Cyber Security Awareness Month for a Five-Person Business

October, for a business of five

October is Cyber Security Awareness Month, and most of the advice published for it is written for organisations with an IT department.

A business of five has no such department. It has an owner, somebody doing the books, a few staff, a website looked after by an outside company, and laptops of various ages.

For that business, a short list does most of the work. Not a policy binder, and not another subscription.

Four habits: software kept up to date, two-step login on the accounts that matter, backups that have actually been restored, and staff who know what a fake invoice or a fake login page looks like.

Where the risk actually comes from

• Old software with known holes, on a computer or the website.
• Stolen passwords, reused from accounts breached years ago.
• Lost files, from a failed drive, a theft or malicious software.
• A convincing email asking for a payment or a password.

The fourth is the one no software fixes, because nothing technical is broken. A person is persuaded to type a password into the wrong page, or to pay an invoice into the wrong account.

Updates, without waiting to be asked

Updates close holes that are already known. That is why they matter: once a fix is published, the weakness it fixes is public too.

Set computers and phones to update automatically, and restart them when they ask. A laptop that has not been restarted in a month has often not finished updating.

Windows 7 stops receiving security updates on January 14. Any office computer still running it has three months to be upgraded or replaced.

The website counts too. WordPress, its plugins and its theme need updating as often as the computers do.

A second step on the accounts that matter

Two-step login asks for a code from your phone after the password, so a stolen password alone opens nothing.

Start with email, since nearly every other account sends password resets there. Next come the domain registrar, the hosting account, the bank, and the business's Google and Facebook accounts.

Alongside it, stop reusing passwords. A password manager lets every account have its own long password without anybody memorising it, so one leak no longer opens five doors.

Backups you have restored

Most small businesses have a backup of some kind. Far fewer have ever restored one, which is the only way to know it works.

Keep at least one copy disconnected from the office computers. Ransomware, malicious software that scrambles files and demands payment, scrambles a backup drive left plugged in along with everything else.

The website needs its own backups, stored somewhere other than the server it runs on, so a failed or compromised server does not take the copies with it.

Once a quarter, restore one folder and one copy of the website to a test location, and note how long it took. That is a number to learn before a bad day, not during one.

Staff who check before they pay or log in

Two kinds of email deserve an hour with the whole team.

The first asks for money: a supplier's invoice with new bank details, or a message that seems to come from the owner asking for an urgent transfer or gift cards.

The rule for those: any change to payment details is confirmed by phone, on a number you already had, never one given in the email.

The second asks for a login: a shared document, a full mailbox, a missed delivery, each with a link to a page wanting the email password.

The rule there is to go to the service directly, through a bookmark or the app, never through the link.

Neither rule depends on spotting a fake. Both work just as well on emails that look perfect, and the good ones do.

A worked example

A commercial kitchen equipment dealer with five staff paid its refrigeration supplier each month by bank transfer, against emailed invoices.

One month the invoice came from the usual address, at the usual time, with a note that the supplier had changed banks. The bookkeeper updated the details and paid it.

The supplier's own email account had been taken over, so the message was genuine in every visible way. The payment went to an account the fraudster controlled, and the bank could not get it back.

Nothing at the dealership had been hacked. What was missing was a rule.

The dealer now confirms every change of payment details by phone, using the number in its own records.

The owner also turned on two-step login for every email account that week, so the dealer could not become a compromised supplier to its restaurant customers.

Who looks after what

In a business this size, security fails when everybody assumes somebody else has it covered.

Give one person the list: which computers update themselves, which accounts have two-step login, where the backups are and when one was last restored.

Then be clear what outside companies cover. The web company may look after the website; it probably does not look after the office laptops.

Write it on one page and review it every October. That, more than any poster, is what an awareness month is for.

Questions for your web company

The website is the part of the business most exposed to the internet, and usually the part the owner knows least about.

Ask four things: how often WordPress, its plugins and the theme are updated; where the backups are kept and when one was last restored; who has administrator logins; and what happens if the site is compromised at a weekend.

Vague answers are a reason to ask for them in writing.

The counter-case

Some businesses have less to protect. One with no online payments, no website forms and two laptops can work through this list in a morning.

Others have more. A business holding health records, card numbers or legal files has obligations beyond these four habits, and needs advice specific to its work.

None of it makes a business immune. What it does is close the easy routes in, which are the ones mass emails and automated attacks depend on.

Updates, two-step login, tested backups and two rules about email: start with those, this month.

This month

1. Turn on automatic updates on every computer and phone.
2. List any computer still running Windows 7.
3. Turn on two-step login for every email account.
4. Restore one backup to prove it works.
5. Disconnect one backup copy from the office network.
6. Agree the phone check for payment changes.
7. Ask your web company the four questions.

Step six is the one that costs nothing and prevents the most expensive mistake on the list. A two-minute call to a known number is cheap; a payment sent to the wrong account is usually gone.

Setting up the second step properly, recovery codes included, is covered in two-step login, starting with email.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.