Cybersecurity checklist for small businesses in Pakistan
In short: most attacks on small businesses are not clever. They use a reused password, an open remote desktop, a fake invoice email or a WhatsApp message pretending to be the owner. The checks below close most of those doors, and many cost nothing but an afternoon.
Accounts and passwords
- Turn on multi-factor authentication (MFA) for email, banking, cloud storage, social media pages and remote access. Use an authenticator app rather than SMS where possible.
- Stop reusing passwords. Use a password manager so every account has its own long password.
- Separate admin accounts. Nobody should read email or browse the web while logged in as an administrator.
- Remove leavers on their last day: email, cloud, Wi-Fi, building access, shared social media logins, and the company WhatsApp groups.
- Lock down your domain and email admin. The account that controls your domain name and hosting can take over everything. Protect it with MFA and keep the recovery details current.
Email, payments and WhatsApp fraud
- Call back before changing bank details. If a supplier emails "our account has changed", confirm by phone on a number you already had, not the one in the email.
- Two people approve large payments, and "urgent, confidential" requests from the owner get a phone call first.
- Train staff on WhatsApp impersonation: a new number with the owner's photo asking for a quick transfer or gift cards is a scam until proven otherwise.
- Set up SPF, DKIM and DMARC on your email domain so criminals cannot easily send email that looks like it came from you.
- Turn on WhatsApp two-step verification (a PIN) on every business phone, and never share the six-digit code anyone asks for.
Devices and network
- Close remote desktop (RDP) to the internet. If staff need remote access, put it behind a VPN with MFA. Open RDP is one of the most common ways ransomware gets in.
- Turn on automatic updates for Windows, browsers, Office and phones. Patch the firewall and router too; they are often forgotten.
- Use licensed software. Cracked software is a common carrier for malware, and it does not get security updates.
- Change default passwords on routers, Wi-Fi, CCTV/DVR systems and printers. Keep a separate guest Wi-Fi for visitors.
- Encrypt laptops (BitLocker on Windows, FileVault on Mac) so a stolen laptop does not mean stolen data.
Backups and recovery
- Follow 3-2-1: three copies of important data, on two kinds of storage, with one copy offline or off-site where ransomware cannot reach it.
- Test a restore every quarter. A backup you have never restored is a hope, not a backup.
- Write a one-page incident plan: who to call, how to disconnect an infected computer, who talks to clients, and where the backups are.
People and visibility
- Make reporting easy and blame-free. Staff who click a bad link and report it in five minutes save you; staff who hide it for a week sink you.
- Know what you expose. List every website, server and service reachable from the internet. An external security check often finds forgotten test sites, old admin panels and open ports.
If something has already happened
- Disconnect affected computers from the network, but do not switch them off or wipe them yet; evidence matters.
- Change passwords for email and banking from a clean device, and turn on MFA.
- Call your bank immediately if money was sent to a fraudster; speed improves the chance of stopping the transfer.
- Report cybercrime to the National Cyber Crime Investigation Agency (NCCIA), which took over this work from the FIA's Cyber Crime Wing.
- Get expert help before restoring, so the attacker is not still inside when you go back online.
Want a second pair of eyes? FarSec checks businesses in Pakistan for exactly these gaps and helps fix them. Email [email protected] and tell us what worries you.