At 8:15 a.m., your front desk cannot open the appointment system. At 10:30, an employee receives a message that appears to be from the owner asking for a wire transfer. By lunch, a server is offline and shared files have strange names.
This is how a normal business day becomes an expensive outage.
Cyber security for small business is not about buying every security product available. It is about closing the common gaps attackers use: outdated software, weak passwords, exposed remote access, unprotected email, and backups that have never been tested.
The seven protections below give you a practical baseline.
Key Takeaways
- Patch Windows workstations, servers, applications, and UniFi equipment on a defined schedule.
- Maintain tested, offline or isolated backups.
- Protect email with MFA, filtering, and SPF, DKIM, and DMARC.
- Limit access using least privilege and separate administrator accounts.
- Secure every endpoint with current protection and disk encryption.
- Segment office networks, guest Wi-Fi, and sensitive systems.
- Document HIPAA obligations if your business handles protected health information.
1. Patch Windows Workstations, Servers, and Network Equipment
An unpatched computer is not simply behind on maintenance. It may have a known weakness that attackers are actively searching for.
Patching should cover:
- Windows desktops and laptops
- Windows servers
- Browsers and business applications
- Microsoft 365 applications
- Printers and scanners
- Firewalls, switches, and wireless access points
- UniFi gateways, switches, and access points
For Windows workstations, turn on automatic updates and confirm that updates are actually installing. A computer showing “updates available” for weeks is not protected. Restart devices when required, even if employees find it inconvenient.
For Windows servers, avoid blindly applying updates during business hours. Schedule maintenance windows, verify backups first, and test critical applications after patching. If a server supports dental imaging, accounting, file sharing, or line-of-business software, document what must be checked after the restart.
For UniFi equipment, keep the UniFi Network application, gateway, switches, and access points current. Review firmware status in the UniFi console. Remove unused services and avoid exposing management interfaces directly to the internet.
A practical target is to patch normal systems within 30 days and handle critical, actively exploited vulnerabilities faster. CISA’s Known Exploited Vulnerabilities Catalog is a useful reference for prioritization.
If your business has a local server or specialized Windows software, then patch management should be scheduled and verified: not left to individual employees.
2. Build Backups That Can Survive Ransomware
A backup that sits permanently connected to the same network as your computers may be encrypted along with everything else.
Use a practical version of the 3-2-1 backup rule:
- Keep at least three copies of important data.
- Use at least two different storage types or locations.
- Keep at least one copy offline, offsite, or otherwise isolated.
Back up more than shared folders. Review whether your plan includes:
- Windows servers and system images
- Critical workstations
- Microsoft 365 mailboxes and files
- Accounting and customer databases
- Dental imaging and practice management data
- Configuration files for firewalls and UniFi equipment
- Important cloud application data
Encryption matters, too. Backups should be encrypted in storage and during transfer. Administrative access to backup systems should use separate credentials and MFA. Normal employees should not be able to delete every recovery point.
Then test a restore. Start with a file or folder. Move to a mailbox, database, or server recovery. Record how long the process takes and who is authorized to begin it.
A dashboard that says “backup successful” only proves that a job completed. It does not prove that your business can recover.
See Direct Support’s business continuity planning guide for SMBs for a practical recovery framework.
3. Secure Email Against Phishing and Impersonation
Email is often the front door to your business. One stolen mailbox can expose customer records, reset other passwords, and create fraudulent payment requests.
Start with these controls:
- Require MFA for every email account.
- Use stronger MFA methods for administrators and finance staff.
- Separate daily user accounts from administrator accounts.
- Enable spam, malware, attachment, and suspicious-link filtering.
- Review mailbox forwarding rules and delegated access.
- Train employees to report suspicious messages quickly.
Protect your email domain with SPF, DKIM, and DMARC:
- SPF identifies approved systems that can send email for your domain.
- DKIM adds a verifiable signature to outgoing messages.
- DMARC tells receiving mail systems how to handle suspicious messages that appear to come from your domain.
These records must be configured carefully. An incorrect setting can block legitimate mail from marketing platforms, accounting services, scanners, or customer portals. The FTC’s small business cybersecurity guidance explains the role of email authentication and secure remote access.
Your staff also need a simple verification rule: any request involving money, credentials, sensitive records, or a change to vendor payment details must be confirmed through a separate channel.
A phone call to a known number is faster and cheaper than recovering from a fraudulent wire transfer.
4. Control Access With MFA and Least Privilege
Attackers do not need to break into every computer if they can sign in as one employee with excessive access.
Apply least privilege. Give each person only the access required for their role. A receptionist may need scheduling software but not payroll files. A contractor may need one project folder but not the entire file server.
Use these access controls:
- Require unique accounts. Avoid shared logins.
- Use long, unique passwords of at least 12 characters.
- Store credentials in a business password manager.
- Require MFA for email, VPNs, Microsoft 365, banking, EHR systems, and admin consoles.
- Remove local administrator rights from normal Windows users.
- Use separate administrator accounts for privileged work.
- Disable accounts immediately when employees leave.
- Review inactive accounts and vendor access at least quarterly.
For remote access, do not expose Windows Remote Desktop Protocol, or RDP, directly to the public internet. Use a properly configured VPN or secure remote support tool with MFA and limited access rules.
If a vendor needs access for one task, then create temporary, traceable access instead of sharing a permanent administrator password.
5. Protect Every Endpoint
A single laptop can become the starting point for a larger incident. That includes devices used at home, in a vehicle, or at a client site.
Every Windows PC, Mac, laptop, and server should have:
- Supported operating system versions
- Current security updates
- Reputable antivirus or endpoint detection and response protection
- Full-disk encryption
- Automatic screen locking
- Strong sign-in protection
- Unnecessary software removed
- USB and removable media controls where appropriate
Windows users should confirm that Microsoft Defender or an approved endpoint platform is active and receiving updates. Check protection status centrally if you manage multiple devices. Do not assume that an antivirus icon means the device is healthy.
Enable BitLocker on supported Windows laptops and protect the recovery keys in a controlled administrative system. Encryption reduces the impact if a laptop is lost or stolen. It does not replace MFA, patching, or backups.
Maintain a current inventory of devices, operating systems, owners, and locations. You cannot patch or protect hardware you do not know exists.
6. Secure the Network, Including UniFi Equipment
Your network should limit damage, not allow every device to communicate with every other device.
At a minimum:
- Change default router, firewall, and UniFi administrator credentials.
- Use WPA3 where supported, or WPA2-AES with a strong passphrase.
- Create a separate guest Wi-Fi network.
- Isolate personal devices and smart equipment when possible.
- Disable unnecessary remote administration.
- Use firewall rules to limit inbound and outbound traffic.
- Require VPN access for approved remote connections.
- Keep UniFi controllers and devices patched.
- Protect the UniFi administrator account with MFA.
Use VLANs to separate traffic. A practical UniFi layout may include:
- Business VLAN: managed workstations and normal office systems
- Sensitive systems VLAN: servers, EHR devices, or protected file storage
- Voice or equipment VLAN: phones, cameras, printers, or IoT devices
- Guest VLAN: internet access only, with no internal network access
The important point is not the label. It is the rule behind it: guests and unmanaged devices should not be able to reach servers or sensitive systems.
7. Document HIPAA and Compliance Responsibilities
Dental and medical practices face an additional business risk. A malware incident may affect patient scheduling and operations, but it may also involve protected health information, or PHI.
Technical tools alone do not make a practice HIPAA compliant. You also need documented processes, assigned responsibility, and evidence that controls are reviewed.
If your business handles PHI, address:
- A written risk analysis
- Access control and unique user identification
- MFA for email, EHR, remote access, and administrator accounts
- Encryption for laptops, backups, and sensitive transmissions
- Backup and disaster recovery procedures
- Security awareness training
- Incident response and breach notification procedures
- Business Associate Agreements with relevant vendors
- Periodic reviews of user access and system activity
For example, your email provider, cloud backup provider, EHR vendor, and IT provider may need appropriate contractual arrangements when they handle PHI. Review those requirements with your compliance advisor or legal counsel.
The HHS HIPAA Security Rule guidance provides federal guidance. These protections support compliance, but they do not replace a formal assessment of your specific systems and obligations.
Direct Support also has resources on dental office malware recovery and office network security.
The Cost Question: Security Without Billing Ambiguity
Traditional IT support often creates financial surprises. An urgent security problem turns into an open-ended hourly project. A simple configuration task becomes a long-term contract. You may not know the cost until the work is finished.
Direct Support takes a different approach for discrete issues. Patching, email security, access control, backup troubleshooting, endpoint protection, UniFi configuration, and malware removal can be handled remotely for $150 per issue.
There is:
- No hourly billing
- No long-term contract required
- No surprise surcharge for a problem that takes longer than expected
- U.S.-based technical support
- Nationwide remote assistance
Review the Direct Support pricing options or schedule support.
Cyber security for small business works best when the basics are maintained every week: not discussed after an attack. Patch the systems. Test the backups. Protect email. Limit access. Segment the network. Document what your business must do when something goes wrong.
Simple controls, applied consistently, prevent more downtime than complicated security plans that nobody owns.