Small businesses hold more valuable information than they often realise. Customer details, supplier invoices and bank logins all sit on a few laptops and phones. The Australian Signals Directorate (ASD) notes that even a minor cyber security incident can have devastating impacts on a small business. The good news is that most of the basics are quick to set up.
This guide walks through the main steps from the ASD’s advice for small business. None of them need an IT department. Most can be done by the owner over a few sessions. Where something is beyond you, an IT professional or trusted advisor can help.
Secure your important accounts first
Start with the accounts that would hurt most if someone else got in. Email, banking, accounting software and your website login are the usual candidates. The ASD advises turning on multifactor authentication (MFA) where possible, starting with your most important accounts. It adds a second check on top of your password.
Where MFA is not available, use a passphrase. The ASD describes a passphrase as four or more random words, at least 15 characters long. A password manager lets you keep a different login for each important account. That way one leaked password does not open every door.
Give each person their own login
Shared logins are common in small teams, but they make it hard to know who did what. The ASD recommends giving each staff member their own account. If an account must be shared, use MFA and keep track of who has access. Change the shared login details when someone changes roles or leaves.
Access should match the job. Staff should be able to reach only what they need for their role. When someone leaves the business, remove their access. This is easy to forget during a busy week, so add it to your exit checklist.
Keep devices and software up to date
Software updates are one of the simplest protections you have. The ASD advises updating all devices, apps and software on your business network. Turn on automatic updates wherever you can. Update servers and network storage regularly too. Secure your router by changing its default password.
Use antivirus and ransomware protection on your computers. The ASD notes that many small businesses can stay protected with Windows Security. Old devices need care too. Before you sell, donate or throw out a laptop or phone, wipe it with a factory reset.
Physical security matters as well. Keep devices somewhere secure and set them to lock automatically. Use a passphrase, PIN or fingerprint to open them. A lost phone with no lock gives a stranger your email.
Look after your website
For many businesses the website is the shop front. Our article on why you should be using a responsive website looks at design. Security deserves the same attention. The ASD suggests protecting the website login with MFA or a strong password. Keep your plugins updated and keep backups of the site.
A hacked site can undo a lot of work. Time and money spent on organic and paid digital marketing is wasted if visitors land on a broken or compromised page. Ask whoever manages your site how often it is updated and backed up. If nobody knows, that is your answer.
Back up your files
Backups are your safety net if ransomware or a hardware failure strikes. The ASD advises making a plan to back up your files regularly or turning on automatic backups. Know what data you hold and where it is stored. Keeping it in a secure central location makes backups simpler.
If you hold customers’ personal information, you also need to understand your legal obligations. The ASD points small businesses to this as part of looking after data. Store only what you need. Less data on file means less to lose.
Watch for fake invoices and payment changes
Business email compromise happens when a criminal uses a hacked or fake email account to trick a business into paying them. The ASD describes a construction business that paid an invoice of more than $70,000 after an email arrived with new bank details. The email was fake, because the supplier’s own account had been hacked. A second payment went out by mistake, and the business was unable to recover more than $150,000.
The lesson is simple. Any change to a supplier’s bank details should be checked by phone, using a number you already have. Do not use the contact details in the email asking for the change. Businesses that pay suppliers often, including those relying on outside freight management, should build this check into their accounts process.
Train your team and plan ahead
Staff are often the first to spot something odd. The ASD suggests making time for regular training and including it in the induction for new staff. Keep the training practical and talk about real risks like fake invoices. Encourage people to speak up if they click something they should not have.
Write down a simple emergency plan as well. List the threats you face, their likely impact and how you would respond. Keep a printed copy in case your systems go offline. Test the plan with your staff so everyone knows their part.
If you are just starting out, it is easier to build these habits early. Anyone working out what you need to start a transport company, or any other small business, can add cyber security to the setup list. The ASD small business cyber security guidance is free to read and covers each of these steps in more detail. It also mentions the ASD’s free alert service for small businesses.
Frequently asked questions
What is the first thing a small business should do?
Start with your most important accounts, such as email and banking. The ASD advises turning on MFA where possible, beginning with those accounts. Where MFA is not offered, use a long passphrase. A password manager makes it easier to keep a separate login for each account.
What makes a good passphrase?
The ASD describes a passphrase as four or more random words. It should be at least 15 characters long. The ASD calls it a more secure version of a password. Use a different passphrase for each important account.
How often should we back up our files?
The ASD advises creating a plan to back up files regularly, or turning on automatic backups. How often depends on how much work you could afford to lose. Automatic backups remove the need to remember. Check now and then that a backup can actually be restored.
What should we do if a supplier emails new bank details?
Do not pay until you have checked the change. Call the supplier on a number you already have, not one from the email. The ASD case study shows how costly skipping this step can be. If you need more help, talk to an IT professional or trusted advisor.
This is general information only. For advice that fits your setup, speak with an IT professional or trusted advisor.
