Small businesses are not too small to be targeted. Attackers use automated tools that look for weak passwords, unpatched software and unprotected accounts, whoever owns them. The good news is that a handful of basic controls stop most common attacks. This guide to cyber security for small businesses in Cambridgeshire sets out eight steps in the order that usually gives the most protection for the least effort.
1. Turn on multi-factor authentication (MFA)
MFA asks for a second proof of identity, such as a code from an app, when someone logs in. Switch it on first for email, Microsoft 365 or Google accounts, banking, your website and any admin account. It is one of the most effective single steps you can take. The NCSC explains MFA in plain language.
2. Use a password manager and stop reusing passwords
A password manager creates and stores long, unique passwords so nobody has to remember them. Reused passwords are dangerous because one leaked login can open several accounts.
3. Keep everything updated
Updates fix known weaknesses. Turn on automatic updates for operating systems, browsers and office software, and keep routers, firewalls and your website plugins current. Retire devices that no longer receive updates.
4. Back up properly, and test the restore
Keep copies of important data somewhere an attacker on your network cannot easily reach, such as an offline or separate cloud backup. A backup you have never tested is a hope, not a plan: check that you can actually restore files.
5. Protect the edges: firewall, VPN and secure Wi-Fi
- Use a business-grade firewall and keep its firmware current.
- Give staff a VPN for remote access instead of opening services directly to the internet.
- Separate guest Wi-Fi from the network your business devices use.
- Change default passwords on routers and other devices.
6. Train your team to spot phishing
Most attacks start with a convincing email or text. Short, regular security awareness training helps staff spot fake invoices, urgent requests and unexpected login pages, and gives them an easy way to report anything suspicious without feeling embarrassed.
7. Limit access
Give people only the access they need, remove accounts when staff leave, and keep admin accounts separate from everyday ones. Intrusion detection tools can flag unusual activity so you hear about it early.
8. Plan for the day something goes wrong
Write down who to call, how to isolate a device, where backups live and who must be told. If personal data is involved, you may have to report it to the ICO quickly: see our GDPR checklist for small businesses.
Where to start if you can only do three things
- Turn on MFA everywhere it is offered.
- Make sure backups exist and can be restored.
- Turn on automatic updates.
What about Cyber Essentials?
Cyber Essentials is a UK government-backed scheme built around basic technical controls. Even if you do not seek certification, its checklist is a useful benchmark. Read the NCSC overview and the NCSC Small Business Guide.
The attacks small businesses actually see
Understanding the common attacks makes the steps above easier to prioritise.
- Phishing: a fake email, text or login page designed to steal passwords or get you to pay a fraudulent invoice.
- Business email compromise: a criminal gets into, or imitates, a real mailbox and asks for a payment or a change of bank details.
- Ransomware: malicious software that locks files and demands payment. Tested backups are your best protection.
- Credential stuffing: automated attempts to log in using passwords leaked from other websites. A password manager and MFA stop most of these.
- Unpatched software: attackers scan for systems with known, fixable weaknesses.
Signs something may be wrong
Unexpected password reset emails, MFA prompts you did not trigger, mail rules you did not create, customers receiving odd emails from you, slow or locked devices and unfamiliar software are all reasons to act quickly. Change passwords from a clean device, check mailbox rules and sign-in history, and call someone who can investigate properly.
Security is a habit, not a project
Set a calendar reminder to review accounts, check backups, remove old users and look at updates every quarter. Small, regular checks do more than a one-off clean-up that is then forgotten.
Frequently asked questions
Do small businesses really get attacked?
Yes. Many attacks are automated and indiscriminate, so size is not protection. What matters is whether the basics are in place.
Is antivirus enough?
No. Antivirus is one layer. MFA, updates, backups and staff awareness matter at least as much.
Can you review my security?
Yes. Security and GDPR compliance covers VPNs, MFA, firewalls and intrusion detection, vulnerability reviews and staff security awareness training, on-site across Cambridgeshire and remotely across the UK.
Want help with cyber security for small businesses?
Call me and we will talk through your setup and what a review would cover.