The short answer

Yes.

Small businesses need cyber security because attackers do not need to specifically select your company before attacking it.

Many cyber attacks are automated and target thousands of accounts, websites and devices looking for weak passwords, old software or exposed systems.

A business does not need to be famous to be useful to a criminal.

What does a cybercriminal want from a small business?

Potential targets include:

• Microsoft 365 accounts
• email
• customer information
• banking information
• passwords
• invoices
• cloud systems
• business data

One compromised mailbox can be enough to cause serious damage.

For example, an attacker who gains email access may monitor conversations and attempt to redirect a legitimate payment.

What are common attacks against businesses?

Phishing

An employee receives a convincing email designed to steal a password or convince them to open something malicious.

Business email compromise

An attacker accesses or impersonates an email account to manipulate financial transactions or sensitive conversations.

Ransomware

Data is encrypted or stolen and payment is demanded.

Password attacks

Reused, weak or previously stolen passwords are tested against business services.

Exploitation of old software

Attackers scan the internet for systems running known vulnerable software.

Isn't antivirus enough?

No.

Endpoint protection is important, but cyber security is a combination of controls.

A sensible small-business baseline includes:

• MFA
• supported and patched software
• managed endpoint protection
• reliable backups
• limited administrator access
• secure Microsoft 365 configuration
• staff awareness

What is the biggest improvement most businesses can make?

Start by making account theft harder.

Enable MFA everywhere practical, beginning with:

• Microsoft 365
• email
• banking
• accounting
• domain registration
• cloud systems
• administrator accounts

Then make sure devices are patched and critical data can be recovered.

What if the business only has five employees?

The company size changes the complexity of the solution, not the need for basic protection.

A five-person company may not need a security operations centre.

But it still needs to protect its email, money, customer information and ability to operate.

Cyber security should be proportionate

Small-business cyber security does not have to mean buying every security product available.

The goal is to understand the biggest risks and implement controls that reduce them.

Good security is usually a combination of sensible configuration, reliable processes and appropriate technology.

Where should you start?

Ask these five questions:

1. Does everyone use MFA?
2. Are all devices receiving updates?
3. Can we restore important information?
4. Do staff use administrator accounts unnecessarily?
5. Would we know what to do if an account was compromised tomorrow?

If any answer is "no" or "we don't know", that is a useful place to start.

ITS Canberra helps local businesses improve cyber security without turning a straightforward problem into an enormous enterprise project.