Malware can encrypt documents and bring order processing to a halt, while a stolen password can give an attacker access to your business email. How quickly you contain the damage and get back to work often depends on the preparations you made beforehand. Find out how to protect your devices, email and accounts, and make sure you can recover lost data. At the end, a short quiz will help you assess where your business stands with its security practices.
What does basic business security involve?
An attacker may try to reach business data through an infected computer or a compromised employee account. They may also impersonate a business partner and persuade someone to transfer money, without installing any malware. Your business therefore needs different safeguards to make these attempts harder.
You also need to prepare for an attack that succeeds. Employees should know who to report the problem to, while those responsible for IT need to decide how to limit the damage and safely restore operations. If documents are encrypted or deleted, you will need backups that have been tested.
To assess whether your business is prepared for these situations, look at four areas:
Hardware and software: protection against malware and updates that fix security flaws attackers could exploit.
Email: recognising scams, verifying unusual requests and reporting suspicious messages or mistakes.
Accounts and access: securing sign-ins and controlling who can use business services.
Backups: being able to recover data and resume work after an attack, a failure or accidental file deletion.
In each area, you also need to check regularly that your safeguards work and keep up with changes in the business.
Hardware and software: what does business antivirus protect against, and what do updates fix?
Malware can enter a business in several ways. It may be hidden in an attachment or an application downloaded from the internet, but it can also exploit a flaw in software you already use. Once running, it can steal information or encrypt documents so they can no longer be used. That is why devices need both protection that detects threats and regular software patches.
Security software examines suspicious content and compares it with known threats. Many products also monitor the behaviour of running applications. This makes it possible to respond to dangerous activity, such as large numbers of documents being encrypted, even if the particular malware has not been identified before. Depending on the available features, the threat may be blocked, its activity stopped and the person managing security notified.
This response reduces the risk of data loss and downtime. However, no security package can stop every attack. Its settings, whether it is up to date and whether anyone notices its warnings also matter. When the software reports a threat, the person responsible for IT should check what was detected and whether it was blocked. If protection is disabled, they need to find out why and restore it.
Updates complement this protection. Alongside new features and improvements, software vendors release security patches. These fix flaws that could let outsiders access information or run malicious commands. Such a flaw is called a vulnerability. Once it has been patched, an attacker can no longer exploit that weakness.
An older version may still work without any visible problems despite containing a known vulnerability. You should therefore not wait for something to break before updating it. Patches are needed not just for operating systems and browsers, but also for business applications and network device software. For systems used in day-to-day work, plan the installation so that a compatibility issue or restart does not cause unexpected downtime. We explain this in more detail in our guide to software updates in business.
Automatic updates make it easier to install patches regularly. However, the person responsible for IT should still check that everything went as planned. If an update requires a restart, make sure it happens so the installation can finish.
Remember that malware protection and updates should cover every computer used for work, including those used outside the office. When checking that security software works and the necessary patches are installed, include laptops used at home or while travelling, for example.
Email: how do you spot a scam and respond to a mistake?
Many scams do not require any malware to run. An attacker only needs the recipient to transfer money to a specified account or enter a password on a fake website. The attack then looks like an ordinary task: paying an invoice or opening a shared document.
A familiar sender and references to a genuine business relationship make a message more convincing. Sometimes a scammer fakes the display name or uses an email address that differs from the real one by just one character, a small change that is easy to miss during a busy day. An attacker may also take over a genuine mailbox and reply within an existing conversation. They can then see previous messages, signatures and what has already been agreed. A correct email address alone therefore does not prove that a new instruction came from the person your business actually works with.
A request to change the bank account for a payment is a good example. The invoice and amount may be correct, yet the money can still go to an attacker. Verify any such change through a separate channel, for example by calling a number already saved in your business contacts. Replying in the same email thread does not provide that assurance, because the person responding may still be the scammer.
Take similar care with messages asking you to sign in to a particular service. A link may lead to a site that looks almost identical to your business cloud storage, for example. However, any details entered there go to the owner of the fake site. Instead of clicking the link in the message, open the service from a saved bookmark or type its address into your browser. This reduces the risk of your password falling into the wrong hands.
Email filters help block dangerous messages, but some still reach their recipients. Your business therefore needs a reporting process that everyone knows, including what to do after clicking a link or following an email's instructions. Employees should know who to contact and how to reach them without using email if the mailbox may have been compromised.
Reporting an incident quickly gives your team a chance to secure the account, check the computer and warn others before they follow the same instructions. The person handling the response needs to know whether someone only opened a page or also entered a password or ran an attachment. These are different situations, so the next steps must depend on what actually happened.
Passwords and access to business services
Tricking someone into revealing a password is only one way to take over an employee's account. Another is to use details leaked from a completely different service. If an employee uses exactly the same credentials for an online shop and their work email, a breach at the retailer also puts their work mailbox at risk. An attacker can use the exposed password and email address in further sign-in attempts.
That is why every service should have its own long password that is hard to guess. A password manager helps you create and store these passwords. It lets you use different credentials without memorising every combination. However, the manager itself also needs protection: a strong master password and an additional verification step, if it supports one.
A unique password limits the impact of a breach at another service, but an attacker can still trick you into revealing it. Multi-factor authentication, or MFA, adds another safeguard. Once enabled, it requires an extra step when signing in, such as entering a code from an app or approving a request on your phone. Someone who only knows the password will therefore still be unable to sign in. This is especially important for email, which holds messages from customers and links for recovering other accounts.
Remember that this extra verification step still requires your attention. A code entered on a fake website can be passed to a scammer. You should also never approve a sign-in attempt you did not initiate. If these requests appear unexpectedly, report them so someone can investigate.
If an attacker takes over an account despite these safeguards, they gain access to the data and functions available to its owner. That is why access permissions should be limited to what each person needs for their role. This way, taking over one account does not automatically let an attacker change settings for the whole business or use all its resources.
Revoking access when someone leaves is just as important. Returning a laptop does not close an account in an email service, cloud platform or sales application. Include every service the employee or contractor was given access to, including those that work independently of the main business account. You may also need to invalidate active sessions.
Backups: what determines whether you can recover your data?
Backups let you recover business data after a failure, accidental deletion or an attack. They should cover everything employees need to resume work. Restoring documents alone will not get an order management application running if its database is missing, for example.
You also need to make sure an attacker cannot destroy the backups along with the originals. If a backup is stored on a drive that stays connected, malware may encrypt its contents too. That is why at least one copy should be isolated from business devices and accounts, for example on a disconnected drive or in an independently managed service that protects it from modification and deletion.
Do not confuse a backup with a synchronised cloud folder. Synchronisation carries changes between devices, so a deleted or corrupted document may affect the other copies too. Version history and the recycle bin can help undo some of these changes, but you need to know their limits: how long versions are retained, for example, or whether someone who takes over the account could delete them.
How often you create backups depends on how quickly information changes and how much of it the business can afford to lose. If the order database is only backed up in the evening, an afternoon failure could mean losing data recorded throughout the working day. If that loss would be unacceptable, shorten the intervals between backups.
Ultimately, what matters is whether your business can use the backups it has made. That is why you need to run recovery tests in a safe location, without overwriting current work. A test lets you check whether the documents are complete, whether the restored application works and how long it takes to get it running. Even an up-to-date backup will not let you resume serving customers quickly if recovery takes longer than your business can afford.
And if you want to learn more about creating and storing backups, read our article: Business backups: how to protect data from hardware failure and ransomware.
Business security checklist
To help you review your business security measures, we have put together a short checklist of the main recommendations.
Hardware and software
Is security software active on all computers and mobile devices used for work?
Does protection also cover devices used for work outside the office?
Does someone check threat alerts and respond appropriately?
Are updates for systems, applications and network devices installed regularly and correctly?
Is filtering for dangerous messages enabled?
Does every employee know who to report suspicious messages and any mistakes to?
Do employees know how to verify unusual requests received by work email?
Can problems also be reported without using business email?
Accounts and access
Does every service have its own unique, long and complex password?
Is an additional sign-in verification step enabled wherever it is available?
Are employees' permissions limited to what they need for their roles?
Is access to every business service revoked when someone leaves?
Are active sessions invalidated when necessary?
Backups
Do backups cover all the data needed to resume work?
Does the backup schedule reflect how much recent work the business can afford to lose?
Are backups protected from destruction?
Are data recovery tests carried out?
Do you know how long it takes to restore the files, settings and applications you need?
How far has your business come with security? Take the quiz
Is your business still establishing the basics, putting them into everyday practice or already using them regularly and checking that they work? Find out! Answer a few questions, choosing one response for each that reflects your current situation. If you do not know something, choose the option that says so. That is valuable information too.
Remember that this quiz is an initial self-assessment, not a full security audit. Even a favourable result does not rule out a serious gap in one area. Treat it as a first step towards taking better care of security in your business.
Need help protecting your business?
If you are unsure whether the safeguards described here work in your business, get in touch. We will help you work out what to check and which changes to make first.
To protect your computers and servers, we can offer Bitdefender GravityZone. As an authorised partner, we will help you choose a package that suits your business and put it into use. You can try it for 30 days before buying.
Alongside antivirus protection, you also need backups, rules for granting access and a team prepared to respond to threats. If you want to find out how to bring these elements together in your business, get in touch.
