By J. Mesa
Small businesses are frequent targets for cyberattacks, and many fall victim to data breaches and other threats. In my work, the cause is seldom a clever attacker. It is one of five common mistakes.
This post covers each mistake, why it matters, and how to fix it.
Why are small businesses targeted?
- They hold data worth stealing: customer records, payment details, and bank access.
- They have fewer defenses than large companies.
- Automated attacks scan the whole internet and don’t care about company size.
- They connect to larger clients, which makes them a way in.
An attacker does not need to pick you. Your business only needs an open door.
Mistake 1: Failing to update software and security systems
Criminals look for flaws in outdated software. If your systems are behind, you are open to attacks that a free update would have blocked.
How to fix it:
- Turn on automatic updates on every computer and phone
- Check for updates to servers, firewalls, routers, and business applications each month
- Plan a time to install updates that need a restart
- Replace software and devices the vendor no longer supports
Mistake 2: Using weak passwords
Weak passwords are easy to guess, and an attacker with access to one account can do a great deal of damage. Reused passwords are just as risky, because a breach at one site exposes every account that shares the password.
How to fix it:
- Use a long, unique password for every account and system
- Give staff a password manager
- Turn on multi-factor authentication for email, banking, and remote access
- Change a password when there is a sign it was exposed. Current guidance from NIST no longer recommends forced changes on a fixed schedule.
Mistake 3: Neglecting employee training
Many small businesses give their staff no cybersecurity training. That leaves employees open to phishing and other scams, and most attacks start with a person.
How to fix it:
- Train every employee when they join and at least once a year after that
- Add short refreshers through the year
- Use real examples of phishing emails
- Write clear policies for handling suspicious messages and sensitive data
- Reward reporting. Never punish someone for admitting they clicked.
Mistake 4: Not backing up data
Without a recent backup, a ransomware attack or a failed drive can end the business. With one, you recover in hours or days.
How to fix it:
- Back up on a schedule, daily for important data
- Keep a copy somewhere separate from your business systems, so an attacker who gets in can’t reach it
- Follow the 3-2-1 rule: three copies, two types of storage, one offsite or offline
- Test a restore every few months
Mistake 5: Not having a cybersecurity plan
Many small businesses have no plan. When something goes wrong, they improvise, and that costs time and money.
How to fix it: Write a short plan that covers:
- Who is responsible for security
- How you handle updates and backups
- How and when you train employees
- What to do and who to call when an incident happens
- How you will notify customers if their data is exposed
One or two pages is enough to start. Review it once a year.
What other mistakes should I watch for?
- No multi-factor authentication. It blocks most attacks that use stolen passwords.
- Too much access. Every employee can see every file, and former staff still have accounts.
- Believing “we’re too small.” That belief is the reason the other mistakes go unfixed.
- Leaving it all to the IT provider. Many IT contracts cover support and exclude security. Ask what yours includes.
- No inventory. You can’t protect devices and accounts you don’t know about.
How do I know if my business is at risk?
Answer these questions:
- Do all our computers and phones update automatically?
- Does every account have a unique password and multi-factor authentication?
- Did every employee receive training in the past year?
- Did we restore a file from backup in the past three months?
- Do we have a written plan with phone numbers on it?
Each “no” is a gap an attacker can use.
How much does it cost to fix these mistakes?
Less than most owners expect. Automatic updates and multi-factor authentication are free with the tools you already own. A password manager and cloud backup cost a few dollars per user each month. Training and a written plan cost time. Compare that with the cost of a week of downtime.
Where should I start?
Follow this order. Each step builds on the one before.
- Turn on multi-factor authentication for email.
- Turn on automatic updates.
- Set up backups and test a restore.
- Roll out a password manager.
- Schedule a training session.
- Write your plan.
Most small businesses can finish the first three in a week.
Who should be responsible for cybersecurity?
Name one person. In a small company it is often the owner or the office manager. That person does not need to be technical. They need to make sure the tasks on this list happen and to know who to call for help.
Do I need outside help?
You can handle the basics yourself. Consider outside help when you store regulated data such as health or payment information, when a client or insurer asks for proof of your security, or after an incident. An assessment from a security professional shows you the gaps you can’t see from inside.
How do I keep these fixes from slipping?
Put them on the calendar. Schedule a monthly 15-minute check that updates and backups ran, a quarterly review of who has access, and a yearly review of the plan and the training. Security fails when it depends on someone remembering.
Does antivirus fix these mistakes?
No. Antivirus is useful, and it addresses none of the five. It can’t create a backup, train an employee, or write a plan. Keep it running, and treat it as one layer.
Your next step
Small businesses face growing risk, and these five mistakes account for most of it. Update your systems, use strong passwords, train your people, back up your data, and write a plan. Cerberus Cybersecurity can help with training, policy development, and assessments. Contact us to get started.
Leave a Reply