Cybersecurity for small businesses in Syria: 12 practical steps

Many small business owners assume hackers aren't interested in them: "who would target an office of ten people?" In reality, most attacks aren't aimed at a particular company. They are wide, automated attempts looking for any open door: an email account with a weak password, a router on factory settings, an employee who clicks a fake link. A small company is often the easiest target, because it has no IT department and no written policies.

The good news is that closing most of those doors doesn't need a big budget. The steps below run from the most important and easiest to the less urgent, and most can be done within a week.

1. A different password for every account, kept in a password manager

The most dangerous habit of all is using the same password for email, Facebook, the bank and the website's admin panel. When any one of those services leaks (and leaks happen constantly), the password is tried automatically on every other account.

• Use a password manager such as Bitwarden (free) to generate a long, random password for each account and remember it for you.
• The only password you memorise is the manager's own: make it a long phrase of four or five words.
• Don't keep passwords in an Excel file on the desktop or in WhatsApp messages to yourself.

2. Two-step verification, starting with email

Email is the key to everything: it's how every other account's password gets reset. Turn on two-step verification for the company email and the owner's email before anything else, then for social media, the website's admin panel and the hosting account.

An authenticator app on the phone (Google Authenticator, Microsoft Authenticator or Aegis) is better than SMS codes, which can be redirected or delayed. Keep the backup recovery codes somewhere safe, away from the phone.

3. WhatsApp: never send your verification code to anyone

Stolen WhatsApp accounts are one of the most common incidents we see. The trick is simple: you receive a six-digit code, then a message from a "friend" or "the phone company" asking you to send it over because it was "sent by mistake". Whoever gets the code takes your account, then messages your customers and family in your name.

• Turn on two-step verification in WhatsApp (Settings → Account → Two-step verification), with a PIN and a recovery email.
• There is no reason anyone else would ever need your verification code. Ever.
• Check "Linked devices" regularly and remove any device you don't recognise.
• If the company number runs on WhatsApp Business, keep it on a dedicated work phone, not a personal phone passed between staff.

4. Updates: don't postpone them

Most breaches exploit known flaws that were patched months earlier. Turn on automatic updates for Windows, the browser, the phone's system and office software. If your website runs on WordPress or a similar system, updating its plugins and themes matters as much as updating the core.

Devices that no longer receive security updates (such as Windows 7 or very old phones) shouldn't be used for email, banking or customer data.

5. No cracked software

Cracked programs shared on websites and groups are one of the most common ways malware gets into companies. The "activator" may well work, but it often brings along a program that steals the passwords saved in the browser or opens a back door on the computer.

There are alternatives: free open-source software (LibreOffice, GIMP, 7-Zip), free editions of commercial programs, or a proper licence for the programs the business really depends on.

6. Backups with the 3-2-1 rule

Ransomware encrypts a company's files and demands payment to unlock them, and failing disks and sudden power cuts destroy data too. The only sure protection is a working backup:

• 3 copies of important data (the original and two backups).
• On 2 different kinds of storage (for example an external disk and a cloud service).
• 1 of them away from the office, or not permanently connected to the network, so ransomware can't encrypt it along with everything else.

Most importantly, restore a file from the backup once a month. A backup that has never been tested may fail when you need it.

7. Watch out for phishing

A message that looks like it's from the bank, the courier or "Facebook support" asks you to sign in through a link. The giveaways:

• Urgency and threats: "your account will be closed within 24 hours".
• A link whose name is close to the real one but differs by a letter or an extension.
• A request for a password, a verification code or a money transfer.

The simple rule: never sign in from a link you received in a message. Open the website or app yourself. And if "the boss" urgently asks for a transfer by message, call to confirm before acting.

8. Separate accounts for every employee

A shared account ("we all use the same email") means you can't tell who did what, and you can't cut off someone who has left without changing the password for everyone.

• Each employee gets their own accounts for email and software, with only the access their job needs.
• When someone leaves: disable their accounts the same day, and change any shared passwords (office Wi-Fi, social media accounts).
• Administrator accounts on computers are for IT support only, not for daily work.

9. The router and the Wi-Fi

The router is the door to the whole network, and many are still on factory settings:

• Change the router's default admin password (admin/admin and the like).
• Use WPA2 or WPA3 encryption with a long password, and turn off WPS.
• Give visitors a separate guest network that can't see the company's devices.
• Update the router's firmware when an update is available.

10. Security cameras: not on the internet with the factory password

Camera recorders (DVR/NVR) with a port opened for viewing from a phone are among the most hacked devices in the world, because they stay on the factory password and never get updates. Change the password, update the device, and preferably view the cameras through the manufacturer's official app or a VPN instead of opening a port on the router.

11. Your website and its hosting

A company's website is its storefront; a hacked site means a defaced page, hidden links to shady sites or stolen form data. The minimum:

• HTTPS on every page.
• Keep the site's system and plugins updated, and delete plugins you don't use.
• A strong password and two-step verification for the admin panel, with as few users as possible.
• Backups of the site and its database, kept separately from the hosting.
• A firewall in front of the site (such as Cloudflare, which has a free plan) to block much of the automated traffic.

If you're choosing new hosting, we wrote a separate guide: Shared hosting, VPS or cloud?

12. A short plan for after a breach

Don't wait for an incident to work out what to do. Write one page with:

• Who is told first, and their phone numbers (the owner, IT support).
• Disconnect the affected device from the network straight away; if possible, don't switch it off before asking a specialist.
• Change the passwords of email and key accounts from a clean device.
• Warn customers if fraudulent messages may have reached them in your name.
• Restore from backup once the devices are confirmed clean.

Where to start this week

If you only have time for three steps, start with these: two-step verification on email and WhatsApp, a password manager, and a backup kept outside the office. Those three alone prevent most of the incidents we see.

If you'd like a full review of your company's network, devices and accounts, with a written plan in order of priority, that's what our cybersecurity service does. You can contact us to book a consultation.