Small Business Cybersecurity

Why this matters

The myth that "we're too small to be a target" died years ago. Cybercriminals don't target individual small businesses; they run automated attacks that hit thousands at a time and exploit whichever doors are unlocked. A residential service business holds payment information, customer access codes, employee data, and bank credentials. A ransomware event that encrypts the CRM and accounting system locks the business out of its operations for days or weeks. A wire-fraud email that tricks an office manager into changing a vendor's payment routing can cost six figures in a single transaction. According to FBI Internet Crime Complaint Center (IC3) annual reports, business email compromise is now the highest-dollar-loss cybercrime category, and small businesses are over-represented in victim counts because they have less mature defenses than enterprises.

The threat landscape for small service businesses

Each of these has a different defense; no single tool covers all of them.

The minimum viable cybersecurity program

A small service business doesn't need an enterprise security operations center. It needs to do the basics consistently. The list:

1. Strong authentication everywhere

• Long, unique passwords for every account. Use a password manager (Bitwarden, 1Password, LastPass alternative). Reusing passwords across sites is the single biggest amplifier of risk.
• Multi-factor authentication (MFA) on every account that supports it. Email, CRM, accounting, banking, social media, payment processor.
• App-based MFA (Google Authenticator, Authy) preferred over SMS-based, because SMS can be intercepted via SIM-swap.
• Hardware keys (YubiKey, Titan) for the most sensitive accounts (owner email, banking, primary admin accounts).

MFA alone prevents the majority of account takeover attempts that succeed against passwords.

2. Backups that actually work

The ransomware playbook: encrypt every file the malware can reach. If the backup is on the same network, attached to the same workstation, or accessible by the same credentials, it gets encrypted too.

The 3-2-1 rule:

• 3 copies of important data.
• 2 different storage media.
• 1 copy off-site.

Modern equivalent: production system + cloud backup + offline air-gapped backup. Test restoration quarterly - a backup you've never restored from isn't a backup; it's a hope.

3. Email security

Email is the dominant attack vector. Defenses:

• Modern business email (Microsoft 365 Business, Google Workspace) with built-in phishing and malware filters.
• SPF, DKIM, and DMARC configured on the business's own domain to prevent spoofing.
• Employee training on phishing recognition. The free CISA Stop Ransomware materials are a good starting point.
• Inbox rules audit - attackers create forwarding rules in compromised inboxes to siphon mail; check monthly.
• External-email banner flagging emails from outside the organization.

4. Endpoint protection

Every laptop, desktop, and phone is a potential entry point. Defenses:

• Modern endpoint protection (Microsoft Defender for Business, CrowdStrike, SentinelOne) on every device.
• Auto-update enabled on OS, browser, plugins. Most exploited vulnerabilities have patches available for weeks before they're used.
• Full-disk encryption (BitLocker on Windows, FileVault on Mac) so a stolen laptop doesn't equal a breach.
• Mobile device management (MDM) if technicians use phones for work - separates work data, allows remote wipe.

5. Network security

The shop's network deserves protection too:

• Firewall with current firmware. Consumer-grade routers from 5 years ago aren't adequate.
• Wi-Fi with WPA3 (or at least WPA2) and a strong password. Separate guest network for visitors.
• VPN for remote access to office systems; never expose internal services directly to the internet.
• Network monitoring at least at the level of seeing what devices are connected.

6. Vendor and SaaS security

Most data lives in third-party systems. The vendor's security is now your security. Verify:

• Vendor SOC 2 Type II or equivalent reports for major systems (CRM, accounting, payment processor).
• Vendor breach-notification commitments.
• Vendor's MFA support for your account.
• Vendor's data export capability (so you can leave if needed).

A small business with secure on-premise IT but careless SaaS choices is no more secure than the SaaS vendor's weakest moment.

Wire fraud specific defenses

Business Email Compromise (BEC) deserves its own callout because the dollar losses are catastrophic and the defenses are specific.

The pattern: an attacker compromises an email account (often the owner's or controller's), studies the communication patterns, then either:

• Sends an email from the compromised account asking the bookkeeper to wire money to a "new" account.
• Sends a spoofed email pretending to be a vendor, claiming bank account changes and supplying new routing.

Defenses:

• Out-of-band verification for any payment or banking change. A phone call to a known number (not one from the email) verifying. Always.
• Dual approval on outgoing wires above a threshold.
• Vendor management policy that requires verified contact for ACH or wire account changes.
• Training of the bookkeeper / office manager specifically on this attack pattern.
• Wire-fraud insurance as a backstop.

A bookkeeper who has been trained to never change vendor bank accounts without an out-of-band call is the highest-leverage defense against six-figure losses.

Incident response readiness

A breach will happen eventually, even with good defenses. Readiness:

References

• NIST Cybersecurity Framework 2.0 (February 2024).
• CISA Cyber Essentials toolkit.
• FBI Internet Crime Complaint Center (IC3) annual reports.
• PCI DSS v4.0.
• State breach-notification statutes (all 50 states).
• Federal Trade Commission Safeguards Rule, 16 CFR Part 314.
• KnowBe4, Proofpoint published phishing simulation research.
• Verizon Data Breach Investigations Report (annual).
• Manuall internal: Customer Data Privacy, Business Insurance Basics.