Cybersecurity gets overcomplicated very quickly. Small businesses are often told they need more tools, more dashboards and more policies, but the biggest gains usually come from getting a handful of basic controls right and making sure somebody is actually looking after them.
The aim is not to make a small business look like a bank. It is to reduce the chance of the common incidents that cause the most disruption: compromised accounts, stolen passwords, malicious email, unpatched devices and data that cannot be recovered when something goes wrong.
Start with the controls that stop the common problems
The Australian Cyber Security Centre recommends small businesses start with practical basics such as multi-factor authentication, software updates and backups. That is a good place to begin because these controls deal with a large amount of everyday risk before you get into more advanced security work.
Photo by Compagnons via Unsplash.
1. Multi-factor authentication
MFA should be enabled anywhere a stolen password could give an attacker access to business email, files, cloud applications or administration systems. Microsoft 365 is an obvious one, but it should not stop there if other important services are in use.
It is also worth remembering that simply saying “we have MFA” does not automatically mean every authentication path is covered. The configuration still matters.
2. Keep devices and software updated
Updates are not exciting, but they are one of the most useful security controls a business has. Computers, browsers, phones, networking equipment and business applications all need a sensible patching process rather than relying on somebody remembering to click update occasionally.
3. Back up the things the business genuinely needs
A backup is only useful if the business can recover what it actually relies on. That means knowing where important information lives, what is already protected by the application provider, what needs separate backup, and whether a restore has been tested.
For many businesses that includes Microsoft 365 data as well as files, servers or line-of-business systems. Backup and recovery should be treated as part of normal IT management, not something checked for the first time after an incident.
Email and identity are usually where the trouble starts
A compromised mailbox can be far more useful to an attacker than infecting one computer. Once they are inside an account, they may be able to read conversations, reset passwords, impersonate team members or change payment details in an existing email thread.
That is why email security, account protection and good offboarding matter so much. Old accounts should not be left active, administrators should be kept to a minimum, and unusual sign-in activity should be visible to somebody who knows what to do with it.
Photo by Mimi Thian via Unsplash.
Security tools still need somebody looking after them
Buying another security product is easy. Making sure it is deployed properly, monitored and still doing what you expect six months later is the harder part.
This is where managed security becomes useful. Endpoint protection, identity controls, email protection and security monitoring should work together, with alerts going somewhere useful rather than disappearing into another portal nobody checks.
Do not forget the boring operational stuff
Some of the most important security work does not look particularly technical. New starters need the right access, departing team members need access removed, shared passwords need to be avoided, devices need to be tracked, and somebody needs to know who is responsible for important systems.
These small gaps tend to build up over time. They are also exactly the sort of thing that gets missed when IT is only looked at when something breaks.
What should a small business prioritise first?
If we were cleaning up a typical small-business environment, the first priorities would usually be fairly simple: protect important accounts with MFA, make sure devices are patched and managed, confirm backups can actually recover the required data, remove old access, secure email, and get useful monitoring in place.
After that, the business can work through stronger controls in stages. The Essential Eight is a useful Australian baseline for doing that without trying to solve everything at once.
Cybersecurity should fit the business
A ten-person professional services firm does not need the same security program as a large enterprise. It does, however, need controls that reflect the value of the information it holds, the systems the team depends on, and the damage an account compromise or outage could cause.
The useful outcome is not the longest possible list of security products. It is a setup where the important controls are in place, somebody is responsible for them, and the business has a clear idea of what should be improved next.
Q10 provides cybersecurity and IT support to help businesses reduce risk, improve security and keep their team supported. If you want a clearer view of where the gaps are, we can review the current environment and work through the priorities in sensible stages.