Small businesses are not too small to be targeted. Criminals specifically target small businesses precisely because they tend to have weak defences compared to large organisations, yet still have valuable data and payment systems.
1. Multi-Factor Authentication on Everything
Enable MFA on Microsoft 365, Google Workspace, accounting software, banking, and any remote access tools. This single step prevents the vast majority of account compromise attacks. It takes minutes to set up and is free.
2. Proper Backup with Offsite Copy
If ransomware hits your business and encrypts everything, a working backup is the difference between a bad day and a business-ending event. Backups must include an offsite or cloud copy that is not connected to your network — ransomware frequently encrypts network-connected backup drives as well as production data.
3. Endpoint Detection and Response (EDR)
Consumer antivirus is not sufficient for business use. Modern endpoint protection platforms (like CrowdStrike, SentinelOne or Microsoft Defender for Business) detect behavioural threats that signature-based antivirus misses. Managed EDR through Computer Crew means threats are monitored and remediated without you needing to understand the technology.
4. Email Security
Configure SPF, DKIM and DMARC records for your domain. These prevent criminals from sending emails that appear to come from your domain — a common attack against your clients. Use Microsoft Defender for Office 365 or similar for phishing and malware scanning on email.
5. Keep Software Patched
Unpatched systems are the most exploited attack vector in small business incidents. Enable automatic updates for Windows, your business applications, and your router firmware. Or let us manage this for you through our managed IT service.
6. Principle of Least Privilege
Every staff member should have only the access they need for their role. Your accounts staff don't need admin rights on their computer. Limiting access limits the damage when an account is compromised.
7. Incident Response Plan
Know what you'll do if you're hit. Have your IT provider's emergency number saved. Know which systems to isolate. Know who to notify (if you store customer data, you may have Privacy Act notification obligations).
8. Staff Awareness Training
The majority of attacks start with a human mistake — clicking a phishing email, downloading a malicious attachment. Brief annual training on recognising phishing and safe practices is one of the most cost-effective security investments available.