing your business. Automated scripts scan websites, email services and public-facing systems, looking for outdated software, weak passwords and misconfigured accounts.

A business becomes interesting when it has access to money, customer data, contracts, invoices, inventory information or advertising accounts. If an email account is compromised, an attacker can read real correspondence and send a convincing fake invoice at exactly the right moment.

That is why security is not just about your website and antivirus software. It includes Microsoft 365 or Google Workspace, computers, the router, accounting and ERP systems, the online store, phones and everyone who uses them.

What are the most common attacks against small businesses?

Phishing and stolen passwords

A message about an unpaid invoice, a delivery or a blocked account takes you to a copy of a familiar page. Once someone enters their password, the attacker tries the same credentials in email, the website admin panel, social media profiles and payment services.

Fake invoices and bank account changes

A compromised email account allows an attacker to monitor a conversation between you and a customer or supplier. Never confirm an IBAN change by email alone. Call a phone number you already know, not a number provided in the message itself.

Ransomware and file loss

Malware can encrypt documents, shared folders and backups if they are permanently accessible from the same network. Paying a ransom does not guarantee that your files will be restored and does not eliminate the risk of data leakage.

Vulnerable website or online store

An outdated CMS, plugin, theme or library can open a path to the admin panel or database. HTTPS is necessary, but it does not fix vulnerable code, a stolen administrator password or a misconfigured integration with couriers and payment providers.

Lingering or overly broad access

A former employee may still have an active account, while an external provider may see more than they need to. A shared admin account is also a problem: you do not know who made a change and cannot revoke access for just one person.

What basic protection should every business have?

1. 01
   Document your systems and data

   Make a list of your business email, website, online store, ERP and CRM system, accounting system, files, domain, hosting, couriers, payment providers and advertising accounts. For each service, record its owner, administrator, type of data and recovery method.

2. 02
   Secure email and administrator accounts

   Use unique, long passwords and a password manager. Enable two-factor authentication for email, your domain, hosting, social media profiles, advertising accounts and admin panels. Whenever possible, prefer an authenticator app or hardware key over SMS.

3. 03
   Separate roles and access

   Every person should have their own account. Grant only the permissions they need: a sales employee should not be a database administrator, and an external developer should not have constant access to customer records.

4. 04
   Update software in a controlled manner

   Keep operating systems, browsers, WordPress, plugins, server components and applications up to date. Before updating your ERP or store, make a backup and check that the changes will not affect orders, inventory or invoicing.

5. 05
   Back up and restore

   Keep several copies of important data on different media, with at least one copy outside the primary environment. An automated backup does not prove that you can restore the system. Restore selected files or a database to a separate environment on a predefined schedule.

6. 06
   Secure the website and network

   Check HTTPS, administrator accounts, WAF settings, login attempt restrictions and logs. Change the router's factory password, update its firmware and separate the guest Wi-Fi network from business devices.

7. 07
   Train the team with real-world examples

   Show what a fake invoice looks like, how to check the sender’s address and where to report a suspicious email. Payments, IBAN changes or urgent transfers must be confirmed through a second channel.

8. 08
   Write an incident response plan

   Define who disconnects a compromised computer, who changes the passwords and who speaks to the bank, hosting provider and customers. Keep emergency contact numbers outside the primary system. When personal data is involved, discuss with a lawyer and the data protection officer whether there is an obligation to notify.

How do you protect your website, online store and ERP system?

For your website, start with up-to-date components, restricted access to the admin area, separate accounts and backups of the files and database. For an online store, also control the payment provider, courier integrations, API keys and access to customer and order data.

API keys must not be stored in public JavaScript code, chats or spreadsheets accessible to the entire team. Record which integration uses each key and change it when an employee or provider leaves.

The ERP system should have roles, a change history and separate permissions for inventory, sales, invoicing and settings. With custom business software, these rules are designed together with the processes rather than added after the first problem. This is especially important when one system brings together customers, contracts, invoices, inventory movements and communications.

If support is handled by another team, request a record of access rights, an update schedule, a backup policy and an incident response procedure. Taking over a website or online store built by another company starts with reviewing the code, hosting, domain and administrator accounts-not changing the colours.

How much does basic cybersecurity cost?

The cost depends on the number of users and devices, the volume of data, uptime requirements and whether you already have support. For a specific security configuration, audit or test, the price is determined by the scope and stated in the quote.

An SSL certificate is often included with hosting or issued at no extra cost. This does not mean the entire website is secure. With hosting for websites and systems, check whether Cloudflare or another security layer, backups, monitoring, a recovery time frame and a clear list of administrators are included.

How can you check whether your backups and security are working?

Ask for a specific answer to five questions: when was the last successful backup, where is it stored, how many versions are retained, how long does recovery take and who has access to the backups? The statement “we back up every day” does not tell you whether a restore has ever been performed.

Check access in practice. Retrieve a list from the administration areas of your email, domain, hosting, online store, ERP system and advertising accounts. Remove old profiles, change shared passwords and record who approves new access.

For a website or online store, you can start with support and checks, including updates, backups and minor changes. A more complex environment requires a separate plan for monitoring, testing and response-not just monthly installation of updates.

What should you do if you suspect a breach?

1. 01
   Stop the spread

   Isolate the affected computer or account without deleting files or logs. Do not use compromised email for coordination.

2. 02
   Secure critical access

   From a clean device, change the passwords for your email, domain, hosting, ERP system and payment services. Terminate active sessions and download a list of administrators.

3. 03
   Contact the right people

   Notify your IT support team, hosting provider and bank if you suspect fraud. Consult a lawyer or data protection officer. Do not negotiate or pay a ransom without a professional assessment.

4. 04
   Restore from a clean backup

   First determine how the breach occurred and check your backup. Restore in an isolated environment, update the systems, and replace all affected keys and passwords.

5. 05
   Document what happened

   Record the times, affected accounts, messages sent, actions taken by the team and decisions made. This information helps with recovery, notifications and preventing a repeat incident.

What should you check every month?

• The list of users and administrators in all critical systems.
• Backup activity and an actual restoration of selected data.
• Updates for operating systems, the website, plugins, the server and the ERP system.
• Two-factor authentication for email, domain, hosting, advertising and admin panels.
• Unusual logins, changes to API keys and new email forwarding rules.
• The phone numbers that are still working and the roles in the incident response plan.