How to Keep Your Computer and Network Safe

Cyber security can sound like something only large companies need to worry about, but small businesses are often easier targets precisely because they tend to have fewer resources, less formal security and a lot of important information sitting across everyday devices, email accounts and cloud systems.

You don’t need to turn your business into a fortress, but you do need some basic protections in place.

The good news is that many of the most useful security measures are not particularly complicated. They come down to keeping software updated, protecting access to your accounts, being careful with email and links, backing up important information and making sure everyone in the business understands the basics.

Why small businesses need to take cyber security seriously

Small businesses hold far more valuable information than they often realise.

That can include:

• Customer details.
• Email accounts.
• Banking information.
• Invoices and financial records.
• Website logins.
• Cloud storage.
• Staff information.
• Passwords and account credentials.

A cyber incident doesn’t need to involve a sophisticated hacker breaking into a network. It can be as simple as someone clicking a fake login link, reusing a compromised password or losing access to an important account.

For a small business, even a relatively minor incident can mean lost time, disrupted work, recovery costs and a lot of stress.

1. Keep your operating system and software up to date

One of the simplest ways to reduce your risk is to keep your operating system, software and applications updated.

Software updates don’t just add new features. They often fix security vulnerabilities that have already been discovered.

That means delaying updates for months can leave known weaknesses open unnecessarily.

Where possible, enable automatic security updates for:

• Windows or macOS.
• Browsers.
• Microsoft 365 or other office software.
• Security software.
• Mobile devices.
• Business applications.

If you use older software that is no longer supported by the manufacturer, it may be time to replace it.

2. Use strong, unique passwords

Weak or reused passwords are still one of the easiest ways for criminals to gain access to business accounts.

A strong password should be difficult to guess and, just as importantly, should not be reused across multiple accounts.

If the same password is used for email, banking, social media and website administration, one compromised account can quickly create problems elsewhere.

A password manager can make this much easier by generating and storing unique passwords for different accounts.

3. Turn on multi-factor authentication

Multi-factor authentication adds another layer of security beyond your password.

Depending on the service, this may involve:

• An authentication app.
• A security key.
• A one-time code.
• A biometric check such as fingerprint or face recognition.

This is especially important for high-value accounts such as:

• Email.
• Banking.
• Cloud storage.
• Website administration.
• Domain registration.
• Accounting software.

If someone manages to obtain your password, multi-factor authentication can still stop them from getting into the account.

4. Protect your email account

Your email account is one of the most important accounts in your business because it is often used to reset passwords for everything else.

If someone gains access to your email, they may also be able to access your website, cloud services, social accounts and other business systems.

Make sure your email account has:

• A strong, unique password.
• Multi-factor authentication enabled.
• Recovery details that are current.
• Alerts for suspicious login activity where available.

Be particularly cautious with emails that ask you to log in urgently, reset a password, approve a payment or open an unexpected attachment.

5. Learn to recognise phishing attempts

Phishing remains one of the most common ways attackers try to get into business accounts.

A phishing message may pretend to come from a bank, supplier, Microsoft, Google, a delivery service, a client or even someone within your own business.

Common warning signs include:

• Unexpected urgency.
• Requests to log in through a link.
• Unusual payment instructions.
• Unexpected attachments.
• Email addresses that are slightly different from the real one.
• Poor spelling or awkward language.
• Requests for passwords or security codes.

If something feels unusual, don’t use the link in the message. Go directly to the official website or contact the sender another way.

6. Keep antivirus and security protection current

Modern operating systems already include useful security features, but you should still make sure the protection on your devices is switched on and up to date.

Security software can help detect malicious files, suspicious behaviour and known threats before they cause damage.

The important thing is not simply having security software installed. It also needs to be current and running properly.

7. Use a firewall

A firewall helps control network traffic coming into and out of your devices or network.

Most modern operating systems and routers include built-in firewall protection.

For most small businesses, the key is simply making sure these protections have not been disabled unnecessarily.

If you have a more complex office network, remote workers or specialised business systems, it may be worth getting professional advice about how your network should be configured.

8. Secure your Wi-Fi network

Your business Wi-Fi should be protected with a strong password and modern encryption.

A few sensible precautions include:

• Change the default router administrator password.
• Use a strong Wi-Fi password.
• Keep router firmware updated.
• Avoid sharing your main network password unnecessarily.
• Use a separate guest network for visitors where possible.

Public Wi-Fi should also be treated with caution, particularly when accessing sensitive business systems.

9. Back up important business data

Backups protect you from more than cyber attacks.

They can also save you after hardware failure, accidental deletion, theft, ransomware or a simple human mistake.

Important business information should be backed up regularly and, ideally, stored separately from the device you use every day.

Cloud-based backup systems can make this easier because the process can happen automatically.

The important point is that a backup only helps if it is:

• Recent.
• Complete.
• Stored securely.
• Actually recoverable.

It’s worth periodically checking that your backups can be restored successfully.

10. Protect mobile phones and laptops

Phones and laptops often contain access to email, banking, cloud storage and business systems, which makes them valuable targets.

Make sure business devices use:

• A PIN, password or biometric lock.
• Automatic screen locking.
• Device encryption where available.
• Remote location or wipe features where appropriate.
• Current software updates.

Don’t leave devices unlocked in public places or vehicles.

11. Be careful with USB drives and external devices

Unknown USB drives and external devices can carry malicious software.

Avoid connecting devices to your computer if you don’t know where they came from.

For business environments, it can also be useful to limit who is allowed to connect external storage devices to company computers.

12. Limit access to business systems

Not every staff member, contractor or supplier needs access to every part of your business.

Give people access only to the systems and information they genuinely need.

This is particularly important for:

• Website administration.
• Hosting accounts.
• Domain names.
• Cloud storage.
• Accounting systems.
• Social media accounts.
• Email marketing platforms.

When someone leaves the business or no longer needs access, remove their account promptly.

13. Avoid sharing login details

It can be tempting for a small team to use one shared username and password, but this makes security harder to manage.

Where possible, give each person their own account.

This makes it easier to:

• Remove access when someone leaves.
• Track who made changes.
• Use individual multi-factor authentication.
• Avoid constantly changing shared passwords.

14. Create simple security procedures for your business

You don’t necessarily need a complicated cyber security manual.

Even a few simple internal rules can make a big difference.

For example:

• All important accounts must use multi-factor authentication.
• Passwords must not be shared.
• Software updates should not be ignored indefinitely.
• Unexpected payment requests must be verified.
• Staff must report suspicious emails or login activity.
• Access must be removed when contractors or staff leave.

The more people involved in your business, the more important it becomes to make these expectations clear.

15. Protect your website as well as your computer

Small businesses sometimes protect their laptops carefully but forget that their website is another important business system.

Your website should also be kept secure.

For a WordPress website, that usually means:

• Keeping WordPress core updated.
• Updating themes and plugins.
• Removing software you no longer use.
• Using strong administrator passwords.
• Limiting administrator accounts.
• Keeping regular website backups.
• Monitoring for suspicious activity.

Outdated website software can create vulnerabilities in exactly the same way outdated computer software can.

16. Keep an eye on your accounts

Security is not just about prevention.

You also want to notice unusual activity quickly.

Pay attention to:

• Unexpected password reset emails.
• Login alerts from unfamiliar locations.
• New users you don’t recognise.
• Changes to account recovery information.
• Unexpected transactions.
• Emails being sent from your account that you didn’t send.

The sooner you notice something unusual, the sooner you can act.

17. Have a basic plan for what happens if something goes wrong

It is much easier to respond to a security incident if you have already thought about what you would do.

Your basic response plan might include:

• Changing compromised passwords.
• Signing out of active sessions.
• Contacting your IT provider.
• Contacting your bank if money may be involved.
• Restoring clean backups if necessary.
• Reviewing which accounts may have been affected.
• Letting relevant people know if action is required.

You don’t need to predict every possible situation. You just don’t want to be figuring everything out for the first time in the middle of a crisis.

What are the most important cyber security steps for a small business?

If you only focus on a few things, start with these:

• Use unique passwords.
• Enable multi-factor authentication.
• Keep software up to date.
• Be cautious with unexpected emails and links.
• Back up important information.
• Secure your email account.
• Limit access to important business systems.

Those basic measures can significantly reduce your exposure to common threats.

Do small businesses need professional cyber security support?

That depends on the complexity of your business.

A sole trader using a laptop, Microsoft 365 and a few cloud services may be able to manage many basic protections themselves.

A business with staff, multiple devices, shared files, remote access, customer databases or more complex systems may benefit from professional IT or cyber security support.

The important thing is not to assume that being small means you’re too small to be targeted.

How often should you review your cyber security?

Cyber security shouldn’t be treated as a once-off setup.

Review your key protections periodically, especially when:

• You add new staff.
• Someone leaves the business.
• You introduce new software.
• You change IT providers.
• You move to new devices.
• You receive suspicious emails or login alerts.

A simple review every few months can uncover old accounts, outdated software and access that is no longer needed.

Final thoughts

Keeping your computer and network safe doesn’t require you to become a cyber security expert.

For most small businesses, the biggest improvements come from getting the basics right and doing them consistently.

Keep your software current. Protect important accounts with strong passwords and multi-factor authentication. Be suspicious of unexpected emails. Back up your information. Limit unnecessary access. And make sure the people you work with understand that security is everyone’s responsibility.

None of those steps is particularly dramatic, but together they make your business a much harder target.