Cybersecurity: 10 essential habits to protect your small business

A small business is not "too small to interest hackers". Quite the opposite: attacks are largely automated and target the least protected first. The good news is that a few habits are enough to avoid most incidents.

1. Turn on two-factor authentication everywhere

Email, online banking, social media, hosting, business tools: enable two-step verification (an authenticator app rather than SMS where possible). A stolen password is then no longer enough to get in.

2. One unique password per service

Reusing the same password hands over every door with a single key. Use a password manager (Bitwarden, 1Password, KeePassXC…) to generate and remember long, different passwords.

3. Install updates without delay

Operating systems, browsers, websites, servers: most attacks exploit flaws that have already been fixed. The recent php2shell vulnerability is a good example. Turn on automatic updates whenever possible.

4. Follow the 3-2-1 backup rule

3 copies of your data, on 2 different media, 1 of them off-site (or offline). Above all, test restoring regularly. A backup that has never been restored is just a hope.

5. Beware of phishing

Fake delivery emails, fake mobile money payment messages, fake bank advisers on WhatsApp: when you see unusual urgency, a shortened link or a request for a code, stop and check through another channel. No legitimate service will ever ask for your verification code.

6. Separate your networks

Guest Wi-Fi must never give access to your computers, cameras or server. An isolated guest network (VLAN) and a properly configured firewall greatly limit the damage. See our interactive network diagram.

7. Limit admin rights

Everyone works with a standard account; administrator accounts are only for administration. Disable the accounts of people leaving the company immediately.

8. Protect computers and phones

Up-to-date antivirus, disk encryption (BitLocker, FileVault), automatic screen lock, and a passcode on work phones. A stolen laptop must not turn into a data leak.

9. Secure your website

HTTPS everywhere, up-to-date CMS and plugins, admin accounts protected by two-factor authentication, automatic backups and monitoring. Your website is often the first visible entry point.

10. Prepare your response plan

Who do you call during an incident? How do you isolate an infected computer? Where are the backups? Writing a one-page procedure before an incident saves precious hours on the day.

What about your obligations?

Your customers' data is protected by law: in Cameroon by Law No. 2024/017 on personal data protection, in Quebec by Law 25, and in Europe by the GDPR. Securing your systems is also how you meet these obligations.

Where to start?

If you only do three things this week: turn on two-factor authentication for your email, check that your backups can be restored, and install pending updates. To go further, our team carries out security audits and helps businesses put these measures in place: let's talk.