Cybersecurity Basics for Small Businesses: 10 Steps That Stop Most Attacks

Small businesses often assume they are too small to be targeted. In reality, most attacks are automated: bots try leaked passwords against every email login, scan every website for outdated plugins, and send the same phishing email to thousands of addresses. The good news is that basic hygiene stops most of them.

The ten steps

1. Turn on multi-factor authentication (MFA) for email, banking, hosting, domain and social media accounts. This single step blocks most password-based break-ins.
2. Use a password manager so every account has a long, unique password. Reused passwords are how one leak becomes many.
3. Keep everything updated — operating systems, browsers, routers, website software and plugins. Turn on automatic updates wherever possible.
4. Remove access promptly when staff leave: email, shared drives, software and any shared passwords.
5. Give people only the access they need. Not everyone needs admin rights on their computer or the website.
6. Back up using the 3-2-1 rule, with at least one copy that ransomware cannot reach.
7. Train staff to recognise phishing: urgent payment requests, unexpected attachments, and login pages reached from email links.
8. Verify payment changes by phone. If a supplier emails new bank details, call them on a number you already have before paying.
9. Secure the office Wi-Fi with a strong password, and use a separate guest network for visitors.
10. Keep your website lean: remove unused plugins and themes, use HTTPS, and restrict admin logins.

If something goes wrong

• Disconnect the affected computer from the network, but do not switch it off — it may hold evidence.
• Change passwords for affected accounts from a clean device, and check email forwarding rules attackers often add.
• Contact your bank immediately if money was transferred.
• Report cybercrime at cybercrime.gov.in or by calling the national helpline 1930. Organisations covered by CERT-In directions must report certain incidents to CERT-In within six hours.