Key points
- Turn on multi-factor authentication for email and remote access first.
- Keep a backup out of the network's reach and test restores.
- Protect computers with detection (EDR) and automatic updates.
- Train staff to spot phishing and fake bank details.
- Prepare a one-page checklist for the day of an incident.
Why small businesses are targeted
Attackers don't always pick their targets: they send thousands of malicious emails and exploit the businesses that leave a door open. A small business often uses the same tools as a large one (cloud email, online banking, business software) but rarely has someone dedicated to security. Payment fraud, email account takeover and ransomware all exploit that gap.
The good news: the measures that stop most of these attacks are well known, affordable and compatible with a small team's daily work. National agencies such as France's ANSSI and Cybermalveillance.gouv.fr publish free guidance that points in the same direction as the five rules above.
1. A tested 3-2-1 backup
Backup is the last safety net when everything else fails. The 3-2-1 rule remains the reference:
- 3 copies of your data: the original and two backups;
- 2 different media, for example an office NAS and online storage;
- 1 copy off site and out of reach of the company network, so ransomware cannot encrypt it.
A backup is only worth something if it restores: schedule regular restore tests and record the results.
2. Endpoint protection beyond antivirus
Classic antivirus recognises known threats. Endpoint detection and response (EDR) watches for suspicious behaviour, such as a program encrypting files in bulk, and can isolate the computer. Add automatic system and software updates, and keep administrator rights for IT only.
3. Multi-factor authentication everywhere
Multi-factor authentication (MFA) asks for a second proof, often an approval on your phone, so a stolen password is no longer enough. Turn it on first for:
- email and Microsoft 365 or Google Workspace;
- remote access (VPN, remote desktop);
- online banking, accounting and admin tools.
4. Aware staff
Phishing, fake bank details, fake tech support: attacks target people first. Short, regular exercises work better than one annual session. The Cyber Lab offers free scenarios that take a few minutes.
5. An incident response plan
On the day of an incident, every minute counts. A one-page checklist is often enough:
- isolate the affected computer (unplug the cable, turn off WiFi);
- alert your IT provider and management;
- pay nothing and keep the evidence;
- change exposed passwords;
- restore from a clean backup;
- report the incident if personal data is affected (to the data protection authority, within 72 hours in the EU).
Three common scenarios and the rule that stops them
Typical cases to illustrate the approach: these are not client references.
- Fake bank-detail change. A "regular" supplier sends new bank details. The rule: any change of bank details is checked by phone, using the number you already have, never the one in the message. Staff awareness (rule 4) makes the difference.
- Hacked mailbox. A reused password leaks from another site; the attacker reads emails and creates a hidden forwarding rule. Multi-factor authentication (rule 3) makes the stolen password useless.
- Ransomware. An attachment opens the door and server files are encrypted. Endpoint protection (rule 2) limits the spread; the isolated backup (rule 1) lets you recover without paying.
Putting the five rules in place in a few weeks
For a business with a handful to a few dozen computers, the order that gives the most protection quickly is often:
- Week 1: inventory accounts and access, enable multi-factor authentication on email.
- Week 2: set up or check the isolated backup, run a first restore test.
- Week 3: roll out endpoint protection and automatic updates.
- Week 4: a short awareness session and a posted incident checklist.
The pace depends on the size of your estate and your tools; what matters is to deal first with what limits damage most.
Getting support on the French Riviera
AroData carries out cybersecurity assessments for small businesses in Cannes, Nice, Antibes, Mougins and Sophia Antipolis: accounts, permissions, backups and email are checked, then you receive a written, prioritised action plan. For a first idea of your level, the cyber self-assessment asks 15 questions without scanning anything. Details are on the cybersecurity page.
Frequently asked questions
Where should we start if nothing is in place?
With multi-factor authentication on email and a tested isolated backup: those two measures limit damage the most.
Is a cybersecurity audit intrusive?
No. AroData's assessment checks configurations and practices with your consent, without penetration testing. The online self-assessment gives a first view in 15 questions.
Does a small business need paid antivirus?
How the tool is managed matters more than the tool: endpoint protection with behaviour detection, monitored alerts and automatic updates protects better than antivirus installed and forgotten.
What should we do about ransomware?
Unplug the computer from the network, don't pay, alert your IT provider and management, keep the evidence, then restore from a clean backup. If personal data is affected, the authority must be notified within 72 hours under GDPR.
Where can we find official help?
Cybermalveillance.gouv.fr offers practical guides and victim support in France, and ANSSI publishes an IT hygiene guide. AroData can help you apply them.