Cybercriminals do not target small businesses because they are interesting — they target them because they are often easier. A regional law firm, a dental practice, or a three-person accounting office rarely has the defenses of a large corporation, but they hold plenty of valuable data: client records, financial information, employee details.

The good news is that the most common attacks are also the most preventable. Here are five fundamentals that make a real difference.

If there is one thing on this list you do in the next 24 hours, make it this. Enable MFA on your email, your accounting software, your bank accounts, and any other system that holds sensitive data. A stolen password alone is not enough to get in when MFA is active.

Most platforms support authenticator apps (Microsoft Authenticator, Google Authenticator) at no extra cost. Use them.

Weak, reused passwords are behind an enormous share of breaches. The fix is a password manager — a tool that generates and stores strong, unique passwords for every account. Your team only needs to remember one master password.

Good options for small businesses include Bitwarden (free tier is excellent), 1Password, and Keeper. The investment is small; the protection is significant.

Unpatched software is one of the most common entry points for attackers. Windows updates, browser updates, and application updates exist largely to close security holes. Make sure automatic updates are enabled on every device your team uses for work — including personal devices if they access company email or files.

Technology can only do so much. The most sophisticated email filter will occasionally let something through, and one click on the wrong link can compromise an entire network. Brief, regular conversations with your team about what phishing looks like — urgent requests, mismatched sender addresses, unexpected attachments — go a long way.

A few things to teach everyone:

• Verify unexpected wire transfer or payment requests by phone, not by replying to the email
• Hover over links before clicking to see the actual destination
• When in doubt, call the sender directly

Ransomware encrypts your files and demands payment to restore them. The only reliable defense is a backup that ransomware cannot reach — stored offsite or in a cloud service that keeps version history. But a backup you have never tested is not a backup; it is a hope. Restore a file from your backup at least once a quarter to confirm it actually works.

These five steps will not make your business invulnerable, but they will protect you from the overwhelming majority of attacks that target small businesses. If you want a clear picture of where your business stands today, reach out — I work with businesses throughout Connecticut's shoreline and lower CT River Valley.