Most small businesses do not get hacked by a determined attacker with custom tools. They get hit because a password was reused, a laptop had no backup, or someone clicked a link that looked like an invoice. The defences that stop the overwhelming majority of these incidents are unglamorous, cheap and take an afternoon.
Here are the five that matter, in the order they protect you.
1. A password manager and two-factor authentication
Password reuse is the single biggest gift you can give an attacker. One breach at a newsletter tool, and the same email and password opens your hosting, your bank and your email.
Install a password manager, generate a different password for every service, and turn on two-factor authentication everywhere it is offered — email, hosting, domain registrar, bank, and any tool that can spend your money. Use an authenticator app or a hardware key rather than SMS where you can; SIM swaps are common enough to matter.
Start with these four, because losing them is catastrophic:
- The email address you use to reset everything else
- Your domain registrar
- Your hosting or cloud account
- Your bank and payment processor
2. Backups that you have actually restored
A backup you have never restored is a hope, not a backup. The rule worth keeping is simple: three copies, on two kinds of media, with one off-site. In practice that means a local copy, an automated cloud copy, and a periodic export you keep somewhere else.
Test one restore this month. Pick a folder, delete a file by accident on purpose, and recover it. If that takes an hour of guesswork, you have found the problem before a ransomware note did.
For websites, make sure the backup covers the database as well as the files — and that you know how long a restore takes.
3. Updates, on a schedule rather than in a panic
Most successful attacks exploit a vulnerability that was patched months earlier. You do not need to update the moment a release lands; you need a routine:
- Operating system and browser: automatic
- Website platform, plugins and themes: weekly, and remove anything unused
- Router and other hardware: quarterly, or when a serious advisory appears
Delete plugins and accounts you no longer use. An abandoned plugin is an unlocked door nobody is watching.
4. Separate accounts, least privilege
Everyone in the business should have their own login, and nobody should have more access than the job requires. Shared logins make it impossible to tell who did what, and impossible to remove one person's access without changing a password everyone knows.
Contractors and freelancers should get access to the specific thing they need, with an end date. When the project finishes, the account goes.
5. A five-minute habit for suspicious messages
Phishing is still the most common way in, and it targets people, not software. Teach two habits rather than a lecture:
- Check the domain, not the display name. An invoice from "your supplier" that comes from a Gmail address is not from your supplier.
- Never act on payment details from an email. Call the known number and confirm. Invoice fraud and CEO-fraud both rely on urgency.
Make it safe to report mistakes. If someone fears being blamed, they will delay telling you — and the delay is what turns a click into an incident.
What to do if something does go wrong
- Disconnect the affected device from the network; do not wipe it.
- Change passwords from a different, clean device, starting with email.
- Tell your bank immediately if payment details were involved.
- Check your backups before restoring anything.
- Report to the relevant authority — in Pakistan, cybercrime complaints go to the FIA's cybercrime wing.
Write these five steps down somewhere offline. In the middle of an incident, nobody remembers the plan.
Checklist
- Password manager installed; unique passwords everywhere
- 2FA on email, registrar, hosting, bank
- Three copies of data, one off-site, restore tested
- Weekly update routine; unused plugins removed
- Individual accounts; access removed when work ends
- Two phishing habits taught and repeated
- Incident steps written down offline
None of this is exciting, which is why it works. Pair it with a basic privacy policy and you have covered both the technical and the legal side of holding customer data.
