Skip to content
Asian Leader HubPeer recognition and leadership discourse for Asia-Pacific executives

Phishing protection checklist for small businesses

A phishing protection checklist starts with one idea: slow down before you click, and make sure every person on your team knows who to tell. Phishing is a fake message that tries to trick you into handing over a password, money or access. Small teams can be fooled as easily as large ones. The steps below take a few hours to set up and cost little.

Why small teams are a target

The 2018 Verizon Data Breach Investigations Report studied 53,308 security incidents and 2,216 confirmed data breaches. Phishing and pretexting, which means making up a story to fool someone, were tied to 93 percent of the breaches the report observed.

The report also found that about 4 percent of people click on any given phishing campaign, down from 11 percent in 2014. That sounds small. But if you send a scam email to 50 people, one click is enough. A team of five is only as safe as its most rushed day.

Attackers do not need to know your company. They send the same message to thousands of inboxes and wait. That is why habits matter more than size.

Source: Verizon, 2018 Data Breach Investigations Report, as reported by CyberScoop, April 10, 2018 (cyberscoop.com/verizon-2018-dbir-ransomware-phishing-pretexting/).

Checklist 1: Learn the warning signs

Teach everyone the same short list. Share it in a team chat or print it and pin it up. Look for these signs.

  • The message is unexpected, or it pretends to be from someone you know.
  • It creates pressure, such as "pay today" or "your account will close".
  • It asks for a password, a code or a change to bank details.
  • The link address does not match the company it claims to be from.
  • An attachment arrives that you did not ask for.

NIST's small business guide gives a simple rule: do not click a link or open an attachment you were not expecting. If the message looks important, call the sender and ask them to describe what it is. Use a phone number you already have, not one in the message.

Source: NIST, Small Business Information Security: The Fundamentals (NISTIR 7621 Revision 1), November 2016 (doi.org/10.6028/NIST.IR.7621r1).

Checklist 2: Check links before you click

Hover your mouse over a link. Your browser shows the real web address, usually at the bottom of the window. If you do not know or trust that address, do not click it. Search for the company or topic in your browser instead, and open the page from the results.

On a phone, press and hold a link to see where it goes. Be extra careful with links in text messages and chat apps. Scam messages arrive there too.

Never type a password into a page you reached from a message. Open the site yourself and sign in there.

Source: NIST, Small Business Information Security: The Fundamentals (NISTIR 7621 Revision 1), November 2016 (doi.org/10.6028/NIST.IR.7621r1).

Checklist 3: Set up your tools

Training helps, but settings catch what people miss. Do these five things this month.

  • Turn on the spam and malware filters your email provider offers. NIST notes that filters can remove emails known to carry malware.
  • Turn on the warning feature in your web browser that flags harmful sites.
  • Switch on two-step sign-in for email and bank accounts. A stolen password alone then cannot open the account.
  • Install updates for your computers, phones and apps. Updates close the holes that malware uses.
  • Use a password manager, so each account has its own strong password.

NIST also advises using more than one form of identification for important systems. For example, a user logs in with a password and then enters a code sent by text message. If you cannot do everything at once, start with email and banking.

Source: NIST, NISTIR 7621 Revision 1, November 2016 (doi.org/10.6028/NIST.IR.7621r1).

Checklist 4: Make money requests hard to fake

Many phishing attacks aim at payments. A fake message from a "boss" or a "supplier" asks for an urgent transfer or new bank details. Set one rule for the whole team: any request to pay, or to change payment details, is confirmed by a phone call to a known number.

Tell your suppliers and customers what you will never ask for by email, such as a password. Ask them to do the same for you. The same habit NIST recommends for unexpected attachments works here: call the sender and ask.

Keep access limited. Only a few people need to approve payments, and only those people need access to the bank login.

Source: NIST, NISTIR 7621 Revision 1, November 2016 (doi.org/10.6028/NIST.IR.7621r1).

Checklist 5: Plan for the day someone clicks

Someone will click one day. What matters is what happens next. Agree on a simple plan and write it on one page.

  • Make it easy to report. Pick one person or one email address for suspicious messages.
  • Do not blame the person who clicked. If people fear trouble, they stay quiet, and the problem grows.
  • Disconnect the device from the network and change the passwords the person used.
  • Call your bank at once if money or payment details may be involved.
  • Back up important data at least once a month and store the copy away from the office.

NIST suggests a full encrypted backup of each business computer and phone at least once a month, kept away from your office. A recent backup means a malware attack costs you hours, not your business.

Source: NIST, NISTIR 7621 Revision 1, November 2016 (doi.org/10.6028/NIST.IR.7621r1).

Sources

  • Verizon, 2018 Data Breach Investigations Report, summarised by CyberScoop, April 10, 2018: cyberscoop.com/verizon-2018-dbir-ransomware-phishing-pretexting/
  • NIST, NISTIR 7621 Revision 1, Small Business Information Security: The Fundamentals, November 3, 2016: doi.org/10.6028/NIST.IR.7621r1