Most breaches at small businesses don’t involve a nation-state attacker or a never-before-seen exploit. They exploit the basics: a reused password with no MFA, an unpatched VPN, a staff member reading email on an admin account, or a macro-laced invoice. The good news is that the controls that stop these attacks are well understood, and most of them cost far more in attention than in money.<\/p>\n
The Australian Signals Directorate’s Essential Eight<\/strong> is the best-known framework for this. It lists eight mitigation strategies, each with maturity levels. Trying to do all eight at once can feel overwhelming, so here are the five we recommend small businesses tackle first, and why.<\/p>\n Stolen or guessed passwords are still one of the most common ways attackers get in. MFA means a password alone isn’t enough.<\/p>\n Firewalls, VPN appliances, remote desktop gateways and other internet-facing systems are the front door. When a critical vulnerability in one of them is announced, attackers often start scanning for it within days.<\/p>\n If an attacker compromises an account with admin rights, they can do almost anything: disable security tools, steal data or deploy ransomware across the network.<\/p>\n Malicious macros in documents and spreadsheets remain a common way malware gets onto machines, usually through a convincing email attachment.<\/p>\n1. Multi-factor authentication (MFA) everywhere<\/h2>\n
\n
2. Patch internet-facing systems fast<\/h2>\n
\n
3. Restrict administrative privileges<\/h2>\n
\n
4. Lock down Microsoft Office macros<\/h2>\n