The Handful of Controls That Do Almost All the Work

Small business owners frequently believe they are too small to be attacked. That is a reasonable inference from how attacks are described and it is wrong, because it assumes someone chose you.

Most attacks on small organisations are not targeted. They are automated. Systems scan continuously for exposed services, known vulnerabilities and reused credentials, and they act on whatever they find. Nobody decided your business was worth attacking; a program found a door.

What that changes about the analysis.

Being uninteresting provides no protection, because nothing evaluated whether you were interesting.

You are attacked at the same rate as anyone with a similar exposure, and you have fewer defences than a large organisation, which makes you a better outcome for the same effort.

And the second common route in is your relationships. Small businesses are attacked as a path to a larger customer, and small businesses handling other people's money or data are attacked for that. An accountant, a bookkeeper, a lettings agent and a small law firm all hold material worth more than their own turnover suggests.

The practical consequence for how to think about this. The question is not who would attack us. It is what is exposed, and what would happen if it were taken.

And the encouraging part, which the rest of this lesson develops. Because most of what reaches a small business is opportunistic rather than crafted for you, a small number of basic controls removes a disproportionate share of the actual risk. You are not defending against a determined adversary who has chosen you. You are trying not to be the easiest available option.

Security marketing describes a vast landscape of threats. What actually happens to small organisations is a short list, and knowing it tells you where to spend.

Account compromise. Someone gets into an email account, usually through a reused password or a phishing page. This is the most common incident by a wide margin, and it leads directly to the next one.

Payment fraud. Once inside an email account, an attacker watches for invoices, then sends the customer amended bank details, or intercepts a supplier's invoice and changes the account. The money goes and does not come back. For most small businesses this is the largest realistic financial loss.

Ransomware. Files encrypted, a demand made, operations stopped. Less common than account compromise but far more damaging when it happens, because it stops the business rather than costing it money.

Data loss without any attacker. A failed drive, a deleted folder, a laptop left on a train, a departing employee taking a mailbox. This is more common than any deliberate attack and it is the easiest to prevent.

And website compromise, where a site running outdated software is taken over and used to host something, damaging reputation and search standing.

What is largely absent from that list. Sophisticated intrusions, novel exploits, and the nation-state activity that dominates security coverage. Those exist and they are not what happens to a business of twelve people.

The planning consequence is direct. Defences should be chosen against those five, in roughly that order, and anything sold on the basis of a threat not on that list should be treated sceptically until the basics are done.

The controls that matter, ordered by how much realistic risk each removes per unit of cost and effort.

Multi-factor authentication on email, and then on everything else. This single control addresses the most common incident directly, because a stolen password stops being sufficient. If a small business does exactly one thing, this is it. Phishing-resistant methods such as passkeys or hardware keys are better still, since codes can be relayed through a proxy page.

Backups that are tested and that an attacker cannot reach. Backups address ransomware and every form of accidental loss at once. The critical property is separation: a backup connected to the same systems gets encrypted along with everything else.

Updates, applied automatically. Most automated attacks use vulnerabilities that were patched months earlier, so keeping software current removes a large share of opportunistic compromise for no ongoing effort.

A payment verification procedure, from the security awareness cursus. Bank detail changes verified with the counterparty on a number held beforehand. This addresses the largest financial loss directly and costs nothing.

A password manager, so that credentials are unique per service. This stops one breached service from opening the others, which is how most account compromise actually propagates.

And removing access when people leave, which is unglamorous and routinely forgotten.

The shape worth noticing. All six are cheap, none requires expertise, and together they address every item on the list of what actually happens.

Backups are the control that determines whether an incident is an inconvenience or the end of the business, and most small businesses believe they have working backups when they do not.

The long-standing rule of thumb is to keep three copies of your data, on two different kinds of storage, with one held somewhere else. The point of the last part is separation: a fire, a theft or an attacker that reaches your systems should not reach every copy.

The three ways small business backups fail in practice.

They are connected. A backup drive plugged into the machine, or a network folder the same accounts can write to, will be encrypted along with everything else. Ransomware operators specifically look for and destroy reachable backups, because that is what forces payment. A backup needs to be somewhere your normal credentials cannot delete it.

They are not tested. A backup that has been running for two years and has never been restored is a hypothesis. Failures are routine: the job stopped six months ago, the new folder was never included, the files are there but unreadable. A restore test twice a year converts a hypothesis into a fact, and it is the single most valuable hour in this lesson.

And they do not cover what matters. Backing up files while ignoring the email account, the accounting system, the customer database and the website means the recoverable part is the least important one. Cloud services are frequently assumed to be backed up and frequently are not, in the sense that matters: many providers protect against their own failure rather than against you deleting something and noticing eight months later.

The practical instruction. Write down what would need to be restored to reopen the business, then confirm each item is actually covered and actually restorable.

Advice for small businesses usually consists of adding things. It is more useful to say what can be skipped, because a list of forty controls produces zero controls.

What is genuinely optional at this size, until the basics are complete.

A security operations centre, threat intelligence feeds, and anything monitoring for advanced adversaries. You do not have the staff to act on alerts, and the threats being monitored for are not the ones that will reach you.

Most security certifications, unless a customer requires one. Certification demonstrates security to buyers; it does not create it, and pursuing one before the basics are done inverts the order.

Penetration testing, before you have applied the patches a test would tell you to apply. A report listing findings you already know about is an expensive way to feel serious.

Written policies nobody reads. A twelve-person business needs decisions, not a policy library. One page of actual rules beats forty pages of framework language.

And separate tools for every category of risk. Consolidation is usually better at this scale, both for cost and because each tool has to be understood to be useful.

What is not optional. The six controls from the diagram, and knowing what you would do in the first hour of an incident, which the next lesson covers.

The underlying point is about sequencing rather than about dismissing anything. Every item in the optional list is worth doing eventually, and doing any of it while lacking multi-factor authentication and tested backups is buying a second lock for a door that is standing open.

Small businesses have security properties that are better and worse than large organisations, and the differences are worth using deliberately.

What is better. Everyone knows everyone, so an unusual request from a colleague is genuinely easier to check. Communication is direct. Decisions can be made in an afternoon rather than through a committee. And there is no bureaucracy between noticing a problem and fixing it.

What is worse, and each of these needs a specific answer.

No separation of duties. In a business of eight people, the person who raises an invoice may also approve the payment, which removes the control that defeats most payment fraud. Where headcount makes real separation impossible, a partial version still helps: the owner sees every payment above a threshold, or two people are required for any new payee.

Shared accounts. Common because licences cost money, and they destroy accountability, survive departures, and cannot be protected individually. This is worth paying to fix.

Everyone is an administrator. Convenient, and it means any compromise is total. Ordinary work should happen on ordinary accounts.

No cover. When the one person who understands the systems is unavailable, nothing can be done. Written access records and a second person who knows how things work is business continuity rather than security, and it matters more than most controls.

And the owner as the weak point. The owner typically has access to everything, is the most public individual, is the most targeted, and is the least likely to be challenged by staff. A small business where the owner is exempt from the rules has a single point of failure that is also the most attacked.

A category small businesses consistently under-examine: the people and companies who have access to your systems.

Who typically has it. The web developer who built your site and still has the login. The bookkeeper with access to your accounts. The IT contractor with administrative access to everything. Software vendors whose products connect to your data. The marketing agency with access to your customer list and your social accounts. And former employees whose access was never removed.

Why this matters more than it appears. A compromise of any of them is a compromise of you, and you have no visibility into their security. Attacks against service providers as a route to their customers are a well-established pattern precisely because one compromise yields many targets.

What is proportionate at this scale, without becoming a procurement function.

Know the list. Write down who has access to what. Most small businesses cannot produce this, and the exercise itself usually finds two or three accounts that should have been removed years ago.

Remove what is not needed. The developer who finished the project two years ago does not need standing administrative access.

Give the minimum. A bookkeeper needs the accounting system, not the email account.

Ask two questions of anyone holding your data: do you use multi-factor authentication, and what happens if you are breached. The answers are informative, and the fact that you asked changes how seriously they treat your account.

And for anything critical, know how to revoke access yourself, immediately, without needing the provider's cooperation. That capability is what matters on the day a relationship ends badly.

Everything in this lesson, arranged as something achievable rather than as an aspiration.

First hour. Turn on multi-factor authentication for email, for every account. Then for banking, accounting, and anything holding customer data. Use an authenticator app or a passkey rather than text messages where the option exists.

Second hour. Install a password manager and move the accounts everyone shares into it. Change any password used in more than one place, starting with email.

Third hour. Check that backups exist for each of: files, email, accounting, customer records, website. Find out where each backup lives and whether your normal login can delete it. Fix whichever answer is wrong.

Fourth hour. Restore something. Pick a file and a mailbox and actually recover them. This is the step everyone skips and it is the one that tells you whether the previous hour was real.

Fifth hour. Turn on automatic updates everywhere: computers, phones, website software, network equipment.

Sixth hour. Write the access list. Every person and company with access to any system, and what they can reach. Remove what is not needed, especially anyone who has left.

Seventh hour. Agree the payment rule with whoever handles money, in writing: no bank detail change is actioned without a callback to a number held beforehand, and no exceptions for urgency.

Eighth hour. Write the one page the next lesson describes, so that an incident does not begin with working out who to call.

That is a working day, spread over a weekend, and it removes most of the realistic risk to a small business. Almost none of it costs anything beyond the password manager, and the value is concentrated in the first four hours.