Small Business, Big Questions: A Plain-English Route to Fast Pen Test and Fast Cyber Essentials Results

Running a small business means you're going to be wearing every one of those hats at some point. Marketing, payroll, customer service and somewhere down the line cyber security. Most business owners wouldn't have the slightest intention of becoming experts in firewalls and that's absolutely fine. The reality is that customers and insurers are increasingly demanding some form of evidence that you've taken sensible steps to protect your business. A fast pen test and a fast Cyber Essentials cert are a very practical way of providing that evidence without the need to employ a full time security expert. The jargon has been stripped out and the steps explained in plain English below.

Why small firms get targeted

The idea that attackers only go after the big names is a myth. In fact the attackers will use automated tools to scan the internet for any weakness and those tools don't care how big the business is. A dentist, a joiner's merchant and a family run accountancy practice are all in the same scans as a multinational.

Small organisations also tend to have far fewer safeguards. There's rarely going to be a dedicated security team, updates to software get deferred and passwords are often reused across accounts. That doesn't mean they're being negligent. It simply means they don't have the time.

What attackers are after

Motives are generally straightforward. The criminal wants the money in one form or another (by locking files and demanding payment, by tricking the staff into moving the money or by stealing customer details to sell). That in itself is a useful piece of information for the owner as it enables them to focus on the right kind of protection.

Cyber Essentials without the headaches

Cyber Essentials is a UK government backed scheme, aimed at small organisations. It defines five areas of basic protection: firewalls, secure configuration, access control, protection against malware and keeping everything up to date.

Think of it as a household checklist really. Doors locked, windows shut, spare key not left under the plant pot. Nothing particularly glamorous about it, but taken together these things will prevent the vast majority of opportunistic attacks.

Fast Cyber Essentials is ideal for small businesses as the scope is typically very limited. Ten laptops and a cloud email account are a lot easier to assess than a full blown network. The sensible thing to do is just to block out an afternoon, get the answers and then go through the questionnaire properly and submit it for assessment.

So what is a pen test?

A penetration test (often shortened to 'pen test') sounds quite intimidating. The concept is actually quite simple. A skilled tester, with your permission, attempts to get into your systems in the same way a criminal would. They then report back what they found, in order of severity, and give you recommendations as to how to fix things.

For a small business a quick pen test might be confined to the website, the email system and the remote access that the staff use from home. The tester will explain each of the vulnerabilities in plain English and the result is a very clear list of things to do rather than a general feeling of anxiety.

Does a small business really need one?

That's down to what the business actually holds. A business that has customer payment details, health records or other sensitive commercial information has a lot to lose. So too does any business that relies on a website for sales. If a day offline would be damaging then testing is absolutely worth considering.

Putting the pieces in order

For a lot of small businesses the sensible order is Cyber Essentials first, penetration test second. The cert gets you to the basics and the pen test then looks at whether anything has got through. Some will opt to do both together to save time and that's perfectly acceptable.

Whichever route suits, a few preparation steps make everything faster:

• Write down every device that connects to the business network (so phones and tablets are included).
• Check who has admin rights and remove them from anyone who doesn't need them.
• Turn on multi-factor authentication for your email and for any of the cloud tools that support it.
• Switch on automatic updates where you can.

These habits cost almost nothing and fix many of the problems that testers and assessors flag most often.

Talking to staff

Tech is only half the story. The people are the ones who actually click the links, open the attachments and take the phone calls from the convincing stranger. A brief, simple briefing is far more effective than a lengthy policy document which nobody ever reads.

What phishing emails look like (obviously) and what to do if you get one. Report anything suspicious and you won't be blamed. Agree a simple rule around payment requests (e.g. if you're being asked to change your bank details you would call the number already on file to confirm this). Little things like that go a long way to stopping a lot of fraud which no firewall is ever going to catch.

Paying for security sensibly

Budget is very much a real issue for small firms and it's fair to consider the cost. The spend is a mix of prevention and evidence. Prevention reduces the likelihood of an incident. The evidence (in the form of a certificate and a test report) is what enables you to get the work, satisfies your insurers and gives you peace of mind with your customers.

Compare providers on what they offer rather than price per se. Find out if they have support in place if the questionnaire itself raises some confusing questions. Find out if the pen test report will be in plain English so that the non-technical person can understand it. A good provider will have no hesitation in answering those questions.

Keeping up the good work

Cert & testing are snapshots. New staff, new software and new suppliers all change the picture. Diary your Cyber Essentials renewal 12 months in advance and plan for another penetration test either annually or after any significant change. Have a short review every quarter (even if it's just 15 minutes) to ensure the fundamentals haven't drifted. Who still has access? Are the updates actually installing? Have any new devices appeared on the network that no-one has seen? These are the little things that you check and they catch the problems while they're still cheap to fix.

The bottom line

Cyber security for a small business doesn't have to be daunting. A quick penetration test will show you how a real attacker might get in. Fast Cyber Essentials will show you that the fundamentals are in place. Taken together they give the business owner a rare commodity in this area: a clear picture, a short to-do list and proof that your customers can trust you.