Cybersecurity Basics for Small Businesses in India

Why are small businesses targeted?

Attackers do not only chase large companies. Small businesses often hold money, customer data and supplier relationships, yet have lighter protection than a big firm. Automated attacks scan the internet for weak passwords, outdated websites and exposed systems, so size is not a shield.

The damage is practical: payments diverted by a fake invoice, a locked computer holding your accounts, a defaced website, customer data leaked or email used to scam your own clients. Because the basics are inexpensive compared with the cost of an incident, a short checklist followed consistently is the best first investment.

Which accounts and passwords need protecting first?

Start with email. Whoever controls your email can reset almost every other password, so protect it with a strong unique password and multi-factor authentication. Next come banking and payment portals, accounting software, cloud storage, domain registrar, website admin and social media accounts.

Use a password manager so that every account has a different long password without anyone memorising it. Never share logins by WhatsApp or sticky notes; give each person their own account. When an employee leaves, remove their access the same day, including shared mailboxes and tools.

• Multi-factor authentication on email, banking, cloud and admin accounts
• A password manager and unique passwords for every service
• Individual accounts instead of shared logins
• Same-day removal of access when people leave

How do updates, backups and devices fit in?

Attackers frequently use known weaknesses in software that has not been updated. Turn on automatic updates for operating systems, browsers and business apps, and keep website plugins, themes and servers current. Retire devices and software that no longer receive updates.

Backups are your safety net against ransomware, accidental deletion and hardware failure. Follow a simple pattern: more than one copy, on different storage, with at least one copy that cannot be changed or reached from your normal network. Test a restore occasionally, since a backup you have never restored is only a hope.

How do you defend against phishing and fraud?

Most incidents start with a convincing message. Typical examples in India include a fake invoice or changed bank details from a supplier, a courier or KYC update link on SMS or WhatsApp, a fake payment screenshot, or a call from a supposed bank officer asking for an OTP. Staff who handle payments are the usual targets.

Create a few firm rules: never share an OTP or PIN, verify any change of bank details by phoning a known number, hover over links before clicking and be suspicious of urgency. Encourage people to report suspicious messages without fear of blame. A culture that welcomes reports catches problems early.

• Verify bank detail changes by calling a number you already hold
• Never share OTPs, PINs or passwords with anyone
• Treat urgent payment requests with extra caution
• Report suspicious messages to a named person right away

What about your website, network and data?

If you run a website, keep its software updated, use strong admin credentials with MFA, limit who has access and keep backups. An outdated plugin on a WordPress or WooCommerce store is a frequent weakness. Use HTTPS and monitor for unusual changes. A periodic security assessment can find issues before attackers do.

In the office, change default router passwords, use a business-grade firewall where possible, separate guest Wi-Fi from your work network and encrypt laptops that leave the premises. Collect only the customer data you need, and store it carefully, since data protection obligations in India are developing. Check current official rules.

What should your incident plan include?

Write a one-page plan before you need it. It should list who decides, who to call such as your IT provider and bank, how to disconnect an affected device, where backups are and how to inform customers if their data is involved. Keep a printed copy, because your systems may be unavailable.

After an incident, change passwords, find out how it happened and fix the cause. Report cyber fraud through official channels such as the national cybercrime reporting portal and inform your bank quickly for payment fraud. A modest, practised plan beats an elaborate one nobody has read.

Frequently asked questions

What is the single most important thing a small business can do?

Turn on multi-factor authentication for email and financial accounts. It blocks many account takeovers even when a password has leaked.

Do I need antivirus software?

Reputable endpoint protection is a sensible layer, along with updates, backups and training. It is not enough alone, since many attacks rely on tricking people, not on malware.

How often should I back up my data?

As often as you can afford to lose work. Daily is common for active business data, with periodic checks that you can restore. Keep at least one copy offline or otherwise protected.

Should I get my website security tested?

A periodic assessment is worthwhile, especially if you take payments or store customer data. A vulnerability assessment or penetration test can find issues before attackers do.

What should I do if I suspect fraud?

Contact your bank immediately for payments, change affected passwords, isolate affected devices and report through official cybercrime channels. Keep evidence such as messages and transaction details.

Need help with this? See our Cybersecurity & VAPT service or talk to Yash Parikh.