Why encryption is your last line of defence
Data protection
Your business data no longer sits in one place. It is on laptops, phones, USB sticks, a server in the back room and a dozen online services. Protecting every one of those against every possible form of unauthorised access is not realistic. Phones get left in taxis. Drives get lost. Passwords get guessed. Someone eventually clicks the wrong link.
Encryption is what makes that survivable. Encrypted data is scrambled so that only someone holding the key can read it. If a thief walks off with a laptop, or an attacker copies files off a server, encryption is the difference between an inconvenience and a breach you have to report to your customers.
The practical version for a small business is short: turn on full-disk encryption on every laptop and desktop, encrypt any portable drive that leaves the building, use encrypted connections for remote access, and keep the recovery keys somewhere you will actually find them. Most of this is built into Windows and macOS already and costs nothing but the time to configure it properly.
Antivirus, anti-malware and what the difference actually is
Security
People use the two terms as though they are different products. In practice they describe the same thing: software that detects, blocks and removes malicious code. "Antivirus" is simply the older name, from an era when viruses were the main threat anyone worried about. Modern products under either label deal with ransomware, spyware, trojans, credential stealers and everything else.
What matters far more than the name on the box is how the product is deployed. A licence that expired eight months ago protects nothing. Neither does a tool nobody monitors, sitting on twelve machines with no central console, quietly reporting detections to a screen nobody looks at.
For a business, the questions worth asking are: is it installed on every machine including the ones that rarely get used, is it current, does someone see the alerts, and is there a plan for what happens when it finds something. We set this up so the answer is yes to all four.
Malvertising: infected without clicking anything
Threats
Malvertising is the use of online advertising to deliver malware, often with no interaction from the person browsing. You can be reading a well-known news site, never touch an ad, and still end up compromised. Code hidden in the ad quietly redirects the browser to a server that profiles the machine and picks an appropriate attack.
It works because of how ad space is bought and sold. Advertisers bid in real time through networks that do not always vet who they are dealing with, and much of the buying is automated. A malicious buyer only needs one network with loose standards to get their ad in front of a large audience on reputable sites.
The usual delivery method is an invisible page element that redirects the browser to an exploit kit, which attacks whatever unpatched software it finds. Ransomware is a common payload. The defences are unglamorous and effective: keep browsers and plugins patched, run a reputable ad and script blocker on business machines, and make sure the endpoint protection on those machines is current.
Patching is boring, and it is most of your security
Maintenance
Nearly every serious incident we get called into involves software that had a fix available and had not been updated. Vulnerabilities in operating systems, browsers, VPN appliances and the processors themselves get disclosed constantly. Most are patched by the vendor before the details go public. The window between a patch shipping and attackers scanning for anyone who has not applied it is measured in days.
Small businesses fall behind for understandable reasons. Updates need a restart, the restart is inconvenient, someone dismisses the prompt, and six months later that machine is two hundred patches behind. Servers are worse, because nobody wants to reboot the thing everybody depends on.
The fix is a schedule rather than good intentions: automatic updates on workstations, a defined maintenance window for servers, and someone verifying afterwards that the updates actually installed. It is the least interesting thing we do and it prevents more damage than anything else on this page.
A backup you have never restored is not a backup
Data protection
Every business we meet believes it has backups. Fewer than half turn out to have backups that would survive the thing they are most likely to face. The external drive left plugged into the server gets encrypted along with everything else during a ransomware attack. The cloud sync folder faithfully replicates the deletion. The job that has been silently failing since a password change last spring has nothing in it at all.
A backup worth having follows a few rules. Keep more than one copy. Keep at least one of them somewhere the primary systems cannot reach, so malware on your network cannot destroy it. Keep versions going back far enough that you can retrieve a file damaged weeks ago. And check the job results, because backup software fails quietly by default.
Most importantly, restore something. Pick a file, pick a whole machine, and prove it comes back. Until you have done that, what you have is a hope rather than a recovery plan.