When we talk about cybersecurity, many people think of big attacks on multinationals that make the news. But the reality is that most incidents happen in small and medium-sized businesses, precisely because they tend to be less protected. The good news is that protecting yourself doesn’t require an IT department or a huge budget. With a handful of basic measures you drastically reduce the risk.
In this article we go over the bare minimum any SME should already have in place. No jargon: just sensible practices you can start applying this very week.
Passwords and two-factor: the front door
Most problems start with a weak or reused password. If the same key opens your email, your bank, and your online store, all it takes is one leak anywhere to compromise them all.
- Use a password manager: a program that creates and stores long, distinct keys for each service, so that you only have to remember one.
- Turn on two-factor authentication (you’ll see it as 2FA or two-step verification). It’s that code that arrives on your phone or in an app in addition to the password. Even if someone steals your key, they won’t be able to get in without that second step.
- Immediately change any “factory default” password on routers, cameras, or equipment.
The perfect password doesn’t exist; what exists is the habit of never reusing them and always adding a second lock.
Backups: your safety net
If tomorrow a malicious program encrypts all your files and you’re asked for a ransom, would you be able to recover your work? Backups are the difference between a scare and a catastrophe.
- Apply the 3-2-1 rule: three copies of your data, on two different media, and one of them off-site (for example, on an external server or a disk you keep somewhere else).
- Make sure the backups are made automatically. Anything that depends on someone remembering will, sooner or later, be forgotten.
- And most important of all: test the restore from time to time. A backup you can’t recover is useless.
Keep everything up to date
Software updates aren’t just about adding new features. Many times they fix security flaws that attackers already know about. Putting off an update is leaving a window open.
- Turn on automatic updates on computers, phones, and programs whenever possible.
- Don’t use operating systems or applications the manufacturer no longer maintains: they stop receiving patches and become an easy target.
- Include in this list your router, your cameras, and any device connected to the internet.
Train your team
Technology helps, but most scams come in through email and target people. A message that appears to come from the bank or a supplier asking for data or an urgent payment is the most common trick.
- Explain to your team what phishing is: fake emails or messages that imitate well-known companies to steal data or money.
- Set a simple rule: before any payment or change of bank account, confirm by phone with the usual contact person.
- Create a clear channel so anyone can report without fear if they’ve clicked where they shouldn’t have. Catching a problem early greatly reduces the damage.
Lean on free resources: INCIBE
You don’t have to do it alone. INCIBE (Spain’s National Cybersecurity Institute) offers free public help designed precisely for the self-employed and SMEs: practical guides, training, awareness kits, and security alerts. It also has a free cybersecurity helpline (017), where they advise you by phone if you have a question or suspect an incident.
It’s a good starting point to train your team and stay up to date at no cost. Taking advantage of it is one of the most cost-effective decisions an SME can make in this area.
Where to start
You don’t have to do everything at once. If you had to prioritize, start with backups and two-factor on your email: they’re the two measures that prevent the most trouble with the least effort. From there, keep closing gaps little by little.
At Bravo IA we believe in simple solutions, with your data always on your own server and no ties to any provider. If you want to know where your business stands when it comes to security, we offer a free, no-obligation audit: we review your situation and tell you clearly what should be reinforced first. Whenever you’re ready, let’s talk.