A hacked email account, a laptop left on the train, a fake invoice that gets paid. For a hair salon, installer or online shop these are not abstract risks. Most incidents do not start with a sophisticated attack, but with something simple that was not properly arranged.
The good news: a handful of basic measures closes the doors that are used most. They cost little, you can largely set them up yourself and they help more than an expensive package nobody understands.
Protecting accounts
Two-step verification
Turn on two-step verification for everything that matters: email, banking, accounting, your domain name, your website and your business software. Anyone who steals your password still cannot get in without the second step (a code in an app or a physical key). Start with email, because through email someone can request a new password for almost every other account.
A password manager
One password for everything is the biggest risk: if it leaks at one service, an attacker tries it everywhere. A password manager creates a long, unique password for each account and remembers it for you. Give every employee their own vault and share joint accounts through a shared folder rather than a note or a group chat.
Limiting access rights
Not everyone needs access to everything. An intern in a restaurant does not need access to the bank account and a temporary worker does not need admin rights on the computer. Give everyone their own account with only the rights that fit their work, and close accounts immediately when someone leaves.
Updates and backups
Updates
Many attacks exploit flaws for which an update already exists. Turn on automatic updates on computers, phones, the router and the software you use. Replace devices that no longer receive security updates. The same applies to your website, including the system underneath it: how that goes wrong is described in our article on the PHP flaw that took DigiD and MijnOverheid offline.
Backups following 3-2-1
A backup is only worth something if you can restore it, including after ransomware that encrypts everything it can reach. A useful rule of thumb is 3-2-1:
- 3 copies: the original and two backups.
- 2 types of storage: for example an external drive and online storage.
- 1 off-site: at least one copy that is not in the same place or on the same network, and ideally cannot simply be changed.
Test now and then whether restoring works. A backup nobody has ever restored is an assumption.
Recognising phishing
Phishing is a message that gets you to click, log in or pay for someone pretending to be someone else: your bank, a supplier, a parcel service or your own colleague. At a hotel it might be a fake booking with a link, at a garage an invoice with a changed bank account number.
- Haste and pressure: a message saying it must happen now is a reason to slow down.
- Unusual sender or link: look at the real address, not the name shown above it.
- Changed payment details: always check a new account number through a known phone number, never through the message itself.
- Login page via a link: go to the website yourself or open the app instead.
Discuss this briefly with your team, for example using a real example from your own inbox. Agree that reporting is always right, even if someone has already clicked. The sooner you know, the smaller the damage.
Your website
Your website is the part of your business that anyone on the internet can reach. At the very least, pay attention to:
- HTTPS everywhere: every page over a secure connection, including subdomains, with nothing still loading over http.
- Security headers: settings that tell the browser what is and is not allowed, such as HSTS and a Content Security Policy.
- Forms and login: check input on the server and limit the number of attempts per minute.
- Few third-party components: every plugin or extra service is code someone else maintains.
Want to know how your current site is doing? Run the free website check.
A plan for when things go wrong
You do not need a thick manual, but you do need a single sheet with answers to a few questions, so you do not have to think when it happens:
- Who do you call? your IT partner, your software supplier, your bank and possibly your insurer, with phone numbers on paper.
- What do you do straight away? take the affected device off the network, change passwords from another device and have payments blocked.
- Do you have to report it? if personal data is involved, under the GDPR a data breach generally has to be reported to the Dutch Data Protection Authority within 72 hours, and sometimes to the people affected as well.
- How do you get going again? where are the backups and who can restore them?
Frequently asked questions
Where do I start if I have little time?
Turn on two-step verification for your email and banking, and check that there is a backup stored outside your office. Those are the two measures with the biggest gain.
Is antivirus software enough?
No. Antivirus helps, but it does not protect against a stolen password, a fake invoice or a missing backup. It is one layer alongside the other measures.
What should I do if an employee has clicked a phishing link?
Change the password of the affected account immediately from another device, check that two-step verification is on and look for unusual forwarding rules or payments. If in doubt, call in your IT partner.