Guide · 4 min read
Cyber security basics for small businesses
Small businesses are easy targets for scammers and ransomware. The core protections - MFA, updates, backups, firewalls and staff awareness - explained simply.
Many small business owners assume they are too small to interest attackers. In practice, most attacks are automated and opportunistic. Criminals send millions of phishing emails, scan the internet for exposed systems and try leaked passwords against every login they can find. A small business with weak defences is not singled out, it is simply the one where the door was open.
The good news is that a handful of well-understood measures stop the great majority of these attacks. This guide covers the essentials in plain language, in the order that gives the most protection for the effort, and none of them needs a large budget or a dedicated IT department on the payroll.
From $255 + GST + $30 call-out ($323.25 incl. GST)
Quick checklist
- Turn on multi-factor authentication for all key accounts
- Apply updates to computers and network equipment
- Replace devices that no longer get security updates
- Use a business firewall and close unexplained port forwards
- Separate guest Wi-Fi and cameras from staff devices
- Keep a backup ransomware cannot reach
- Remove access for former staff and contractors
- Confirm bank detail changes by phone
Multi-factor authentication everywhere
If you do one thing after reading this, turn on multi-factor authentication for email, Microsoft 365 or Google Workspace, accounting software, banking and any remote access. It means a stolen password alone is not enough to get in, because the attacker also needs a code or approval from a device the user holds. Authenticator apps are stronger than text message codes. Be wary of repeated approval prompts nobody asked for, as attackers sometimes flood users with requests hoping one gets tapped by mistake.
Keep everything updated
Attackers move quickly once a software flaw is announced, so updates need to be applied promptly across every device. That includes Windows and macOS, browsers and Office, but also the less visible equipment: the firewall or router, network switches, Wi-Fi access points, the NAS, printers and camera recorders. Devices that no longer receive updates from the manufacturer should be planned for replacement. An up-to-date list of what is on the network makes this far easier, because you cannot update what you do not know is there.
A proper firewall and network layout
The router supplied with an internet connection is designed for convenience rather than control. A business firewall lets you decide what crosses the edge of the network, set up a secure VPN for remote staff instead of exposing remote desktop to the internet, and log what happens. Inside the network, separating staff computers, guest Wi-Fi, cameras and other devices into their own segments means a compromised smart TV or visitor's laptop cannot reach the accounts computer. Old port forwards that nobody can explain should be closed.
- Remote desktop never exposed directly to the internet
- Guest Wi-Fi separated from business devices
- Cameras and other devices on their own network
- Default admin passwords changed on all equipment
- Firewall rules documented and kept to what is needed
Backups that survive ransomware
Ransomware encrypts everything it can reach, and modern variants deliberately hunt for connected backup drives and network shares. A backup only protects you if at least one copy is beyond the reach of an infected computer: offline, held by a cloud service with protected version history, or stored in a way that cannot be altered for a set period. Test a full restore so you know how long recovery really takes and that nothing is missing.
Accounts, passwords and access
Give each staff member their own login rather than sharing accounts, so access can be removed cleanly when someone leaves. Nobody should use an administrator account for daily work. Encourage a password manager so people can use long, unique passwords without writing them on notes. Check who has access to email, files, banking and line-of-business software, and remove former staff, contractors and old suppliers who still have accounts.
People are part of the defence
Most incidents start with someone clicking a link, opening an attachment or believing a convincing request. Talk to staff about phishing, invoice fraud and fake support calls, and make it easy and blame-free to report a suspicious email or a mistake quickly. Agree a rule that changes to supplier bank details are always confirmed by phone on a known number. CERT NZ publishes plain-language guidance for small businesses, and its Own Your Online site is a good place to start.
When to call a technician
Book a technician if you are unsure what is exposed on your network, if remote desktop is open to the internet, or if your firewall is just the provider's router. We will check your network and firewall, close risky ports, set up VLANs for guests and devices, configure a VPN with multi-factor sign-in, update firmware, check backups and leave a written record of the setup.
From $255 + GST + $30 call-out ($323.25 incl. GST)
Related services
Firewall & Network SecurityBusiness firewalls, VLANs and VPNs configured and documented onsite.Network Health Check & DocumentationA full check of your network, with clear written documentation.Backup Setup & Disaster RecoveryBackups that follow the 3-2-1 rule and are restore-tested.Common questions
Is antivirus enough to protect a small business?
No. Antivirus is one layer, but most attacks begin with stolen passwords, phishing or exposed services that antivirus does not address. Multi-factor authentication, updates, a firewall, sound backups and staff awareness together provide much stronger protection than any single product.
What should we do if we get hit by ransomware?
Disconnect affected computers from the network, but do not wipe them. Contact your IT support and report the incident to CERT NZ. Do not pay without professional advice, as payment does not ensure recovery. Your backups and how quickly you can restore them decide the outcome.
Do we need a VPN for staff working from home?
If staff reach anything inside the office network, such as a server, NAS or accounting system, a VPN with multi-factor sign-in is the safe way to do it. If everything they use is in Microsoft 365 or other cloud services, a VPN may not be necessary.
How do we know what is on our network?
A network health check lists every connected device, its firmware level and how it is exposed. Many businesses find forgotten equipment, old port forwards and default passwords. That list becomes the basis for updates, replacements and firewall rules.
More guides
- Still on Windows 10? The risks of not upgradingWindows 10 support ended in October 2025. Learn what that means for security, software and compliance, and how to upgrade or replace older computers safely.
- Wi-Fi not working? How to fix it at home or workWi-Fi dropping out or crawling? Work through these practical checks for routers, laptops and coverage at home or in the office, and know when to get help.
- What is mesh Wi-Fi and do you need it?Mesh Wi-Fi uses several units working as one network to cover bigger homes and offices. Learn how it works, when it helps and when cabled access points win.
- Why is my computer slow? Causes and fixesA slow computer usually has a clear cause - an old hard drive, too little memory, startup clutter or malware. Here is how to find which one it is and fix it.
- Repair or replace your computer? How to decideWeighing up a repair against a new computer? Look at the fault, its age, Windows 11 support and your data to make a sensible call for home or business use.