Building Practical Cyber security for a Growing Business

When people think about cyber security, they often picture enterprise products costing thousands of dollars every month - CrowdStrike, Microsoft Sentinel, Palo Alto firewalls, dedicated SOC teams, and security engineers working around the clock.

Most small businesses don't have any of that.

What they do have is customer data, employee laptops, internet-connected servers, and the same attackers targeting much larger organisations.

When I began improving security for our company, buying expensive security products wasn't an option. Instead, the goal was simple: reduce risk using reliable, well-configured tools that were either already available or completely free.

Before I begin, I want to emphasise that this approach is not perfect. In cyber security, no solution provides absolute security. That said, this approach is cost-effective, practical, and particularly suitable for small businesses and organisations.

Every Security Decision Started With One Question; Does this reduce risk enough to justify the effort?

Small businesses don't need every security product on the market. They need controls that address their biggest risks:

• Malware
• Stolen credentials
• Accidental deletion
• Insider mistakes
• Internet-facing attacks
• Data loss

1. Windows Defender is Better Than People Think.

Windows Defender comes built into all modern Windows operating systems, making it one of the easiest security solutions to deploy and configure. It provides regular security updates, real-time protection, access controls, Controlled Folder Access, and Microsoft SmartScreen — all with zero licensing costs.

While SmartScreen can occasionally be overly cautious and require workarounds for legitimate applications, its protection against malicious downloads and phishing attempts for regular employees makes it a valuable security feature.

A well-configured Defender installation is significantly better than an expensive antivirus solution that nobody manages.

2. Firewalls Aren't Just for Routers.

A common misconception is that having a company firewall at the network perimeter is enough to keep systems secure. While a router or perimeter firewall provides an important first line of defence, it should not be the only layer protecting an organisation's devices. Every endpoint should also have its own firewall configured to restrict unnecessary network traffic.

On Windows systems, Windows Defender Firewall provides robust host-based protection. Properly configured inbound and outbound rules can block unnecessary services, prevent unauthorised applications from communicating over the network, and restrict access to sensitive services such as Remote Desktop Protocol (RDP) to only trusted devices or networks.

For Linux systems, tools such as UFW (Uncomplicated Firewall) and iptables allow administrators to define strict firewall policies. A good practice is to allow only the ports and services that are required while using a default deny policy for all other incoming connections. This significantly reduces the attack surface and limits opportunities for unauthorised access.

A firewall at the network edge is important, but it should never be the only line of defence. By combining perimeter firewalls with properly configured host-based firewalls on every endpoint, organisations implement defence in depth, ensuring that if one layer fails, additional security controls remain in place.

3. Backups Are Security Too.

Many organisations only realise the importance of backups after experiencing a ransomware attack or other major data loss event. However, backups are a fundamental part of any cyber security strategy, helping organisations recover from malware, hardware failures, accidental deletion, and natural disasters.

One of the most widely accepted backup strategies is the 3–2–1 rule:

• 3 copies of your data — the original data and two backup copies.
• 2 different types of storage media — such as an internal drive and external storage or cloud storage.
• 1 offline or offsite copy — kept disconnected from the primary network.

The offline copy is particularly important because ransomware often attempts to encrypt any connected drives or network shares it can access. If backups remain connected to the system, they may be encrypted along with the original data, leaving no clean copy available for recovery.

Equally important is regularly testing backup restores. Organisations should periodically verify that backups are complete, uncorrupted, and can be restored within an acceptable time frame. A backup that has never been tested may fail when it is needed most.

A backup you can't restore isn't a backup.

4. Least Privilege Solves More Problems Than Antivirus.

One of the most overlooked principles in cyber security is the Principle of Least Privilege. Simply put, users should only have the permissions they need to perform their jobs — nothing more.

For example, most employees should not be able to:

• Install or uninstall software.
• Disable antivirus or other security features.
• Access payroll or HR records.
• Modify server configurations.
• Access sensitive systems unrelated to their role.

This concept is commonly implemented using Role-Based Access Control (RBAC), where permissions are assigned based on an employee's role within the organisation. An accountant does not need access to server settings, just as an IT administrator does not need access to payroll records. Restricting permissions reduces the potential impact of both accidental mistakes and malicious activity.

Some organisations view restricting software installation as inconvenient because it requires IT involvement.

Personally, I would rather walk to every employee's computer and install the required software myself, even if I had to explain the process a thousand times rather than deal with the consequences of a single successful malware infection caused by an unauthorised download. Spending a few extra minutes helping users is far less costly than recovering from a security breach.

5. Password Managers Beat Password Policies

For many years, organisations focused on enforcing complex password policies. Employees were required to create passwords with uppercase letters, lowercase letters, numbers, special characters, and to change them every few months. In practice, this often resulted in predictable passwords such as Password123!, Password124!, and Password125!, which provide little real security.

Modern security guidance takes a different approach. Rather than forcing users to memorise increasingly complex passwords, organisations should encourage:

• Unique passwords for every account.
• Long passwords or passphrases.
• Multi-Factor Authentication (MFA) wherever possible.
• The use of a reputable password manager to securely generate and store credentials.

During my own security audits and testing, approximately 99% of employees failed to create passwords that met even basic security expectations without guidance. This reinforces an important lesson: relying solely on password policies is rarely enough. Giving users the right tools such as password managers and reinforcing them with MFA produces far better security than expecting people to remember dozens of complex, unique passwords.

Strong security should work with human behaviour, not against it.

6. Documentation Is a Security Control.

Documentation is one of the most overlooked aspects of cyber security, yet it is one of the most valuable security controls an organisation can have. Keeping accurate records of asset inventories, firewall rule changes, server configurations, patch history, and incident response procedures ensures systems can be managed consistently and recovered quickly when problems occur.

I know documentation isn't something most people enjoy writing or maintaining, but it is absolutely necessary. Personally, I enjoy documenting systems because it makes troubleshooting, maintenance, and security far more manageable. Good documentation saves time, reduces mistakes, and makes it easier for anyone to understand the environment.

When something breaks, or worse, a security incident occurs — documentation is often what saves you.

7. What I Didn't Buy

One of the biggest misconceptions in cyber security is that effective security requires expensive enterprise solutions. For this project, I didn't purchase an enterprise EDR platform, hire a 24/7 Security Operations Center (SOC), or deploy AI-powered threat detection.

Instead, I focused on getting the fundamentals right. Properly configuring Windows Defender, enforcing firewall rules, applying the principle of least privilege, maintaining reliable backups, using password managers, and documenting everything provided far more value than buying expensive tools without the resources to manage them.

For small businesses, strong fundamentals will almost always provide a better return on investment than advanced security products that go unused or are poorly configured.

The Biggest Lesson

I learned from this project is that security isn't determined by price. A poorly configured enterprise security platform provides far less protection than free tools that are properly configured, regularly maintained, and used consistently. Small businesses don't need perfect security — they need practical, well-managed security that fits their environment and resources.

Attackers rarely compromise small businesses because they defeated cutting-edge security products. More often, they succeed because of weak passwords, exposed services, missing backups, excessive permissions, or systems that haven't been updated in months. Those problems don't require million-dollar budgets to fix — they require discipline, planning, and a commitment to implementing the fundamentals consistently.

Good cybersecurity isn't built by buying the most expensive tools. It's built by doing the simple things well, every single day.