8 Cyber Security Essentials for SMEs in 2024

Every day, businesses find new ways to leverage digital technologies for greater convenience, continuity and productivity. If we thought our operations couldn’t be more reliant on digital tools, we’re soon proven wrong with the endless innovations on offer.

But with technology so integrated into our day-to-day lives, you would think the risks would be better known. However, more than half of users don’t even know how to check if a password has been compromised, let alone prevent it from happening. And this is just one of the very many security concerns of operating a business.

Therefore, IT security should be considered an essential business practice. By implementing the right steps now, you can prevent dangerous breaches that could prove detrimental to your brand and business in the future. But with so many digital technologies to consider, SMEs and start-ups may be wondering where to start.

Well, here are eight security steps not to skip:

Protect passwords

Passwords are often the first layer of security for your private information. Therefore, they should be carefully considered.

You have probably heard this time and time again, but passwords should not be easy to remember or re-used across sites and applications. One breach could leave data across platforms vulnerable, which could pose serious problems for a business with intellectual property or sensitive customer information.

Another thing to make a habit of is checking whether any accounts you hold have been compromised. You can use safe online tools, such as https://haveibeenpwned.com/, which keeps track of known security breaches. If any breach affects you, you can quickly react by updating passwords and notifying those impacted. Doing so can prevent any subsequent vulnerability, and assure stakeholders that you are taking proactive action in keeping your business and its information secure.

As a business, you likely hold many accounts with various platforms, sites and applications. Keeping track of passwords for these can become a burden, especially if they are being shared with different people in the company. Fortunately, there are password manager tools, such as Bitwarden or LastPass, that enable secure storage of multiple passwords, which can then be shared with users.

In the past, these tools have had a reputation for being difficult to use and tailored towards those more technically savvy. However, with increased security at the forefront of many people’s minds now, user experience has improved, making them suitable for general use, too.

Implement two-factor authentication

Adding extra security layers with two-factor authentication is becoming more common, and in some cases, a requirement by certain platforms and tools. If it’s not something you’re familiar with, it’s time to get to know.

Two-factor authentication refers to a second step in the signing-in process, beyond just a username and password. There are various ways to verify a login attempt, whether that be a verification code sent to a connected email address or phone number, or a code stored in a dedicated authenticator app, such as those on offer from Microsoft or Google.

Some password managers also have built-in two-factor authenticator functionalities, whereby unique codes are created and valid for a few seconds, so need to be promptly inputted after signing in.

While the added security layer can slow down the logging-in process, it is an essential step, particularly for a business’s highly sensitive accounts, such as with banks or email providers. Any unauthorised activity on these can leave the company vulnerable to dangerous breaches.

For business owners, where there is sometimes an overlap between company and personal accounts, it is important that both are protected by this extra security step.

Email security tips

No matter your line of business, emails more than likely play a vital role in your day-to-day activities. It comes as no surprise then, that threats and scams are often targeted at a company’s emails, with attempts to access sensitive data, money or company information.

Email threats can come in many forms, but generally, they cause harm when dangerous links or attachments are opened. Unsafe emails can often be recognised pretty easily if you pay close attention to the details. For instance, the email address might not match the sender’s name or company, and often consists of a random, or long, sequence of letters and numbers.

The URLs in these emails also tend to be misleading. For instance, a link might read www.apple.com, but the actual URL it is linked to might be different. When URLs are hidden in this way, it is usually a telltale sign that is it harmful. You can check the URL of any link in an email by simply hovering over it.

Another common email threat is scammers impersonating the CEO of a company and sending employees emails asking them to do certain tasks, such as WhatsApp a number, or purchase gift cards. Again, the authenticity of these emails can be verified by checking the email address and any links. It’s also important to ensure employees who may be targeted by such scams are aware of the signs and risks.

Businesses should implement email security measures to help protect employees and prevent the chances of any scams being missed. For instance, a security layer that scans incoming external links and attachments for phishing attempts or viruses can identify and stop users from receiving harmful messages.

Device protection

As a minimum, all businesses should have anti-virus software with internet security on all internet-accessible devices that contain company information or are used for business purposes.

However, simply having anti-virus protection isn’t enough to keep your business safe. With the amount of information that passes through our devices each day, there are even greater chances of threats. Therefore, it’s important to schedule weekly scans to keep on top of potential risks.

Not only do risks threaten sensitive company data, but dangers such as ransomware can cause significant disruption to your operations as they block access to systems until large sums of money are transferred to scammers.

Keep software updated

To conduct our day-to-day activities, we often rely on a number of third-party solutions. Think about communication tools, such as Microsoft Teams and Zoom, to information sources, including Google Chrome and Bing.

Fortunately, these third-party tools come with the benefit of leading security teams who regularly update and improve their safety in response to new and potential cyber threats. All businesses really need to do is ensure their software is kept up to date with the latest releases and patches.

While this can sometimes feel like an inconvenience, paired with a short period of downtime, the risks of not updating pose far greater threats.

One way to keep on top of updates is to keep a list of all the software used in the business by IT Security personnel and monitor any zero-day vulnerabilities that could become harmful. This way, any urgent scans or patches can be applied before it’s too late, too.

Regularly back up data

As businesses, we are largely reliant upon the information and data we have stored. Therefore, it’s important to keep it regularly backed up to ensure business continuity should there be any disruption or breach.

Cloud-based services, such as One Drive and Google Drive are foolproof ways to ensure company files are backed up. However, as mentioned previously, these solutions are only beneficial if kept updated and protected by strong passwords and two-factor authentication layers.

For data that may not be updated automatically, we recommend taking a back up on a weekly basis, at least. Or, if a significant number of changes have been made in a day or shorter period of time, a back up may be necessary sooner.

Tips for remote working

Most SMEs and start-ups now operate with a remote working policy. Whether it’s yourself, or an employee, there are some important things to consider to ensure the business is protected wherever you are.

One thing you will probably need, no matter where, is internet access. The obvious solution is using WiFi networks where possible, however, publicly accessible networks can pose significant threats to your business, and are often targeted by hackers. Therefore, it’s recommended that you opt for your own personal hotspot, with a strong password instead. Of course, this might require more data allowance, which will come at a higher price, but the financial risk to your business when using an unsafe network could end up costing you much, much more.

For additional protection, you may also want to use a VPN with a dedicated IP address. This will help increase your online privacy, making it more difficult to be hacked, particularly when using a public or shared network. You can then add more layers of protection to your company’s website, or merchant centre for e-commerce workers, by hiding the admin address behind the dedicated IP.

If working in shared spaces, it’s also important to be wary of your surroundings. For instance, avoid opening sensitive or private company data where others are able to view it. And if leaving a laptop, phone, or any other device unattended for any amount of time, ensure it is locked and password protected.

Educate employees

No matter how big or small your team, each member should be educated on the steps you as a business, and they as employees should be taking to ensure protection across all activities, devices and software. These steps should include each of the above as a minimum, and any others that are specific to your business.

As well as ensuring the business is protected, it is also important to teach teams about personal cyber security as a breach of an individual’s account or device, could in-directly impact the business.

We’re sure you already have some cyber security measures in place. However, with the ever-evolving digital landscape, it’s important to keep up to date with new security features, as well as ensure multiple layers of protection for complete peace of mind. 

As a starting basis, the steps outlined in this blog will provide your business with adequate protection. However, if you would like to speak to our team about additional security steps for your specific business, please don’t hesitate to get in touch.