Cyber security guides
Scams, ransomware, passwords and keeping a small business safe. 50 plain-English guides for small and medium businesses.
- How to spot a fake invoice email before you pay itA fake invoice usually gives itself away through a changed bank account, an odd sender address, pressure to pay quickly, or an amount that doesn't match a real order. The safest habit is simple: never pay a new or changed account number until you've confirmed it with the supplier using contact details you already had.
- A supplier says their bank account has changed: what to doTreat every 'our bank details have changed' message as unverified until you have spoken to a known person at the supplier on a phone number you already had. Payment redirection fraud depends on you updating the account from the email alone, so a short phone check stops it almost every time.
- What is business email compromise, and how do small offices stop it?Business email compromise is a fraud where criminals take over or imitate a real business mailbox, then use it to trick people into sending money or sensitive information. It is stopped by protecting your own mailboxes with multi-factor sign-in and by verifying any payment or data request outside email.
- Boss impersonation scams and how to protect your staffBoss impersonation scams use a message that seems to come from the owner or a manager, asking a staff member to make an urgent payment, buy gift cards or send sensitive files. The defence is an agreed rule that any unusual request from a senior person is confirmed in person or by calling them on their known number.
- Gift card scams aimed at staff, and how to stop themIf anyone asks a staff member to buy gift cards and send the codes by email or text, it's almost certainly a scam. Gift cards are popular with fraudsters because the value can be spent or resold within minutes and can't be traced or reversed, so a firm 'we never pay with gift cards' rule shuts this down.
- Text message scams targeting your staff: what to watch forScam texts pretend to be from couriers, banks, toll roads, government agencies or a colleague, and push staff to tap a link or reply quickly. The rule for work phones is simple: never act on a link in an unexpected text, and check anything important by going to the organisation's app or website yourself.
- Fake tech support calls: what staff should do when the phone ringsFake tech support callers claim to be from Microsoft, your internet provider, your bank or your own IT team, and try to talk staff into installing remote access software or reading out codes. The safe response is to hang up and call your real IT contact back through a number or channel you already know.
- How to recognise a phishing email at workA phishing email tries to get you to click, sign in, open a file or send something by pretending to be someone you trust. You can catch most of them by slowing down and checking four things: who really sent it, what it wants you to do, how urgent it claims to be, and where any link actually goes.
- How to check a link before you click itTo check a link, look at the real address behind it, not the text, and find the main domain by reading back from the first single slash. If the domain isn't exactly the one you expect, or you can't tell where the link goes, don't click it; go to the site by typing the address yourself.
- Are email attachments safe to open?Most attachments from people you deal with are safe, but an unexpected attachment is one of the main ways malware reaches office computers. Be most careful with zipped files, documents that ask you to enable editing or macros, and any file that leads to a sign-in page, and check with the sender if the email is out of the blue.
- Clicked a phishing link? What to do in the next ten minutesIf you clicked a suspicious link, stay calm and act quickly: close the page, tell your IT contact, and if you typed a password, change it from a different device straight away. What else you need to do depends on whether you entered details, downloaded a file, or only looked at the page.
- How to spot a fake Microsoft 365 login pageA fake Microsoft 365 login page looks identical to the real one but sits on a different web address, so the address bar is the only reliable test. Real Microsoft sign-ins happen on Microsoft-owned domains, and if you're asked to sign in after clicking a link in an email, it's safer to close the page and open Outlook or Office directly.
- QR code scams: what businesses and staff need to knowQR code scams hide a malicious link inside a code, often in an email, PDF or printed sign, so you can't read the address before scanning. Before you open a scanned link, look at the address your phone previews, and never sign in to work accounts or pay from a QR code you weren't expecting.
- How to make it easy for staff to report scams and suspicious messagesGive staff one simple way to report anything suspicious, such as a report button in Outlook or a single shared address, and make sure every report gets a quick, friendly response. A fast report from one person can protect the whole office, so reporting should feel normal, never embarrassing.
- Is public Wi-Fi safe for work?Public Wi-Fi is much safer than it used to be because most websites and business apps now encrypt their traffic, but it still carries risks from fake hotspots, sign-in pages and poorly secured devices. Staff can work on it with care if their laptops are updated and protected, and a phone hotspot is the safer choice for anything sensitive.
- Does a small business need a password manager?Yes. A business password manager lets every staff member use a long, unique password for every account without remembering them, and lets you share logins safely and remove access when someone leaves. It replaces spreadsheets, notebooks and reused passwords, which are behind a large share of small-business account takeovers.
- Password rules for staff that actually workGood password rules today are simpler than the old ones: use long passphrases, never reuse a password, store them in a password manager, and change a password only when there's a reason to think it's exposed. Forcing frequent changes and complex symbol rules tends to make passwords weaker, not stronger.
- Shared logins in the office: the risks and safer optionsShared logins, such as one password for the accounts mailbox or the supplier portal, are convenient but make it impossible to know who did what and hard to remove access when people leave. Most can be replaced with individual accounts and shared access, and the rest should live in a password manager's shared vault with multi-factor sign-in.
- What is multi-factor authentication, and why does your business need it?Multi-factor authentication, or MFA, means signing in with your password plus a second proof, such as an app on your phone, a fingerprint or a security key. It matters because it stops most attacks that rely on stolen passwords, which is how the majority of small-business accounts are broken into.
- Text codes, apps or security keys: which MFA method should your staff use?Any multi-factor method is better than none, but they're not equal. Text message codes are the weakest, authenticator apps with number matching are a good standard for most staff, and passkeys or hardware security keys are the strongest choice for admins, finance staff and anyone who approves payments.
- Random MFA prompts on your phone: what an MFA fatigue attack isIf your phone asks you to approve a sign-in you didn't start, someone almost certainly has your password and is trying to get past multi-factor authentication. Deny the request, never approve it to make it stop, and change your password and tell IT straight away.
- Signs your work email account has been hackedThe clearest signs of a hacked work mailbox are emails in your sent items you didn't write, replies going missing, inbox rules or forwarding you didn't create, contacts asking about odd messages, and sign-in alerts from places you've never been. If you notice any of these, tell IT and change your password from another device at once.
- How to recover a hacked Microsoft 365 account, step by stepTo recover a hacked Microsoft 365 account, lock the attacker out first by resetting the password and revoking all sessions, then remove anything they added such as MFA methods, inbox rules, forwarding and app permissions, and finally work out what they saw or sent. Doing these steps in order matters, because a simple password change on its own often leaves the attacker a way back in.
- SPF, DKIM and DMARC explained in plain EnglishSPF, DKIM and DMARC are three settings on your domain name that tell other email systems which servers may send email for you and what to do with messages that fail the check. Together they make it much harder for scammers to send email that pretends to come from your exact address, and they help your genuine email avoid the spam folder.
- How to stop scammers pretending to be your businessYou can't stop scammers using your business name entirely, but you can make it much harder to pretend to be you convincingly. Enforce DMARC on your domain, watch for lookalike domains, protect your own mailboxes and domain registrar account, and tell customers clearly how you will and won't contact them.
- How to protect a small business from ransomwareRansomware is stopped by a short list of unglamorous controls: backups the attacker cannot reach, prompt patching, multi-factor sign-in on everything remote, no everyday admin rights and endpoint detection that can isolate a machine. Get those five right and most attacks fail or become an inconvenience instead of a shutdown.
- What a ransomware attack really costs a small businessFor most small businesses the ransom demand is not the largest cost: lost trading days, recovery labour, rebuilt systems, legal and privacy work and damaged customer trust usually add up to more. Working out your own number before an attack is the best way to decide how much prevention is worth.
- Recovering from a ransomware attack: the first 72 hoursIf ransomware has hit, isolate affected machines from the network but leave them powered on, call your insurer and IT provider, and report it to the NCSC before you start restoring anything. A careful first day matters more than a fast one, because restoring onto a network the attacker still controls means doing it all again.
- Why keeping your computers patched matters, and how to do itPatches close security holes that attackers already know about, often within days of the fix being published, so an unpatched computer is an open invitation. A simple routine that updates operating systems, browsers and business apps on a fixed schedule, and checks that it actually happened, removes a large share of real-world risk.
- Patching beyond Windows: apps, firmware and network equipmentMany small offices update Windows reliably but leave browsers, PDF readers, firewalls, network storage and printers months or years behind, and those are often the devices attackers reach first. Bringing them into a monthly routine with an inventory, a schedule and someone accountable closes a gap most businesses do not know they have.
- Antivirus vs EDR: what is the difference and which do you need?Antivirus blocks known malicious files; EDR (endpoint detection and response) watches what programs actually do, records it, and lets someone investigate and isolate a computer when behaviour looks like an attack. Most small offices now need EDR, because modern attacks rarely rely on a file antivirus already recognises.
- Should staff have admin rights on their computers?No: staff should do everyday work in a standard user account, because anything they run, including malware, inherits whatever rights they have. Removing local admin rights is one of the cheapest and most effective security changes a small office can make, as long as you plan how software gets installed afterwards.
- USB drives and removable media: risks and sensible rules for the officeUSB sticks and external drives are a risk in two directions: they can carry malware in and carry your data out, often unencrypted and easily lost. Most small offices should block them by default, allow only company-issued encrypted drives where there is a real need, and use cloud sharing for everything else.
- What to do when a work laptop is lost or stolenAct within the hour: report it to whoever manages your IT so they can lock or wipe the device and revoke its sign-ins, change the user's password, then confirm whether the disk was encrypted. If it was, the loss is mostly a hardware cost; if not, you may have a privacy breach to assess.
- Laptop encryption explained: BitLocker, FileVault and recovery keysFull disk encryption scrambles everything on a laptop's drive so it cannot be read without the user's sign-in or a recovery key, turning a stolen laptop from a data breach into a hardware loss. Windows uses BitLocker and Macs use FileVault; both are built in, and the main thing to get right is storing the recovery keys centrally.
- BYOD: how to let staff use their own phones for work safelyYou can let staff read work email and Teams on their own phones without managing the whole device: app protection policies keep company data inside approved apps, allow you to wipe only work data, and leave personal photos and messages alone. Pair that with a short written agreement and BYOD becomes a sensible, low-cost option.
- Cyber insurance questionnaires: what insurers ask and how to answer honestlyCyber insurers mostly ask the same dozen questions: MFA, backups, EDR, patching, admin rights, email security, staff training and an incident plan. Answer only what you can prove today, because an inaccurate yes can give the insurer grounds to reduce or decline a claim when you need it most.
- The Privacy Act 2020: what it means for your business ITThe Privacy Act 2020 applies to every New Zealand business that holds personal information, however small, and it expects reasonable security safeguards, limits on how long you keep data, care when it goes overseas and notification of serious breaches. Most of those duties translate into a handful of concrete IT habits.
- Notifiable privacy breaches: when and how to report in New ZealandA privacy breach is notifiable when it is likely to cause serious harm to the people whose information was involved; if so, you must tell the Privacy Commissioner and those people as soon as practicable. The judgement is yours to make, so assess quickly, record your reasoning and lean towards notifying when in doubt.
- How to write a simple IT security policy staff will actually followA useful security policy for a small business fits on two to four pages: it sets out what staff must do with passwords, devices, email, data and incidents, in plain language, and names who is responsible. The goal is clear expectations people can follow, not a document written to impress an auditor.
- How to write a cyber incident response plan for a small businessA small business incident response plan should be a few pages that tell people who is in charge, what to do in the first hour, who to call, how to communicate when email is down and which systems to restore first. Write it before you need it, print it, and practise it once a year.
- How to report a cyber incident to the NCSC in New ZealandNew Zealand businesses can report cyber incidents, from scam emails to ransomware, to the National Cyber Security Centre, which absorbed CERT NZ's reporting service. Reporting is free and confidential, can get you practical advice, and helps warn others; it does not replace calling your bank, Police or insurer where those are needed.
- IT security when staff leave: an offboarding checklist that worksWhen someone leaves, remove their access on their last working day, or immediately if the departure is sudden, then deal with their mailbox, files, devices, shared passwords and any third-party accounts in a set order. A written checklist stops the usual gaps, such as a former employee still receiving email months later.
- Supplier and third-party cyber risk: what small businesses should checkYour security is only as strong as the suppliers who hold your data or can reach your systems: cloud software providers, IT contractors, payroll bureaus and even the company that maintains your phones. Know who they are, ask them a few sensible questions, limit their access and plan for what you would do if one of them is breached.
- Cyber security for remote and hybrid workersRemote staff are safest on a managed company laptop that signs in to cloud services with MFA, keeps itself patched and encrypted, and does not depend on the home network being secure. Add a few clear rules on home Wi-Fi, public networks, printing and family use, and working from home carries little more risk than working in the office.
- Should you pay a ransomware demand?In almost every case, no: paying does not reliably get your data back, does not stop stolen data being leaked, funds the next attack and marks you as willing to pay again. New Zealand government guidance discourages payment, and the far better position is having backups that make the question irrelevant.
- A practical security baseline for New Zealand small businessesA small set of core controls stops most attacks on small businesses: patching apps and systems, controlling what software can run, tightening Office macros and browsers, limiting admin rights, using MFA and keeping tested backups. Australia's Essential Eight groups these well, and the same ideas suit New Zealand offices without needing a formal framework.
- How to run a cyber tabletop exercise for your businessA tabletop exercise is a guided discussion where your key people walk through a realistic cyber incident, step by step, to test the plan and find the gaps before a real attack does. For a small business it takes about an hour, needs no special tools and usually turns up several practical fixes.
- Dark web monitoring explained honestlyDark web monitoring services search collections of leaked data for your business email addresses and domain, and alert you when staff credentials appear. It is a useful early warning, but it cannot remove the data, sees only what the provider has collected and is no substitute for MFA and unique passwords.
- How to tell if your business has been hackedMost compromises are quiet: the signs are odd sign-ins, unexpected mailbox rules, new admin accounts, security tools switched off, unfamiliar remote access software or customers receiving emails you did not send. If you see any of these, assume an intruder may be active, avoid tipping them off and get help to investigate.