Small organisations guide to cyber security
Protect your business with the NCSC’s cyber security tips on backups, protecting your devices and accounts, and spotting scams.
Pages
Page 4 of 6
Protecting your devices
Phones, laptops and tablets hold important business information. If a criminal accesses these (or any of your business’s shared devices such as tablets used for bookings or meetings), they could:
- view your own (or your customers’) private information
- change your passwords and take over critical accounts
- cause financial or reputational damage to your business
- make purchases using your online accounts
This is why it’s important to lock down access to all devices, including any personal devices that your staff use for work purposes. Think of it like locking your front door. It won’t stop every threat, but it makes most attacks much harder.
It’s especially important for phones and tablets, as these often leave the office environment and so are more likely to be lost or stolen.
Controlling who can access your devices
Use a 6-digit PIN or a strong password to prevent unauthorised people accessing your device when you turn it on (or unlock it). Better still, use fingerprint or face recognition, although if you’re sharing devices, you’ll need to set a PIN/password as well (so that other people can unlock the device).
Below we've provided links that give specific instructions about setting PINs, passwords and fingerprint/face recognition. If your device isn’t listed, check the support area on the manufacturer's official website.
Tips for choosing a good PIN/password:
- Create a different 6-digit PIN/password for each device, don’t use the same one.
- Avoid guessable PINs like 123456 or 000000.
- If your device comes with a default password, make sure you change it.
- Avoid common passwords that criminals will try (like password or abcd1234). If you’re already using one of these passwords, you should change it as soon as possible.
- Don’t base PINs or passwords on personal information (like dates of birth, pets names, members of your family, etc).
- You can write your PIN or password down, provided you keep it safe and out of sight.
- A good way to make your password difficult to crack is by combining three random words to create a password (for example fishapplesing)
Keeping your devices up to date
Viruses and other types of malware (such as ransomware) can harm your organisation’s devices, and the data stored on them. The best way to protect your organisation from viruses is to keep all your devices up to date, including the software and apps that they use.
Updating can improve performance, add new features, and most importantly, fixes bugs in software that criminals could use to hack your device. Below we've provided links that give specific instructions about updating your devices. If your device isn’t listed, check the support area on the manufacturer's official website.
- Google: Check and update your Android version
- Apple: Update macOS, Update your iPhone or iPad
- Windows: Install Windows Updates
Updating your devices may take some time and requires a reliable internet connection, so it’s best to do this at a location where you can access wifi and keep your device plugged in.
Note
If your phone, laptop or computer is no longer supported, you should replace it with a more up-to-date model. You don’t need the latest model, just something that still receives updates. If you do decide to replace your device, please refer to the NCSC’s guidance on buying and selling devices.
Keeping your apps up to date
Apps that are out of date (ie no longer supported by the manufacturer) could include bugs that a criminal could exploit to hack your device. Fortunately, it’s simple to set your device to update apps automatically, so they are kept up-to-date without you having to check.
Deleting out-of-date apps
If there are apps or software on your devices that you no longer use, you should delete them. This will also save storage and can improve how your device performs. If you use apps or software that no longer receive updates, you should find an alternative that is supported, as using an unsupported app leaves you at risk.
Warning
Only download apps from official stores or websites. Apps from your devices built-in store are vetted before they're released, so they can be checked for security issues.
Below we've provided links that give specific instructions about deleting apps.
Keep your web browsers up to date
As with apps, an out-of-date web browser can include bugs that a criminal could use to hack your device. Most browsers are set to automatically update, but some require you to reopen them before the update is applied.
You can use the NCSC’s Check your web browser tool to check you’re using the most up to date version. It works with all popular browsers including Google Chrome, Microsoft Edge, Safari and Mozilla Firefox. Simply click on the link below using the browser you want to test.
Check your antivirus and firewall
Antivirus software stops computer viruses from harming your devices, whilst a firewall blocks unwanted connections (usually from the internet) from reaching your device. Modern devices have antivirus and firewall software built in (and turned on by default), but you should still check these are both switched on in case a previous user has turned them off.
Note
Apple devices contain built-in virus protection which is already turned on. Similarly, you don’t need antivirus on your smartphone, provided that you only install ‘official’ apps (from sites like Google Play and Apple’s App Store).