The 5 basic cyber security controls every SME should know

When people talk about cyber security for SMEs, it is common to picture expensive tools and specialist teams. In practice, a significant part of the protection comes from five basic controls, which the UK Cyber Essentials scheme has set out in a very objective way: firewalls, secure configuration, security update management, user access control and malware protection. None of them requires exotic technology. What they do require is method and consistency.

1. Firewalls: deciding what is allowed in

A firewall works as a filter between the business's network and the internet. It blocks connections that have not been authorised and allows only the traffic that is needed. In a small business there are usually two: the one in the router or boundary device, and the software firewall on each computer.

The points that matter most:

• Change the device's default administrator password.
• Block incoming connections from the internet by default.
• Document every rule that opens up a service and remove those that are no longer used.
• Keep the firewall enabled on laptops, especially when they are used outside the office.

The topic is explored further in the article Firewalls: what does a small business really need to protect?

2. Secure configuration: removing the factory defaults

Computers, routers and systems usually leave the factory configured for ease of use, not for protection. That includes sample accounts, publicly known default passwords, services running for no reason and pre-installed applications that nobody uses.

Configuring securely means:

• Changing all default passwords before putting the equipment into use.
• Removing or disabling unnecessary accounts and software.
• Disabling automatic execution (auto-run) of media and files.
• Requiring devices to be unlocked with a password, PIN or biometrics.

Every item removed is one less door for an attacker to exploit.

3. Security update management: closing known flaws

When a manufacturer publishes a security fix, the flaw it corrects becomes known, including to those who intend to exploit it. Systems that do not receive the update remain exposed to a documented problem.

Cyber Essentials sets a useful benchmark: updates rated critical or high risk must be applied within 14 days of release. In addition, software no longer supported by the manufacturer must be removed or isolated. Read more in why keeping systems up to date is a security measure.

4. User access control: everyone with what they need

Many incidents start with a compromised credential. The more access an account has, the greater the potential damage. This control aims to limit that impact.

• Individual accounts: each person with their own user account, with no shared logins.
• Least privilege: access only to the systems and data needed for the role.
• Separate administrator accounts: used only for administrative tasks, never for reading email or browsing the web.
• Multi-factor authentication: mandatory on cloud services, such as business email and file storage.
• Removing accounts: access removed or disabled when a person leaves or changes role.

5. Malware protection: preventing execution

The last control is about stopping malicious software from running on devices. Antivirus is the best-known approach, but not the only one. It is also possible to restrict which applications can be installed, through official app stores or lists of approved software.

The key point is that protection must be active, up to date and configured to scan files and websites automatically. Even so, antivirus on its own has limits, as discussed in the article is antivirus enough?

How to turn this into a routine

Implementing the controls once is not enough. New equipment arrives, people join and leave, and manufacturers publish fixes every week. Information security for small businesses depends on periodic review, however simple.

• Review firewall rules and administrator accounts at least once a quarter.
• Check monthly whether any devices have pending updates.
• Include the removal of access in the staff leaving process.
• Confirm that malware protection is active on all computers.
• Keep an up-to-date inventory of devices and cloud services.