Small business network security: an 11-step checklist

Here's a complete small business network security checklist. Cover these basics and you'll be far ahead of most organizations — big businesses often miss these same controls.

Step 1: Inventory your hardware and software

You can't secure what you don't know exists. Build a list of every device — laptops, desktops, printers, mobile devices — with the make and model, MAC address, assigned IP, connection method (Wi-Fi or Ethernet), licensing and warranty details, and the department and person it belongs to. Do the same for software and firmware, and make a plan for anything unauthorized or no longer supported by the vendor (for example, end-of-life operating systems).

Step 2: Automate patches

Patching is one of the highest-impact things you can do — a large share of breaches trace back to unpatched vulnerabilities. Modern Windows and Windows Server versions can apply updates automatically; turn that on.

Step 3: Restrict administrative privileges

Work in an administrative account only when performing administrative tasks. Regular user accounts can't install software or change protected settings without an admin prompt — which means an accidental click on a malicious installer is blocked. Audit every computer to see which users hold admin rights, and always change default passwords on new devices.

Step 4: Start a security awareness program

Security awareness is often the highest-ROI control you have, since the overwhelming majority of attacks involve people. A few principles: employees gravitate to the easiest way to do their jobs, so make the secure path simple; annual training doesn't stick, so run it monthly or bi-monthly; and reinforce it with simulated phishing, which leaves a lasting impression training alone can't.

Step 5: Filter web traffic

The web is a common attack vector. The strongest approach is to allow only the sites needed for business and block everything else by default. If that's too restrictive, at minimum block known-malicious sites — most modern firewalls can do this automatically.

Step 6: Block malicious emails

Use an email security solution: point your mail DNS records to the provider so inbound (and sometimes outbound) email is scanned for malware and other threats before it reaches inboxes. Given how much email is spam or malicious, this control isn't optional. Pair it with SPF, DKIM, and DMARC.

Step 7: Install endpoint protection

Every workstation and server should run endpoint protection (anti-malware), installed everywhere and kept updated — verify coverage from your management console. Automatically scan removable media (USBs, discs) on insertion, and disable autorun.

Step 8: Back up your data

Automatically back up anything you can't afford to lose, and keep copies in more than one location — if you have an on-site backup, add a cloud backup; if you have one cloud backup, add a second. Back up critical systems like domain controllers on a regular schedule, and encrypt backups in transit and at rest. Many small businesses that suffer an incident never reopen simply because they had no backups.

Step 9: Secure Wi-Fi traffic

Use WPA2 (not the insecure WEP) with a strong password. Consider turning Wi-Fi off outside business hours so an attacker can't sit outside and attack it. Put guests and unmanaged devices — like employees' phones — on a separate network, isolated on its own VLAN (or physically) to be effective.

Step 10: Control user accounts

Disable a departing employee's account immediately — ideally before they leave the building — to prevent retaliation or takeover. Auto-lock devices when idle (NIST suggests a short timeout; shorten it further in public areas). And enable multi-factor authentication everywhere you can.

Step 11: Create an incident response plan

Even with strong controls, an attacker may still get in — so have a plan for how you'll respond. Make sure everyone knows their role, practice responding to different scenarios, and keep contact information current. The better prepared you are, the faster you recover.

Conclusion

Cybersecurity can feel overwhelming, but covering the basics puts you ahead of most of your peers. Start working through these 11 practices to keep attackers out of your network.