Cyber Security Basics for Small Businesses: 2FA, Backups and Ransomware

Most small businesses do not get hacked by a genius. They lose access because someone reused a password, clicked a convincing email, or left an old server running. The advice from India's CERT-In and the US agency CISA keeps repeating the same basics, which is useful: a short list done well beats a long list left undone.

What the official advisories actually say

CERT-In issued advisory CIAD-2025-0019, "Essential Measures for Industry for Safeguarding Business Operations against Cyber Security Threats", on 10 May 2025, with a severity rating of High. Its recommendations include long unique passwords with multi-factor authentication, limiting staff permissions by job role, automatic updates where possible, regular offline backups with tested restores, filtering email for phishing, and regular staff training with simulated phishing.

CISA's joint #StopRansomware Guide, updated in September 2023, says much the same: keep offline, encrypted backups of critical data and test them, because many ransomware variants hunt for backups they can reach; use phishing-resistant multi-factor authentication, especially on email and remote access; patch internet-facing systems first; and do not leave remote desktop exposed to the internet. The guide lists phishing, exposed remote services, unpatched flaws and stolen credentials as common ways in.

A real example of how people get caught

On 8 September 2025, Check Point reported, a maintainer of popular JavaScript packages received an email imitating npm support that demanded he update his two-factor details within 48 hours. He entered his details on a fake page, and attackers used that access to publish malicious versions of widely used packages. The lesson for a small firm is not about code. A rushed, official-looking email asking you to "verify" an account is the classic trap, and even careful technical people fall for it. Our post on npm supply-chain attacks tells the longer story.

The one-page action list

1. Turn on two-factor sign-in

Start with email, then banking and payment dashboards, your domain registrar, website host, accounting software and social accounts. An authenticator app or a hardware key is better than an SMS code where the service offers the choice. Our glossary explains two-factor authentication.

2. Use a password manager

A password manager creates and stores a different long password for every service, so one leak cannot unlock the rest. Give each staff member their own login rather than sharing one, and remove access the day someone leaves.

3. Keep backups that ransomware cannot reach

Keep at least one copy offline or in storage that your normal accounts cannot delete. Then, once a quarter, actually restore a file or a whole database to prove the backup works. Read more under backup and disaster recovery.

4. Install updates

Switch on automatic updates for computers, phones, routers and the plug-ins on your website. Remove software and old servers nobody uses, since unmaintained systems are where attackers often enter.

5. Teach staff to pause

Agree a simple rule: money requests, password resets and unexpected attachments get confirmed by a phone call to a known number. Five minutes at a team meeting about a recent phishing email is more effective than a long policy document.

6. Limit who can do what

Staff should see only the data their job needs. Keep admin rights for a few people and review the list every few months.

7. Do not expose remote access

Remote desktop and similar tools should not sit open on the internet. Use a VPN or a managed remote-access service with two-factor sign-in.

8. Write a half-page incident plan

List who to call, how to disconnect an infected computer, where the backups are and how to reach your bank and web host. If personal data is involved, you may have reporting duties; see our posts on CERT-In incident reporting and the DPDP Rules.

What you can safely skip at first

You do not need an expensive security product on day one. A five-person office gets far more protection from two-factor sign-in, backups and updates than from an exotic tool. Buy advanced tools after the basics are in place, and be wary of anyone who sells fear rather than a clear plan.

Where VS Tech Builders fits

We are a software studio, not an incident-response firm. What we can do is build admin panels with role-based access, activity logs and sensible sign-in options into the websites and business software we deliver, and plan backups with you. If you want a plain review of how your website, app or business system stores data and who can reach it, get in touch.

Sources

Checked on 3 November 2026. Technology changes quickly; always confirm details with the official source before you act on them.

• CERT-In Advisory CIAD-2025-0019: Essential Measures for Industry for Safeguarding Business Operations against Cyber Security Threats — CERT-In
• #StopRansomware Guide — CISA, MS-ISAC, NSA and FBI
• The Great NPM Heist: September 2025 — Check Point Blog

Frequently asked questions

What is the first thing a small business should do for cyber security?

Turn on two-factor authentication for email, banking, your domain registrar and website host, and set up a password manager. Email is the master key to most other accounts, so protecting it first removes the easiest route for attackers. After that, set up tested backups and automatic updates.

How do I protect my business from ransomware?

CISA's guide recommends offline, encrypted backups that you test regularly, phishing-resistant multi-factor authentication, prompt patching of internet-facing systems, staff training and not exposing remote desktop to the internet. No single step is enough, but together they limit the chance of an attack and the damage if one succeeds.

Are cloud backups enough against ransomware?

Only if the backup cannot be deleted or overwritten from the infected computer or a stolen account. Synced folders often copy encrypted files straight away. Keep at least one copy that is offline or protected from normal accounts, and test restoring from it. Ask your provider how versions and deletions are handled.

Where do I report a cyber incident in India?

CERT-In's directions list incident@cert-in.org.in and the phone line 1800-11-4949 for reports. Covered organisations are asked to report listed incidents within six hours of noticing them, and a first report can contain the facts you have so far. Check whether the directions apply to you.