IT security for small businesses: the basics you shouldn't skip

For a small business the biggest risk is usually not a sophisticated attack. It's the missing basics: the same password used everywhere, a backup nobody has ever tried to restore, email without two-step verification.

Many incidents can be avoided with a few habits that cost little and only need setting up once. Backups, HTTPS and website updates are the part we look after with website hosting and support.

1. Real backups, tested

A backup is your insurance if a virus locks your files or a computer breaks. A simple and widely used rule is 3-2-1:

• 3 copies of your data
• 2 different media, for example a drive in the office and a cloud service
• 1 copy off site

What to back up: shared documents, email, management software data, invoices.

What is not a backup: a synced folder (delete a file and it disappears from the cloud too) or two mirrored drives (if a virus encrypts the files, they're copied encrypted).

Above all: an untested backup doesn't count. Every so often, restore a few files and check they open.

2. Two-step verification where it matters

A password, however long, doesn't protect you once it's stolen. Two-step verification (a code on your phone as well as the password) makes it much harder to get in with a stolen password. Turn it on at least for:

• email
• banking and tax portals
• management and accounting software
• website, hosting and domain accounts: losing the domain means losing your website and email
• social profiles and your business's Google listing

An authenticator app or a physical key is best. Text messages are better than nothing, but not enough for the most important accounts.

3. A password manager

A spreadsheet with every password shared between colleagues is one of the most common risks. A password manager solves three problems:

• everyone has their own passwords, long and different for each service
• shared passwords live in a shared vault
• when someone leaves, you remove their access without changing everything

4. Updates and alerts

Keep computers, phones, programs and your website up to date: updates close known holes. And don't ignore the suspicious sign-in alerts that email and online services send you: that's what they're for.

For the websites we build, backups, the HTTPS certificate and technical updates are included in the yearly renewal.

5. Watch out for suspicious emails

Many attacks start with an email that looks genuine: a fake courier, a fake bank, a fake supplier changing their bank details. Three rules to share with the people you work with:

• don't open unexpected attachments or links, even if the sender looks familiar
• if an email asks for money or data, check with a call to a number you already know
• if you clicked by mistake, say so straight away: the sooner someone acts, the better

Where to start

If two or more of these sound familiar, start here:

• passwords are kept in a shared spreadsheet
• only the owner has two-step verification, or nobody does
• the backup "exists", but nobody remembers when it was last tested
• nobody looks at security alerts

The first step is to list your accounts and your data: what you have, where it is, who can access it. The rest follows.