Cybersecurity basics for a small contracting business

A small contracting business holds the same things criminals go after at a large company: bank logins, customer addresses and payment details, estimates and invoices. Criminals target companies of every size. Most of the protection comes from a short list of habits.

Devices and files

• Turn on automatic updatesKeep the operating systems, apps and web browsers on every work phone, tablet and laptop up to date, with updates set to install automatically.
• Check which devices still get updatesA phone, laptop or router past its end of support stops getting security fixes.
• Back up the important filesCopy job files, estimates and the books to an external hard drive or the cloud, and keep a copy off the network.
• Lock up the paper files tooStore paper records with customer or payment details somewhere secure.
• Put a password on every deviceDon't leave a laptop, tablet or phone unattended in a truck or a customer's driveway.
• Encrypt devices with sensitive informationLaptops, tablets, phones, removable drives and cloud storage that hold customer or payment details should be encrypted.

The shop's wireless network

• Change the router's default name and passwordThen turn off remote management and log out as the administrator once the router is set up.
• Turn on WPA2 or WPA3 encryptionEncryption keeps information sent over the network from being read by outsiders.

Passwords and sign-in

• Require strong passwordsMake them at least 12 characters, with a mix of numbers, symbols, and capital and lowercase letters.
• Never reuse or share a passwordDon't send one over the phone, in a text or by email. A password manager keeps a different one for each account.
• Limit failed sign-in attemptsLocking an account after a few wrong tries stops password guessing.
• Turn on multi-factor sign-inRequire it for email, banking and anything else with sensitive information. It adds a step after the password, like a temporary code on a phone.

The crew

• Train everyone on a regular scheduleCover phishing emails and texts, passwords and how to report something odd, and update the crew as new scams come up.
• Report phishing, don't answer itAnyone who gets a suspicious email or text reports it instead of clicking or replying.
• Have a plan for a breachDecide ahead of time how you'll save data, keep the business running and tell customers if their information is exposed.

Phishing emails and texts, and the stories they tell shows what the messages look like.