Home/Learn/Online Security

Online Security

Protect your business from cyber threats. Practical security guide for entrepreneurs and teams.

Chapter 1

Introduction to Cybersecurity for Business

Cybersecurity is no longer just for big corporations or banks. Today, any business that uses email, a website, or stores digital data is a potential target. The good news? You don't need to be a technical expert to protect your business.

The Threat Landscape in 2025

Cyber attacks have evolved dramatically. We're no longer talking about simple viruses, but sophisticated operations targeting businesses just like yours.

Phishing: The most common attack method. Emails that appear legitimate but are fake. Example: you receive an email apparently from your bank asking you to verify your account. Click the link and you've given your credentials to attackers.

Ransomware: Malware that encrypts all your files and demands ransom in Bitcoin. Ransomware attacks have increased by 67% in the past two years. Average cost: €25,000-100,000 for small businesses.

Social Engineering: Psychological manipulation. An attacker calls saying they're from IT and asks for a password for "urgent maintenance". Your well-meaning employee provides the password.

Data Breach: Leaks of sensitive data. Customer data, financial information, confidential documents end up on the dark web. Consequences: GDPR fines, loss of customer trust, lawsuits.

Why Are Small Businesses Targeted?

There's a myth that hackers only attack large corporations. The reality:

  • 43% of attacks target small businesses - because they have weaker security
  • 60% of small companies go bankrupt within 6 months after a major attack
  • Small businesses have small security budgets, making them easy targets
  • Many don't have an IT specialist or security protocols

The Real Impact of an Attack

Let's make it concrete. A graphic design studio, 8 employees:

  • An employee opens a phishing email and downloads an attachment
  • Ransomware encrypts the server with all client projects
  • Attackers demand €15,000 in Bitcoin
  • Business is paralyzed for 2 weeks
  • They lose 3 major clients due to delays
  • Total cost: €45,000 (ransom + losses + recovery)

Could it have been prevented? Yes. With proper backups and minimal employee training.

First Steps in Security

You don't need to implement everything at once. Start with the fundamentals:

  • Strong passwords: Minimum 12 characters, combined, unique for each account
  • 2FA (Two-Factor Authentication) everywhere: Email, banking, business tools
  • Regular backup: The 3-2-1 rule (we'll detail this later)
  • Software updates: Operating system, browsers, applications
  • Employee training: At least the basics about phishing and passwords

The right mindset: Cybersecurity is not a one-time project, but a continuous process. But once the foundations are in place, maintenance is minimal - 1-2 hours per month.

Chapter 2

Password Security - The First Line of Defense

81% of security breaches start with weak or stolen passwords. It's literally the most important security measure and, paradoxically, the most ignored.

Anatomy of a Weak Password

These passwords crack in seconds:

  • "password123" - cracked instantly
  • "YourName2024" - maximum 2 seconds
  • "qwerty" or "password" - in every database of cracked passwords
  • Anything found in a dictionary - maximum 10 minutes

Why don't they work? Attackers use "dictionary attacks" and "brute force" with supercomputers that test billions of combinations per second. Your Facebook data (name, birth date, city) is used to guess passwords.

What Does a Strong Password Look Like?

Example of an excellent password: Tr!mb1t@-Gr33n-Fl!es-S0up-B!g

Why is it good?

  • 28 characters - would take hundreds of years to crack
  • Combination of uppercase, lowercase, numbers, symbols
  • Easy to remember (the "passphrase" method: random words with symbols)
  • Contains no personal information

Password Managers - The Real Solution

Reality: you need 50+ unique passwords. It's impossible to remember them all. The solution: password manager.

What a password manager does:

  • Stores all passwords in an encrypted digital vault
  • Automatically generates ultra-strong random passwords
  • Auto-fills credentials on websites
  • Syncs across all devices
  • Alerts if a password appears in a data breach

Recommended for business:
1Password: Best for teams. $7.99/user/month. Features: shared vaults, granular access, security reporting, integrations.
Bitwarden: Open-source, cheaper ($3/user/month). Similar functionality, slightly less UI polish.
You remember one ultra-strong master password. The manager handles the rest.

Two-Factor Authentication (2FA)

Even if someone steals your password, 2FA blocks access. It's a second verification step.

Types of 2FA (from weakest to strongest):

  • SMS: You receive a code on your phone. Vulnerable to SIM swapping, but still better than nothing
  • Authenticator apps: Google Authenticator, Authy, Microsoft Authenticator. Generate codes on your phone offline. Recommended!
  • Hardware keys: YubiKey, Titan Security Key. Physical USB keys. Most secure, ideal for admin accounts

Where to enable 2FA immediately: Email (Gmail, Outlook) - maximum priority, Banking and PayPal, Your password manager, Business social media accounts, Hosting, domains, Cloudflare, CRM, accounting, any tool with sensitive data.

Protocols for Your Team

If you have employees, establish clear rules:

  • Passwords are never shared via email or chat - use password manager with secure sharing
  • Change passwords at offboarding: When an employee leaves, reset everything they had access to
  • Different passwords for personal vs business - if their personal Instagram gets hacked, you don't want it to compromise the business account
  • Regular review: Every 6 months, check who has access to what

Real case: A business lost access to its main domain because it was registered on a former employee's personal email, with a forgotten password. They recovered it after 3 weeks and €2,000 in legal consulting.

Chapter 3

Phishing and Social Engineering

Phishing is responsible for 90% of data breaches. Why does it work? Because it attacks the human, not the technology. The best firewall in the world won't protect you if the employee gives away the password themselves.

What Does a Modern Phishing Email Look Like?

Forget the obvious emails with grammatical errors and the Nigerian prince. Modern phishing is sophisticated.

Real example (happened in 2024):

Email from apparently "office@dhl-delivery.com" (the real domain was dhl-delivery.com.tracking-dhl.net - notice the subtlety?):

  • Perfectly copied logo
  • Message: "Your package is stuck in customs, pay taxes for delivery"
  • Link to a site identical to the real DHL
  • Asks for card details for "taxes"

Result: 1,200 people gave their card details in a single week.

Red Flags - How to Identify Phishing

1. Check the REAL sender address:

Display name says "PayPal Security" but the address is "noreply@paypa1-secure.tk". Notice: "paypa1" (number 1 instead of L) and ".tk" (free suspicious domain).

2. Artificial urgency:

"Your account will be suspended in 24 hours if you don't confirm!" - the classic psychological pressure technique. Legitimate companies don't work this way.

3. Subtle errors:

  • Generic greeting: "Dear customer" instead of your name
  • Grammatical errors (but beware, many are perfectly written now)
  • Unexpected attachments, especially .exe, .zip, .scr

4. Hover over links (DON'T click): The text says "www.amazon.com" but when you put the cursor over it you see "amaz0n-security.ru".
5. Unusual requests: Your bank will NEVER ask for your password via email. PayPal doesn't ask you to confirm card details via link.

Types of Advanced Phishing

Spear Phishing: Targeted attacks. The attacker researches the victim on LinkedIn/Facebook and personalizes the message.

Example: "Hi Maria, I saw you work at CompanyX. I recommended you for a project. Can you fill out this form?" Link to fake page that steals credentials.

Whaling: Phishing targeting managers/CEO. Usually with big financial impact.

Example: Email apparently from CFO to accountant: "Urgent transfer €50,000 to the new supplier. IBAN attached."

Smishing: Phishing via SMS. "Your package: [link]" or "Card blocked, call urgently at 555..."

Social Engineering - Beyond Email

Vishing (Voice Phishing): Someone calls saying they're from IT support and asks for a password for "verification".

Golden rule: Never give passwords or 2FA codes over the phone. Hang up and call the official company number yourself.

Pretexting: The attacker creates an elaborate scenario.

Real example: Someone pretends to be a new employee, calls IT: "It's my first day, I can't access the system, can you reset the password?"

Tailgating: Unknown person enters the office right after you, taking advantage of you holding the door open.

How to Protect Your Team

  • Regular training: Phishing simulations, real examples, short sessions every 3-6 months
  • Clear procedures: How do you verify someone's identity before sharing information?
  • Reporting without penalty: Employees must be able to report "I clicked on something suspicious" without fear of consequences
  • Email filtering: Services like Proofpoint, Barracuda, or even Gmail for Business have anti-phishing protection
  • Browser extensions: Netcraft, Avast Online Security flag phishing sites

If you clicked on phishing: Immediately change affected passwords, Enable 2FA if it wasn't enabled, Scan PC with antivirus, Monitor accounts for suspicious activity, Report to IT/security.

Chapter 4

Backup Strategies - Your Cyber Insurance

The question isn't IF you'll need backups, but WHEN. Hard drives die, ransomware encrypts, employees accidentally delete. Backup is your only safety net.

The 3-2-1 Rule - The Gold Standard

3 copies of your data:

  • 1 productive copy (the one you work on daily)
  • 2 separate backups

2 different media: For example: external hard drive + cloud. NOT: 2 external hard drives (if the office catches fire, you lose both).
1 copy offsite (in another location): Cloud storage is ideal for this. Or a hard drive at a different physical address.
Concrete example for a small business: Copy 1: Your laptop/PC (productive), Copy 2: Time Machine on external hard drive in office (local backup), Copy 3: Backblaze/iDrive continuous backup in cloud (offsite).

What Should You Backup?

MAXIMUM priority:

  • Customer data and transactions
  • Work projects and documents
  • Configurations and settings (website, software)
  • Important emails (export periodically)
  • Contracts, invoices, legal documents

NOT necessary: Applications (can be reinstalled), Operating system (can be reinstalled), Duplicate or temporary files.

Backup Frequency

Think about it: How many hours of work can you afford to lose?

  • Critical data (databases, transactions): Real-time or hourly backup
  • Active projects: Daily automatic backup
  • Archive and documents: Weekly backup

Automation is essential. Manual backup "when I remember" fails 95% of the time.

Recommended Backup Solutions

For individual PC/Mac:

Backblaze: $7/month, unlimited automatic continuous backup. Set it and forget it. Restore via download or they ship a hard drive.

iDrive: Cheaper ($79/year for 5TB), more features (versioning, sync), more complicated to set up.

For teams and servers:

Acronis Cyber Protect: Backup + antivirus + anti-ransomware. From €50/year per workstation.

Veeam: Enterprise standard for servers. Free for up to 10 workloads.

Cloud storage with versioning:

Google Workspace: Gmail, Drive with automatic backup, 30-day versioning (or infinite for Workspace).

Dropbox Business: 180-day version history, ransomware recovery.

Testing Your Backups

An untested backup = no backup. Too many businesses discover during disaster that their backup doesn't work.

Test every 3-6 months:

  • Try to restore random files
  • Verify that the backup is actually running (check logs, notifications)
  • Test a "disaster recovery drill": restore everything in a test environment

Real horror story: A marketing agency backed up daily to NAS in the office. Fire destroyed everything. They discover the NAS hadn't been syncing effectively for 4 months - error ignored in logs. They lost 8 months of projects.

Protection Against Ransomware

Modern ransomware looks for and encrypts your accessible backups. How do you protect yourself?

  • Immutable backups: Backblaze, AWS S3 Glacier with Object Lock - cannot be deleted/encrypted
  • Air-gapped backups: External hard drive disconnected after backup
  • Version history: You can revert to pre-ransomware versions
  • Segregation: The backup account shouldn't have admin access

Recovery plan: Document step by step how to restore systems. In panic after an attack, you'll forget. A simple document with "How we restore everything" saves hours/days.

Chapter 5

Secure Browsing and Email

Browser and email are the most used tools daily and, paradoxically, the most vulnerable if not configured correctly.

HTTPS - The Foundation of Web Security

What does HTTPS mean? HTTP + S (Secure). Data between browser and server is encrypted.

When you access an HTTP site (without S), anyone on the same WiFi network can see what you're doing: passwords, personal data, everything.

Check for HTTPS:

  • Lock icon in the address bar
  • URL starts with https:// not http://
  • WARNING: HTTPS doesn't mean the site is safe! Phishing can have HTTPS. It only means the connection is encrypted

For YOUR site: SSL certificate is mandatory. Cloudflare offers free SSL. Let's Encrypt too. No excuse not to have HTTPS in 2025.

VPN - When and Why?

What a VPN does: Encrypts all your internet traffic and routes it through an intermediary server. ISP, public WiFi, websites - they only see you connecting to the VPN, not what you're doing.

When you MUST use VPN:

  • Public WiFi (cafes, airports, hotels): Unsecured networks where attackers "sniff" traffic
  • Travel to countries with censorship or weak security
  • Access to internal company systems (remote work)

Recommended VPNs for business:
ProtonVPN: Based in Switzerland (strict privacy laws). From €4/month. Open-source, audited no-logs policy.
NordVPN: Cheaper (€3/month on long plan). Features: threat protection, meshnet. Good for small teams.
DON'T use free VPNs - many sell your data or inject ads.
Corporate VPN (for remote teams): Tailscale or ZeroTier - create private networks between team devices. Free for up to 100 devices.

Browser Security Settings

Chrome/Edge:

  • Settings → Privacy → Enhanced protection (blocks trackers and dangerous sites)
  • Enable "Always use secure connections"
  • Delete cookies on close for insignificant sites

Firefox: Enhanced Tracking Protection: Strict, HTTPS-Only Mode, Consider Firefox if you want more control and less tracking.
Recommended extensions (but minimal - every extension = risk): uBlock Origin: Ad blocker, but also anti-malware protection, Bitwarden/1Password extension: Secure auto-fill passwords, HTTPS Everywhere: Forces HTTPS (already built-in to modern browsers).

Email Security - SPF, DKIM, DMARC

These three protocols protect your domain from spoofing (someone sends emails "from you" without being you).

SPF (Sender Policy Framework):

You declare which servers are allowed to send email on behalf of your domain.

Example: "Only Google Workspace servers can send email from @your-company.com"

DKIM (DomainKeys Identified Mail):

Digital signature on every email, proving it comes from you and hasn't been modified.

DMARC (Domain-based Message Authentication):

Tells what to do with emails that fail SPF/DKIM: reject, quarantine (spam), or none (just report).

Why does it matter? Without these:

  • Attackers can send phishing from "contact@your-company.com"
  • Your legitimate emails end up in spam
  • Domain reputation drops

How to set them up: If you use Google Workspace, Microsoft 365, they offer step-by-step guides. You add a few DNS records in your hosting/domain panel. Verification tool: MXToolbox.com - checks SPF/DKIM/DMARC configuration.

Spam and Malware Filtering

Gmail/Google Workspace: Excellent built-in filtering. Plus, you can set:

  • Custom filters for suspicious domains
  • Alert for external emails pretending to be internal
  • Advanced phishing and malware protection (in Admin console)

Advanced solutions for business: Proofpoint, Barracuda, Mimecast: Additional layer of protection. Analyzes attachments in sandbox, detects sophisticated phishing. From €3/user/month.
Simple but effective practices: DON'T open attachments from unexpected emails, Check the REAL sender, not display name, Hover over links before clicking, Use separate addresses: info@, sales@, admin@ - not everything on one address.

Chapter 6

Incident Response - What to Do When You've Been Compromised

I hope you never need to use this chapter, but statistics say 1 in 3 businesses will have a security incident in a year. Preparation makes the difference between 2 hours of remediation and 2 weeks of chaos.

Recognize the Signs of a Breach

Indicators that you've been compromised:

  • You can no longer log into accounts (passwords changed)
  • Suspicious activity: emails sent that you didn't write, unknown transactions
  • Alert from bank/PayPal about unauthorized transactions
  • Clients report receiving phishing emails "from you"
  • Computer is extremely slow, antivirus is disabled
  • Files encrypted with strange extensions (.locked, .encrypted) and a README file with ransom demand
  • Google/Microsoft alerts: "New sign-in from unknown device"

First Steps (First 30 Minutes)

DON'T panic. Breathe. You have a plan:

1. Isolate the immediate impact:

  • Disconnect the compromised device from internet (WiFi off, ethernet cable unplugged)
  • DON'T shut down the computer - you may lose important evidence in RAM
  • If it's active ransomware, disconnect URGENTLY - it can spread across the network

2. Quick assessment: Which account/system is compromised? What sensitive data is exposed? How many users/devices are affected?
3. Notify key team: Person responsible for IT, Management (owner, CEO), DON'T communicate details on compromised channels (if email is hacked, don't communicate via email).

Containment (Next 2-4 Hours)

Change ALL passwords (from a safe device!):

  • Main email
  • Password manager
  • Banking, PayPal
  • Business social media
  • Hosting, domains, Cloudflare
  • CRM, business tools

Revoke active sessions: Google/Microsoft/Facebook have "Sign out of all devices" options. Use them.
Enable/verify 2FA: If it wasn't enabled, enable it now on all accounts. If it was, verify they haven't added new 2FA devices.
Block cards if there's suspicion of financial fraud: Call the bank immediately. Better safe than sorry.

Investigation and Cleanup

Malware scan (on a safe system):

  • Boot in Safe Mode or use a Live USB (Ubuntu, ESET SysRescue)
  • Run Malwarebytes, ESET Online Scanner, Kaspersky Rescue Disk
  • Delete everything detected

Check: Startup programs (Windows Task Manager → Startup, macOS System Preferences → Users → Login Items), Browser extensions - delete everything you don't recognize, Scheduled tasks - malware can reinstall itself.
In severe cases: Format and complete reinstall. It's safer than hoping you cleaned everything.

Recovery and Restoration

Restore from backups (from before the incident):

  • Verify that backups aren't also infected
  • Restore clean versions
  • Test before declaring "all ok"

Post-incident monitoring: Watch bank statements for suspicious transactions (next 3 months), Monitor unusual logins, Check haveibeenpwned.com with your emails.

Legal Obligations (GDPR)

If personal data of customers was compromised:

  • Notify the Data Protection Authority within 72 hours of discovery
  • Notify affected customers if the breach poses risk to them
  • Document the incident: what happened, when, what data, what measures you took

GDPR fines can reach 4% of turnover. Don't ignore the obligations.

The Ransomware Case - Pay or Not?

Official position (FBI, Europol, CISA): DON'T pay.

Why?

  • No guarantee you'll receive the decryption key (30% receive nothing)
  • You're financing criminal activity
  • Marks you as a "payer" - you'll be attacked again

Reality: If you don't have backups and data is critical for business survival, some companies pay. Consult a cybersecurity specialist and a lawyer before any decision.

Post-Mortem and Future Prevention

After it's resolved, do an analysis:

  • How did it happen? What was the attack vector?
  • What could we have prevented?
  • What new measures do we implement?
  • How do we improve the incident response process?

Document everything in an Incident Response Plan: Step by step what each person does in case of breach. When panicking, you won't think clearly - a document saves precious time.
Consider cyber insurance: Companies offering cybersecurity insurance cover recovery costs, consulting, fines, and even ransomware payments (though they don't recommend it). From €500/year for small businesses.

Recommended Tools

1Password

Premium password manager for teams. Shared vaults, audit trail, integrations.

Bitwarden

Open-source password manager. Cheaper, full functionality, optional self-hosting.

Authy

2FA authenticator with cloud backup. Sync between devices, more convenient than Google Auth.

Backblaze

Unlimited automatic cloud backup. $7/month per computer, set it and forget it.

ProtonVPN

VPN based in Switzerland with audited no-logs policy. Open-source, maximum security.

Cloudflare

Free SSL, DDoS protection, CDN. Must-have for any business site.

Want a Security Audit?

Our experts can evaluate and improve your business security. We identify vulnerabilities and provide concrete solutions.

Online Security | Cyber Security Guide for Business | DGI