Cybersecurity basics: essential best practices for small businesses

Many people assume cyberattacks mainly target large companies. In reality, small organizations are frequent targets, precisely because they are less protected. The good news: a few simple habits are enough to rule out most common risks.

Strong passwords, and a password manager to remember them

A password reused across several services is an open door: if it leaks from one website, it can be tried everywhere else.

• Use a different password for every service, ideally a long one (a passphrase made of several words is stronger than a single complicated word).
• Let a password manager remember them for you: it generates them, stores them encrypted and fills them in automatically.
• Never share login details by email or message. If several people need access to a tool, create separate accounts.

Turn on two-factor authentication

Two-factor authentication adds a second check when you sign in: a code sent to your phone, an authenticator app or a security key. Even if your password is stolen, access stays blocked.

Turn it on first for your email, your banking services, your business social media accounts, your website’s admin area and your domain name.

Install updates without delay

Updates often fix known security flaws, which attackers actively exploit. Computers, phones, browsers, software, and also your website and its plugins: everything should be kept up to date. Enable automatic updates whenever possible, and replace devices that are no longer supported by their manufacturer.

Back up regularly, and test your backups

A hardware failure, a mistake or ransomware can make your data inaccessible overnight. The best protection is still a backup that is:

• regular, ideally automatic;
• stored separately, on an offline device or a service separate from your main data;
• tested: a backup you have never restored offers no guarantee.

Recognize phishing

Most attacks start with a message: a fake parcel delivery, a fake invoice, a fake message from your bank or a supplier. A few reflexes reduce the risk:

• be wary of urgency and unusual requests, especially when they involve a payment or a change of bank details;
• check the sender’s address and where links actually lead before clicking;
• when in doubt, contact the person through another channel than the message you received.

Secure your website

Your website is also a way in. Make sure it uses HTTPS, that its admin area is protected by a strong password and two-factor authentication, that unused accounts are deleted and that updates are applied. Reliable hosting and regular backups complete the picture.

What if something goes wrong?

If you are the victim of an attack, do not handle it alone. For organizations based in France, the government service cybermalveillance.gouv.fr offers an online diagnosis, tailored advice and contact with local providers. It also provides practical guides to raise awareness among your team.