Cybersecurity Basics for a Small Shop

Why this matters

A small service shop thinks it is too small to be a target. It is exactly the right size to be one. Attackers do not pick you by name, they sweep for easy doors: a reused password, an unlocked email account, a wire-transfer request that looks like it came from a supplier. The damage is not abstract. It is a drained operating account, a locked-up scheduling system on your busiest week, or a customer list in the wrong hands. You do not need an IT department to close most of the easy doors. You need a handful of habits that stop the cheap attacks, which is most of them.

The threats that actually hit small shops

Forget the movie version. The attacks that land on shops like yours are mundane and a few in number.

• Phishing. An email or text that looks legitimate and tricks someone into giving up a password or clicking a bad link. This is the front door for most breaches.
• Business email compromise. Someone gets into an email account and sends a fake invoice or a "change our bank details" request to your bookkeeper. The money leaves looking like a normal payment.
• Password reuse. One password used everywhere means one leaked password unlocks everything.
• Ransomware. Software that locks your files and demands payment. Often arrives through the same phishing door.

Notice they overlap. Close the email and password doors and you have shut out most of the list at once.

The high-value basics, in priority order

If you do nothing else, do these, top to bottom. The first two stop the majority of real attacks.

1. Turn on two-factor authentication everywhere it is offered. Two-factor means a password plus a second proof, usually a code on your phone. With it on, a stolen password alone is useless. Start with email and banking, then everything else. This is the single highest-payback security step there is.
2. Use a password manager and stop reusing passwords. A password manager makes one strong, unique password per site and remembers them so nobody has to. It kills password reuse, which kills the domino effect.
3. Keep things updated. Phones, computers, and apps. Updates patch the holes attackers use. Turn on automatic updates so it happens without anyone remembering.
4. Back up your business data, off-site and automatic. Ransomware loses its leverage when you can restore from a backup it cannot reach. See related: Backing Up Your Business Data.

This short list, done, puts a small shop ahead of most. Perfect is not the goal. Closing the cheap doors is.

Train the humans, because they are the target

Tools do not get phished, people do. The most important security control in a small shop is a crew that pauses before clicking.

• Teach the pause. Any message that creates urgency and asks for money, a password, or a click deserves a second look. "Pay this now," "your account is locked," "the boss needs gift cards." Urgency is the oldest trick in the book.
• Verify money changes out of band. A request to change bank details or wire funds gets a phone call to a known number before anyone acts, never a reply to the email. This one habit stops business email compromise cold.
• Make it safe to report a mistake. A tech who clicked a bad link and admits it fast lets you contain it. One who hides it out of fear lets it spread. No blame for reporting.

Lock down the accounts that matter most

Not every account is equal. Put the heaviest protection on the few that would hurt most.

• Banking and payments. Two-factor on, separate strong password, and a short list of who can move money.
• Email. The skeleton key. If someone owns your email, they can reset every other password. Protect it like the bank.
• Your scheduling and customer system. Losing access on a busy week is its own emergency. Two-factor and a known recovery path.

When someone leaves the shop, shut off their access the same day. An ex-employee's live login is a door you forgot to lock.

Wi-Fi, devices, and the small stuff

A few quieter habits that close the remaining gaps.

• Lock every phone and laptop with a PIN or fingerprint. Field phones get lost; a locked one is a brick to a thief, an open one is your whole business.
• Separate guest Wi-Fi from the network your business runs on, so a visitor's device is never on the same network as your office computers.
• Be careful on public Wi-Fi. Treat coffee-shop and hotel networks as if a stranger can see the traffic, because sometimes they can. Avoid banking on them.

The mental model to keep

You are not trying to beat a determined, targeted hacker. You are trying to not be the easy one. The attacks that hit small shops are cheap and automated, and cheap attacks are stopped by cheap defenses: two-factor on, unique passwords, updates on, backups running, and a crew that pauses before it clicks. Do the basics and you fall off the easy-target list, which is where almost all the damage lives.

References

• Cybersecurity and Infrastructure Security Agency (CISA), cyber basics for small business
• Federal Trade Commission (FTC), small business cybersecurity guidance
• U.S. Small Business Administration (SBA), strengthen your cybersecurity
• See related: The Customer Data You Store: Protecting It; Backing Up Your Business Data