Author: J. Mesa

By J. Mesa

As a small business owner, protecting your company against hackers and ransomware is essential to its security and success. Attacks keep getting more capable, and no single product stops them all.

Good IT security works in layers. If one fails, the next one catches the problem. This guide explains each layer in plain language and tells you where to begin.

What is IT security?

IT security is the set of tools, rules, and habits that protect your computers, networks, and data from unauthorized access, damage, and theft. For a small business it covers your devices, your accounts, your network, your data, and the people who use them.

Why do small businesses need layers?

Security professionals call the approach defense in depth. An attacker who gets past your email filter still has to fool a trained employee. If the employee clicks, security software can still block the malware. If the malware runs, limited access keeps it from reaching everything, and a backup lets you recover.

Each layer is imperfect. Together they are hard to beat.

Layer 1: What does a firewall do?

A firewall controls the traffic that enters and leaves your network. It blocks connections you did not ask for.

• Use the firewall in your router or a dedicated business firewall
• Keep its software updated
• Change the default administrator password
• Turn on the firewall built into each computer

Layer 2: Do I need antivirus and anti-malware software?

Yes. Security software on each device detects and blocks known malware. Newer products, called endpoint detection and response, also watch for suspicious behavior. Install protection on every computer, keep it updated, and make sure someone reviews its alerts.

Layer 3: Why do updates and patches matter?

Attackers use known flaws in outdated software. Updates close them.

• Turn on automatic updates for operating systems and applications
• Update routers, firewalls, printers, and other network devices
• Replace hardware and software the vendor no longer supports
• Subscribe to security alerts from your key vendors and from CISA to hear about urgent fixes

Layer 4: What are intrusion detection and prevention systems?

An intrusion detection system watches network traffic for signs of an attack and raises an alert. An intrusion prevention system also blocks the traffic. Many business firewalls include both. They help you spot an attacker who is already inside.

Layer 5: How do I control access?

Set strict rules for how people reach company information and systems.

• Give each employee a unique account
• Require long, unique passwords and a password manager
• Turn on multi-factor authentication for email, remote access, and financial systems
• Give each person access to only what the job needs
• Remove access on an employee’s last day

Current guidance from NIST recommends changing a password when there is evidence it was exposed, in place of forced changes on a fixed schedule.

Layer 6: Why train employees?

Your staff see phishing emails before any tool does. Training teaches them to recognize and avoid the tactics hackers use to get into your systems.

• Train at hire and at least once a year
• Use real examples
• Make it easy and safe to report a suspicious message

Layer 7: How should I back up my data?

Backups mean that if your systems are compromised, you still have your information and files.

• Back up on a schedule
• Follow the 3-2-1 rule: three copies, two types of storage, one offsite or offline
• Store a copy in a secure offsite location, so a disaster can’t destroy every copy
• Test a restore every few months

Layer 8: Do I need a security plan and outside help?

A written plan ties the layers together. It names who is responsible, what you protect, and what you do in an incident.

A trusted cybersecurity provider or consultant can help you build the plan and put it in place. They bring advice on the right solutions for your needs and help you stay ahead of new threats.

What security does a small business need at minimum?

1. Multi-factor authentication on email and banking
2. Automatic updates on every device
3. Tested backups with one copy offline or offsite
4. Security software on every computer
5. Phishing training for all staff

These five block the attacks that hit small businesses most often.

What is the difference between IT support and cybersecurity?

IT support keeps your systems working. Cybersecurity keeps them safe. Many IT contracts cover setup and repair and leave out security monitoring, risk assessment, and incident response. Ask your provider which security tasks are included, and get the answer in writing.

How do I secure Wi-Fi in the office?

• Use WPA2 or WPA3 encryption and a strong password
• Set up a separate guest network for visitors
• Keep smart devices and printers off the network that holds business data
• Change the router’s default administrator password

What about cloud services and email?

Most small businesses now run on cloud email and file storage. The provider secures the service. You secure the accounts.

• Turn on multi-factor authentication for every user
• Review sharing settings and remove public links
• Turn on the security features your plan includes, such as phishing protection
• Remove accounts for former staff

How much should I budget?

Start with the minimum list above, which costs little. Then match further spending to your risk: the data you hold, the rules that apply to you, and what a day of downtime costs. A risk assessment tells you where each dollar does the most good.

How do I know if my security is working?

• Updates and backups show as current when you check
• Staff report suspicious emails
• You can restore a file from backup
• You know who has access to what
• An outside assessment finds fewer problems each year

What are the signs my business has been hacked?

• Computers run slowly or behave oddly
• Passwords stop working
• Customers receive strange emails from your address
• Files are missing, renamed, or locked
• Your bank reports unusual transactions

If you see any of these, disconnect the affected device and call your IT or security provider.

Your next step

Protecting your small business takes effective security tools, educated employees, and steady upkeep. Check the minimum list above against your business today. Cerberus Cybersecurity can assess your current layers and help you close the gaps with a risk and compliance assessment. Contact us to get started.

By J. Mesa

Thanks to Hollywood, most people picture a hacker as a hooded figure in a dark room, with a wall of monitors and streaming green text. The real ones look like anyone you pass during the day. They use practical, boring methods, and those methods work.

The most common method is social engineering. This post explains what it is, why small businesses are targets, and how to defend against it.

What is social engineering?

Social engineering is the use of deception to get a person to do something that helps an attacker: click a link, open a file, share a password, or send money. The attacker goes after the person in place of the technology.

It is the first step in most multi-phase attacks. A tricked employee downloads malware or gives up a login, and the attacker builds from there.

Are small businesses too small to be a target?

No. That belief is one of the most damaging misconceptions in small and medium-sized business (SMB).

In 2021 the United States had about 32.5 million small businesses, close to 99.9 percent of all US businesses. The pandemic pushed more of them online, which multiplied their exposure. That is an enormous pool of potential victims.

Why do attackers prefer SMBs?

• There are so many of them. Volume makes up for smaller payouts.
• Attacks are automated. Software sends the emails and scans for weak systems.
• Hacking tools are for sale. Criminals rent tools and services. Think of an online marketplace for hackers.
• The risk to the attacker is low. Small businesses seldom have the means to investigate or pursue them.
• Defenses are thinner than at a large company.

The cost to a victim goes beyond money. A breach damages a reputation for years. Remember Equifax.

What are the most common social engineering techniques?

• Phishing. Mass emails that imitate a trusted company.
• Spear phishing. A message written for one person, using details about them.
• Business email compromise. An attacker poses as an owner, executive, or vendor and asks for a payment or a change in bank details.
• Pretexting. The attacker invents a story, such as “I’m from IT and need your password to fix your account.”
• Vishing. The same tricks by phone call.
• Smishing. The same tricks by text message.
• Baiting. A free download or a USB drive left where someone will find it.
• Tailgating. Following an employee through a locked door.

Why is phishing the biggest threat?

Phishing is the most damaging and widespread threat facing small businesses. Industry analyses attribute the large majority of breaches to it, with business losses in the billions of dollars.

Malware attacks follow, a category that includes ransomware. Malware can disable devices or leak confidential data. That is expensive to fix, and it harms the company in ways that go beyond equipment and cleanup costs.

Why does social engineering work?

It works because it uses normal human reactions.

• Authority. We follow requests from a boss or an official.
• Urgency. A deadline stops us from thinking.
• Fear. A threat to an account or a job pushes us to act.
• Helpfulness. Most people want to assist a coworker or a customer.
• Curiosity. An unexpected file or link is tempting.
• Familiarity. A message that mentions real names and details feels safe.

None of this requires expensive or complex tools. An attacker needs a convincing story and an email address.

What does a real attack look like?

1. The attacker reads your website and social media to learn names and roles.
2. They send an email that appears to come from a vendor, with an “updated invoice” attached.
3. An employee opens it. Malware installs, or a fake login page captures a password.
4. The attacker reads email quietly and learns how you handle payments.
5. They send a payment request at the right moment, or they lock your files with ransomware.

Depending on the malware, security software may or may not catch the file. The person who received the email was the first and best chance to stop it.

How long before a business notices?

Often a long time. Reports indicate that outside parties, such as a bank, a customer, or law enforcement, discover most social engineering and phishing incidents. The business itself does not realize it is a victim.

How do I spot a social engineering attempt?

• The request is unexpected
• It pushes you to act fast or in secret
• It asks for a password, a code, or a payment
• It asks you to skip a normal process
• The sender’s address or phone number is slightly wrong
• Something about the tone feels off

When you notice any of these, stop, and verify through another channel.

What is the best defense?

Training. Technology keeps advancing, and new tools reach the market fast. Those tools are only as effective as the people who use them.

Raising security awareness through training pays back sooner than most investments, because staff come to understand both their tools and the threats.

• Train everyone, including owners and executives
• Use real examples from your own industry
• Run simulated phishing tests and teach from the results
• Repeat through the year

What technical controls help?

• Multi-factor authentication, so a stolen password is not enough
• Email filtering and warnings on messages from outside the company
• Limited access, so one compromised account can’t reach everything
• Security software and automatic updates
• Tested backups

What rule stops the most fraud?

Verify by phone. Any request to send money, change bank details, buy gift cards, or share employee records gets a call to a number you already have. This one habit blocks most business email compromise.

How do I build a security culture?

Cybersecurity is a community effort and a cultural approach. A hacker needs to succeed once. Your team needs to stay alert together.

• Thank people who report suspicious messages
• Treat mistakes as lessons
• Talk about security in regular meetings
• Lead by example

What should I do if an employee falls for it?

1. Disconnect the device from the network.
2. Change the affected passwords from another device.
3. Call your bank if money is involved.
4. Bring in your IT or security provider to check for further access.
5. Report it to the FBI at ic3.gov.
6. Share what happened with the team, without blame.

Your next step

Ask yourself how your team would respond to a fake invoice email tomorrow. If you aren’t sure, start with training. Get in touch with our team to learn how Cerberus Cybersecurity can help you defend against cybercriminals with cybersecurity training built for your staff. Contact us today. At Cerberus Cybersecurity, we are people first.