13 Cyber Security Measures That Every Small Business Has to Implement

Cybersecurity has been important to businesses since the birth of the internet. But now, more employees are in hybrid and fully remote roles than ever before, and most companies rely heavily on an ecosystem of online apps and tools to help them. The risk of unauthorized breaches and the subsequent use of security software tools like secure VPNs have grown exponentially over the last decade.

Today, keeping your business safe and secure is a different ball game from what it was even just a few years ago. Yet, despite the ever-present threat of data breaches, ransomware attacks, and insidious online scams, as many as 90% of businesses aren’t ready to defend themselves.

So how can you stay safe? Read on for all the top cyber security measures that every small business should have in place to protect itself from the perils of the virtual kind.

• Get a VPN
• Install Reliable Antivirus Software
• Use Complex Passwords
• Use Password Managers
• Install a Firewall
• Install Encryption Software
• Ignore Suspicious Emails
• Limit Access to Critical Data
• Back Up Data Often
• Secure Your Wi-Fi Network
• Secure Laptops and Smartphones
• Communicate Policies to Employees
• Provide Your Staff With AI Guidelines
• Frequently Asked Questions

1. Get a VPN

VPN stands for Virtual Private Network. It’s one of the simplest and most affordable ways to hide your online activity from third parties. Here’s a quick video explaining some of the benefits.

VPNs essentially funnel your data and IP address through an encrypted server before it reaches the internet, so all of the websites you visit see the IP address of the VPN server rather than your own.

VPNs are most useful for connecting to public internet networks, like the ones stationed in coffee shops and Airbnbs. These connections are famously unsecured and cyber criminals can use them to scoop up the private data of anyone who logs onto them with relative ease. With a VPN, your new, secure connection will shield you from anyone lurking in the shadows.

Business VPNs also provide a level of protection, but their primary purpose is to forge secure connections between remote devices and company servers/networks, so employees can access resources safely and securely, wherever they’re located in the world.

There is one unavoidable downside to VPNs: Funneling your internet activity through another server (often in another country) will reduce your internet speed slightly – but the best VPNs with large, well-maintained server networks like PureVPN ensure you’ll barely notice. Besides, a slight difference in speed is a small price to pay, however, for significantly more privacy.

It’s crucial to remember that a VPN doesn’t make you completely anonymous online – that task is nearly impossible. But it’s certainly safer than not using one, and de-coupling your IP address from your traffic will make it much harder to trace you. This is why journalists and activists working under authoritarian regimes use them.

We have a guide to VPNs worth checking out if you plan to compare options. Great standalone VPNs aimed at serving an entire workforce include PureVPN’s PureDome Business VPN and NordVPN’s NordLayer.

2. Install Reliable Antivirus Software

“Malware” refers to any software designed with malicious intent, while viruses are a specific type of malware that replicates itself within a computer until it has spread through an entire system.
Another type of malware is called “spyware” and is designed to remain hidden from sight while collecting data on the business it has latched onto.

Ransomware, on the other hand, has become one of the biggest threats to businesses over the last few years. Ransomware gangs will lock businesses out of their own systems, steal their sensitive data, and threaten to publish or delete it if they aren’t paid a hefty fee. With the vast majority of consumers inclined to ditch brands that fall victim to ransomware attacks, it’s easy to see how an attack can become financially fatal beyond the recovery period. Sometimes, the reputational damage is irreparable.

Needless to say, you’ll need to be protected from all these forms of virtual warfare. A good, reliable antivirus program is a basic must-have of any cyber security system. Apart from that, anti-malware software is also essential. They work as the final frontier for defending against unwanted attacks, should they get through your security network.

They work by detecting and removing viruses, malware, adware, and spyware. They also scan through and filter out potentially harmful downloads and emails. Some modern antivirus programs offer ransomware protection, which is killing around one American every month one 2024 study found.

3. Use Complex Passwords

Almost every computer and Web-based application requires a key for accessing it. Whether it is the answers to security questions or the passwords, make sure you create complex ones to make it difficult for cyber criminals to crack them. However, the time it takes to crack a password has greatly decreased due to password-cracking tools, which speed the process up significantly.

This mean it’s never been more important to have a sufficiently long password. What’s more, it has to be unique – this will ensure that if you are compromised, the damage the threat actor can do is contained to the singular account they’ve broken into. It’s also important that it’s varied, including letters, numbers, and special characters.

One tactic is to think about your account credentials as pass-phrases rather than pass-words. Using multiple words and phrases and building a sentence isn’t just more secure, it’s also surprisingly easy to remember.

Using a space before and/or after your passwords is another good idea that will throw a criminal off. That way, even if you write your password down, it would be safe as only you would know that it also needs a space at the front/end. Using a combination of upper and lower cases also helps, apart from using alphanumeric characters and symbols.

Building a sentence For answers to security questions, consider translating them into another language using free online translation tools. This may make them unpredictable and difficult to decipher, and less susceptible to social engineering.

4. Use Password Managers

So you’re using dozens of unique, complex, tough-to-remember passwords when logging into all your work software. This raises an entirely new issue: How can you quickly and easily sign in when you have to take the time to recall and type out a lengthy string of symbols every time? The answer is a good password management tool.

Password managers will track your internet use, automatically generating the correct username, password, and even security question answers that you’ll need to log into any website or service. Users will just have to remember a single PIN or master password to access their vault of login information. Many tools also support other benefits, like a password generator that guides users away from weak or reused passwords.

We’ve ranked the top options in our extensive guide to password managers. Our top pick is NordPass, thanks to great features and pricing, plus a handy browser plugin. However, it’s important to review all the providers on offer before you buy.

LastPass is one of the most widely-used providers, for example, but a 2022 security incident called the provider’s credentials as a secure password manager into question – and a further incident took place in the summer of 2023. The jury is still out on LastPass.

5. Protect Your Network With a Firewall

What separates a firewall from an antivirus program? Well, a firewall protects hardware as well as software, making it a boon to any company with its own physical servers. But a firewall also works by blocking or deterring viruses from entering your network, while an antivirus works by targeting the software affected by a virus that has already gotten through. They work well together, in other words.

Putting up a firewall helps protect a small business’s network traffic – both inbound and outbound. It can stop cyber criminals from attacking your network by blocking certain websites. It can also be programmed so that sending out proprietary data and confidential emails from your company’s network is restricted.

Just getting a firewall isn’t enough: You’ll also have to regularly check that it’s equipped with the latest updates for software or firmware.

Top options include Bitdefender, Avast, and Norton, and many brands will include a firewall in a package with other useful security offerings such as VPNs, password managers, and automatic data backups on the cloud.

6. Install Encryption Software

If you deal with credit card data, bank accounts, and social security numbers on a daily basis, it makes sense to have an encryption program in place. Encryption keeps data safe by altering information on the computer into unreadable codes.

Encryption is designed with a worst-case scenario in mind: Even if your data does get stolen, it would be useless to the criminal as they wouldn’t have the keys to decrypt the data and decipher the information. That’s a smart security feature in a world where billions of records get exposed every month.

Top options here include Microsoft BitLocker, IBM Guardium, and Apple FileVault — they’re all high-quality, so just pick your favorite computer company and get in touch for a free trial or demo of what they have to offer.

7. Ignore Suspicious Emails and Texts

Sometimes the simplest security measures are the best: Make it a habit to never open or reply to suspicious-looking emails, even if they appear to be from a known sender. Even if you do open the email, do not click on suspicious links or download attachments. Doing so may make you a victim of online financial and identity theft through a “phishing” scam, a term that refers to a false message sent to bait the victim into freely giving their login data to the scammer.

Phishing emails are one of the more nefarious ways technology impacts our daily lives. Phishing emails appear to come from trustworthy senders, such as a bank or someone you may have done business with. Through it, the criminal attempts to acquire your private and financial data like bank account details and credit card numbers.

Nowadays, criminals are willing to go through a myriad of different digital avenues to find potential victims – and you should treat texts from unknown numbers with exactly the same, high level of caution, as well as suspicious-looking WhatsApp messages.

For further security, make sure you change your email password every 60 – 90 days. Additionally, refrain from using the same password for different email accounts, and never leave your password written down.

8. Limit Access to Critical Data

Keeping the number of people with access to critical data to a minimum such as the company’s CEO, CIO, and a handful of trusted staff is an important security method. This will minimize the fallout from a data breach, should it occur, and further reduce the possibility of bad actors from within your organization gaining unauthorized access to data.

The Principle of Least Privilege – that employees should have access to the minimal amount of company resources needed to complete their work – should be enforced at all times.

Siloing up what data is accessible – and to whom – is vital to keeping it safe from insider threats. But informing employees of the implementation of such a security method so they can take a proactive approach and alert their managers to examples of poor data hygiene is also important.

Formulate a clear plan that mentions which individual has access to which sensitive information for increased accountability, and communicate it to your entire team, so that everyone is on the same page.

9. Back Up Data Often

Your business should either manually back up all data to an external hard drive or the cloud, or simply schedule automated backups to ensure that your information is stored safely. That way, even if your systems are compromised, you still have your information safe with you – which is why it’s one of the most important security methods to implement.

This feature is frequently baked into software programs that handle sensitive data, but it won’t hurt to run an audit of all your business communications in order to ensure that no single point of failure can erase months or years of historical data.

10. Secure Your Wi-Fi Network

Say goodbye to the WEP (or Wired Equivalent Privacy) network if you still use it and switch to WPA2 (that’s Wi-Fi Protected Access version 2) instead as the latter is much more secure.

WPA2 is an increasingly common standard for online security, so there’s a good chance you’re already using it. However, some large businesses neglect to upgrade their infrastructure and will need to make a concentrated effort to roll all their operations over to a more secure network.

To protect your Wi-Fi network from breaches by criminals, change the name of your wireless access point or router, also called the Service Set Identifier (SSID). You can also ensure that you use a complex Pre-shared Key (PSK) passphrase for additional security.

11. Secure Laptops and Smartphones

Because of the ease of carrying them around, laptops and smartphones hold a hell of a lot of valuable data, and that is also the reason they are at a higher risk of getting lost or stolen. Granted, the thieves are often more interested in making a quick buck at a pawn shop than in ransoming off your business’s corporate secrets, but either way, you’ll lose access to your data and your verified device.

What steps can you take to protect a physical device? Here are the biggest options available:

• Data encryption – we mentioned business-wide encryption software earlier, but sometimes an employee neglects to encrypt the data on their device as well as on the cloud
• Password protection – Similarly, you’ll want to have a password to enter your laptop as well as one to access online accounts. Many password managers can help with this as well.
• Remote wiping – With this ability set up, a business IT manager can remotely delete the data on a misplaced device.

Finally, a company-wide employee training session detailing the best security methods for company-owned devices can be useful as well. In fact, let’s give that idea its own entry:

12. Communicate Cyber Security Measures to Employees

Having a written cyber security policy listing the dos and don’ts of using office systems and the internet is helpful, but not enough. You have to ensure that its details are communicated to and understood by your employees so that they can put it into practice.

That is the only way of making such policies effective. If you’re using new software like a business VPN, and employees don’t know how to use it correctly, they could end up putting your sensitive data stored and used by your company at risk.

With this in mind, you might want to consider bringing in a third-party consultant to check your process for any security loopholes, whether on the internet or in the physical office.

You’ll definitely want to have a process in mind for updating the entire company when changes occur, especially considering you’ll need to amend these policies regularly to keep up with the ever-more sophisticated threat landscape.

It’s also wise to provide staff with resources and information that will help keep them safe online while they’re not at work – including consumer cybersecurity software recommendations and information on processes such as how to remove their personal information from Google if it’s leaked or posted without their consent (tools like Incogni can also help with this).

13. Provide Your Staff With AI Guidelines

As you probably know, AI tools like ChatGPT are all the rage. And while they’ve proved endlessly useful for employees and helped them cut down the time they spend on mundane, repetitive, and administrative tasks, they pose a cybersecurity risk for companies.

For example, did you know that AI tools like Claude, ChatGPT, and Google’s Gemini are continuously trained using data from conversations with users? That means these companies could, in theory, access any of the data you input into their tools. So, while AI is very useful, businesses must think about the types of information they’re comfortable with employees putting into chatbots, and guidelines should be provided on the types of tasks it’s appropriate to use them for.

Without guidelines, chaos ensues. For instance, Samsung employees landed themselves in hot water by pasting their source code into ChatGPT not long after the chatbot was launched. These kinds of events have led many companies to ban their employees from using ChatGPT and other similar tools altogether.

Cybersecurity Measures: FAQs