The Small Business Cyber Security Starter Guide

Chapter 1

Phishing and scam emails

Phishing is a scam email that pretends to be someone you trust, such as Microsoft, your bank, or a supplier you deal with every week. The goal is simple: get you to click a link, open an attachment, or type your password into a fake page. It is the most common way a business gets breached.

The design is rarely the giveaway, because logos and layouts are easy to copy. The clues are usually in the sender address and the link. On a computer, hover over a link to see where it really goes before you click. On a phone, press and hold to preview it.

Urgency is a tactic, not a coincidence. That pressure is there to stop you checking. A real provider will not close your account because you took an hour to think.

Chapter 2

Passwords and a password manager

The two biggest problems are passwords that are simple to guess and the same password reused across many sites. When one website is breached, attackers try those leaked passwords everywhere else, so one small leak becomes a big problem.

Length beats complexity. A long passphrase made of a few random words is stronger and easier to remember than a short jumble of symbols. The NCSC advice of three random words is a good, human way to build one.

The honest reason people reuse passwords is that nobody can remember dozens of unique ones. A password manager solves exactly that, and you only need to recall one master password.

Chapter 3

Multi-factor authentication

Multi-factor authentication adds a second proof of who you are, usually a code or a tap on your phone, on top of your password. Even if a scammer steals your password, they are stopped at that second step, which blocks the large majority of account takeovers.

Not all methods are equal. An authenticator app or a physical security key is stronger than a code sent by text, because text messages can be intercepted or redirected. A text code is still far better than no second factor.

Start with email, banking, your Microsoft 365 or Google account, and any tool holding customer or payment data. Save the backup codes somewhere safe so a lost phone does not lock you out.

Chapter 4

Backups that actually restore

If a fire, a theft, a failed drive or a ransomware attack wiped your systems this afternoon, a good backup is the difference between a bad day and a closed business. For most small firms the real damage is the days of downtime, not the ransom.

A simple, trusted approach is the 3-2-1 rule. Keep three copies of important data, on two different types of storage, with one kept off site or offline. Never let a single event destroy every copy at once.

The step almost everyone skips is testing. A backup you have never restored from is only a hope. Every so often, actually retrieve a file and check it opens.

Chapter 5

Keeping software updated

Many attacks rely on known weaknesses that the maker has already fixed. When you install an update you are usually closing a door that attackers already know how to walk through.

This applies to everything: operating systems, browsers, phones, business software, and the firmware on your router and other network kit. Automatic updates are the most reliable approach, because they do not depend on anyone remembering.

It is also worth knowing when a product stops receiving updates altogether. Once something reaches the end of its supported life, new weaknesses are found but never fixed.

Chapter 6

Staff awareness and a simple rule for money

Your team is not the weak link, they are your best early-warning system once they know what to look for. A short, blame-free conversation about the scams in this guide does more than any single piece of software.

Build a culture where checking is normal and encouraged. Staff should feel safe to pause, ask a colleague, or call a number back to verify, and to report a mistake quickly without fear of being told off.

The costliest scam a small business faces is payment redirection. The defence is a simple, firm rule: any change of bank details, or any payment over a set amount, needs a second person to approve and a verbal confirmation on a number you already hold.

Chapter 7

What to do if the worst happens

Even careful businesses have incidents, so it helps to decide in advance roughly what you will do. The aim in the first hour is to contain the problem and start recovery, not to assign blame.

If an account may be compromised, change its password from a device you trust and turn on multi-factor authentication. If a computer looks infected, disconnect it from the network to stop the problem spreading, then restore from backups once you are confident the threat is cleared.

On ransomware, UK guidance from the NCSC and Action Fraud is not to pay, because paying does not guarantee your files back and marks you as someone who will pay again. Report the incident, and keep a note of what happened and when.

Chapter 8

Your first week action plan

You do not have to do everything at once. This plan spreads the essentials across a week so it stays manageable alongside running the business.

Day 1: multi-factor authentication on your email, then banking and main business accounts. Day 2: set up a password manager and give your email a new, unique passphrase. Day 3: check your backups and prove a restore works.

Day 4: switch on automatic updates everywhere, including the router. Day 5: agree your money rule and share it. Then, when you can, have a short blame-free chat with staff about phishing.

Related