Every business connected to the internet is a potential target, whatever its size. Most attacks on small businesses are not sophisticated. They take advantage of default passwords, missed updates, open WiFi and a lack of backups.
The good news is that the basics go a long way. This guide covers the practical steps you can take with your broadband, router and network, and where to go for more help.
Start with your router
Your router sits between your business and the internet, so it is the first place to look.
Change the default admin password
The admin password is what lets someone change your router's settings. It is different from the WiFi password. If it is still the one printed on the label or set by default, change it to something long and unique, and store it safely, for example in a password manager.
Use a strong WiFi password and modern security
Make sure your WiFi uses WPA2 or, where your devices support it, WPA3. Avoid older settings such as WEP. Use a long passphrase rather than a short word, and change it if you think it has been shared too widely, for example when a member of staff leaves.
Keep the firmware updated
Firmware is the software that runs your router. Manufacturers release updates to fix security flaws. Check whether your router updates automatically, and if not, check for updates regularly or ask your provider or IT support to manage it.
Turn off what you do not use
- Remote management lets the router be managed from the internet. Turn it off unless someone genuinely needs it.
- UPnP lets devices open ports automatically. It is convenient but can expose devices without you knowing. Consider turning it off if nothing relies on it.
- WPS, the push button pairing feature, is best disabled on business networks.
Review open ports
Port forwarding makes a device on your network reachable from the internet, often set up for CCTV, remote desktop or a server. Every open port is a possible way in. Close any you do not need, and use a VPN for remote access instead of exposing services directly. If you have a static IP address, this matters even more; our guide to static IP addresses explains why.
Use a firewall
A firewall controls what traffic can pass between your network and the internet. Most routers include a basic firewall that blocks unsolicited incoming connections, and it should be switched on. Computers and laptops also have their own firewalls, which should stay enabled, especially for staff who work away from the office.
Larger offices, or businesses handling sensitive data, may benefit from a dedicated business firewall with features such as content filtering, intrusion prevention and detailed logging.
Keep guest WiFi separate
If customers, visitors or contractors use your WiFi, give them a separate guest network. A guest network lets them get online without being able to see your computers, printers, tills, file shares or CCTV.
- Give the guest network its own name and password, and change the password from time to time.
- Keep staff devices, card machines and business systems on the main network only.
- Consider putting smart devices such as TVs, speakers and thermostats on a separate network too, as they are not always well maintained by their manufacturers.
Our guides to business WiFi and broadband for shops, cafés and salons cover guest WiFi in more detail.
Protect your accounts and devices
Your network is only part of the picture. Most breaches start with an account or a device.
- Use multi factor authentication on email, cloud storage, banking and anything else that offers it.
- Keep devices updated. Turn on automatic updates for operating systems, browsers and apps.
- Use antivirus protection on computers and keep it active.
- Give people only the access they need, and remove accounts promptly when staff leave.
- Train staff to spot phishing, such as unexpected emails asking them to sign in, pay an invoice or change bank details.
Back up your data
Backups are your safety net against ransomware, accidental deletion and hardware failure. A good backup routine:
- runs automatically, without relying on someone remembering;
- keeps at least one copy away from your main systems, such as in the cloud or offline, so an attack on your network cannot reach it;
- covers cloud services too, not only files on office computers;
- is tested by actually restoring files from time to time.
The Cyber Essentials scheme
Cyber Essentials is a UK government backed scheme, overseen by the National Cyber Security Centre, that helps organisations protect themselves against common online threats. It focuses on five technical controls:
- firewalls;
- secure configuration;
- user access control;
- malware protection;
- security update management.
There are two levels. Cyber Essentials is based on a self assessment that is checked by a certification body. Cyber Essentials Plus adds a hands on technical check of your systems. Certification shows customers and partners that you take security seriously, and some public sector and corporate contracts ask for it.
Many of the steps in this guide, such as changing default passwords, keeping firewalls on, applying updates and limiting access, line up with the Cyber Essentials controls, so they are a good place to start.
If something goes wrong
If you think you have been hacked, disconnect affected devices from the network, change passwords from a device you trust, and get expert help. If a breach involves personal data, you may need to report it to the Information Commissioner's Office within 72 hours of becoming aware of it, so act quickly and keep notes of what happened.
IT support from Cyber Fits
Cyber Fibre is part of the same group as Cyber Fits, which provides IT support and managed services for businesses. If you would like help securing your network, managing updates and backups, or working towards Cyber Essentials, Cyber Fits can help.
Start with a secure connection
Check your address to see business full fibre packages, including a router we can set up for you before your go live date, or contact our team in Sunderland with any questions about your connection and network.