Cyber security becomes unhelpful when it is presented as either a miracle product or an impossible technical discipline.
For a small business, the useful question is simpler: what would make the common attacks harder, limit the damage if something goes wrong and help the business recover without guessing?
That is a system. It includes technology, but it also includes people, access, payment checks, backups and a plan for the first hour of an incident.
Start with the three controls the ACSC puts first
The Australian Cyber Security Centre recommends that small businesses begin with three practical measures: turn on multi-factor authentication, update software and back up information.
Those controls sound basic because they are foundational. They protect against common paths into a business and make recovery more realistic.
- Turn on multi-factor authentication for email, banking, document storage, social accounts and every administrator account that supports it.
- Install operating-system, application, website and plugin updates promptly. Enable automatic updates where that is appropriate.
- Back up the information the business cannot afford to lose, protect the backup account and test that a restore actually works.
The official Australian Government Small Business Cyber Security Hub has current guides, checklists and recovery resources.
Protect identities before buying more tools
Email is often the key to everything else. If someone controls it, they may be able to reset passwords, impersonate the business, redirect invoices or reach files stored elsewhere.
Use a password manager to create a unique credential for each account. Protect the password manager with multi-factor authentication and a strong master passphrase. Avoid sharing one administrator login across a team. Give each person their own account and remove access when the work or role ends.
Access should follow the job. A person who needs to update website content does not automatically need billing, domain or database administration. This is the principle of least privilege in plain English: only give people the access they need, for as long as they need it.
Keep devices boring and dependable
A locked office does not help if an unlocked laptop contains every client file and stays signed into every system.
Business devices should use encryption where available, a short automatic-lock period, a PIN or biometric control and supported software. Remote tracking or wipe features should be configured before a device disappears. Old devices need to be securely reset or destroyed before disposal.
The goal is not paranoia. It is removing the easy opportunities.
A secure website is more than HTTPS
HTTPS matters, but it does not prove the application is safe. A secure build also needs deliberate decisions about what is public, what is trusted, who can perform privileged actions and what information should never reach the browser.
For a website or custom system, I look at the boundary before the decoration:
- Validate input and enforce authorisation on the server, not only in the interface.
- Separate development, test and live environments.
- Keep secrets out of source code, screenshots, analytics and casual messages.
- Limit administrator routes and use multi-factor authentication where the platform supports it.
- Review dependencies and deployment configuration.
- Decide what is logged, who can see it and how long it is retained.
- Agree on backup and recovery ownership instead of assuming the hosting platform handles everything.
Not every brochure website needs the same controls as a client portal holding private records. The risk, data and consequences should shape the build.
People and payment checks matter just as much
Business email compromise often succeeds because a believable message reaches a busy person at the right time.
Create a second-channel check for changes to bank details, urgent payments and unusual access requests. Call a known number from an independent record instead of replying to the contact details in the suspicious message. Give staff a simple way to report something that feels wrong without being blamed for raising it.
Security training should be short, repeated and connected to the work people perform. It should give people a simple way to recognise suspicious requests, verify payment changes and raise concerns without being blamed for asking.
Training is not a penetration test. It does not make someone a specialist security assessor, and I will not represent it that way.
Understand what a penetration test is for
A penetration test is an authorised and scoped attempt to find exploitable weaknesses. It should define the target, accounts, timing, exclusions, evidence, reporting and retesting expectations before active testing begins.
Routine launch checks, automated scans and code review are useful parts of delivery, but they are not automatically a penetration test. For higher-risk systems, CDS can help prepare the application and then work with a suitably qualified independent specialist. The OWASP Web Security Testing Guide describes a broad framework for web-application security testing.
Make the first month practical
If the business is starting from scratch, do not begin with twenty policies nobody will follow.
This month, protect email and administrator accounts with multi-factor authentication. Update supported devices and remove old accounts. Identify the information that would stop the business if it disappeared. Back it up and test one restore. Write down who will make decisions if email, files or the website become unavailable. Then enrol the team in practical training.
Once those basics are real, assess the next layer against the actual risk.
Finish with a boundary and a recovery decision
No responsible developer can promise that a system will never be attacked or never fail.
What CDS can do is build with clear trust boundaries, reduce avoidable exposure, document ownership and say when independent expertise is required. That is more valuable than security theatre because it gives the business something it can operate.
If you are planning a website, portal or business system, begin by explaining what it will hold, who needs access and what happens if it stops. That is enough to start a responsible security conversation.