Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Protecting a small business starts with the same controls that stop most serious intrusions: require strong, phishing-resistant multi-factor authentication (MFA), patch known exploited vulnerabilities quickly, restrict remote access, train people to report suspicious messages, keep isolated encrypted backups, and rehearse how you will respond. CISA, the FBI and NSA describe spearphishing, brute-force login attempts and exploitation of known vulnerabilities as historical methods used by Russian state-sponsored actors. That describes a threat pattern, not proof that every small business is being specifically targeted.
What the Russian cyber threat means for a small business
Russian state-sponsored groups have historically gained access through three practical routes:
- Spearphishing: targeted email or messaging that persuades someone to open a file, follow a link, reveal a password or approve a sign-in.
- Brute force: repeated attempts against weak, reused or exposed passwords, especially where MFA is absent.
- Exploitation of known vulnerabilities: attacking internet-facing software, appliances and services that have a security fix available but have not been patched.
These techniques are not unique to Russian actors, and an advisory about state-sponsored activity is not a forecast that a particular firm will be attacked. They are useful because they point to weaknesses a small business can actually reduce. The objective is not to build a classified-grade security operation. It is to make the common paths into your email, cloud files, remote-access tools and business network difficult, visible and recoverable.
Start with a risk-based inventory
You cannot protect an account or device you have forgotten exists. Make a short inventory before changing settings. Record the owner, purpose, internet exposure and recovery method for each item:
Recommended Free Tools
- Business email and identity accounts, including administrator and former-employee accounts.
- Cloud storage, accounting, payroll, customer-management and payment systems.
- Remote desktop, virtual private network (VPN), remote-support and vendor-maintenance services.
- Firewalls, routers, Wi-Fi controllers, cameras, printers and other internet-connected equipment.
- Laptops, desktops, servers and mobile devices that access business data.
- Where critical data is stored, how it is backed up, and who can restore it.
Mark systems that are exposed directly to the internet, use administrator privileges, or contain sensitive customer, employee or financial information. Those systems receive the earliest attention. Remove accounts and services that have no legitimate owner or business purpose.
As an Amazon Associate I earn from qualifying purchases.
Protect every important account
Require MFA where an attacker would gain leverage
Enable MFA first for email, file storage, remote access, administrator accounts and any service that can reset other passwords. A stolen password should not be enough to enter. CISA advises businesses to aim for phishing-resistant MFA and to use the strongest method their service supports.
Use separate administrator accounts for administrative work and ordinary accounts for email and daily tasks. Do not share logins. Give each employee only the access needed for the job, review privileges when duties change, and disable accounts promptly when someone leaves.
Free tools Windows power users keep installed
One-click scans. No signup required.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Compare practical MFA choices
| Method | Resistance to phishing | What to verify | Operational considerations |
|---|---|---|---|
| FIDO2/WebAuthn security key | Strongest among the commonly available choices because the key verifies the genuine website origin | Whether email, cloud, VPN and administrator systems support FIDO2/WebAuthn; whether employees can enroll more than one key | Issue a spare or documented recovery method, protect the keys physically, and test account recovery before making the method mandatory |
| Built-in device passkey or platform authenticator | Generally phishing-resistant when implemented as a passkey | Device and operating-system support, synchronization policy, and how a replacement device is enrolled | Usually convenient, but recovery and device replacement need written procedures |
| Authenticator-app code | Better than a password alone, but codes can still be relayed during a phishing attack | Whether the service supports app-based MFA and how seeds are backed up or transferred | Plan for a lost or replaced phone; do not let a help-desk reset bypass identity checks |
| Text-message code | Weaker; vulnerable to phone-number takeover and interception | Whether stronger methods are available and whether SMS can be disabled after enrollment | Use only when a stronger supported option is unavailable, and protect the underlying account with additional controls |
A hardware key is a category, not a particular brand recommendation. Confirm compatibility with every critical service, buy enough for staff and spares, and document what happens if a key is lost. A recovery process that silently falls back to an easily phished channel can undo the benefit of strong MFA.
Strengthen passwords and recovery
- Use a unique, long password for every service; a reputable password manager can generate and store them.
- Block known compromised passwords where the service provides that control.
- Protect password-manager and email accounts with the strongest available MFA because they can unlock other systems.
- Review recovery email addresses, phone numbers, delegated access and application tokens. Remove anything no longer controlled by the business.
- Alert on new administrator creation, password resets, MFA-method changes and unusual sign-ins.
Patch the weaknesses attackers already know
Keep operating systems, browsers, routers, firewalls, VPN appliances, business applications and plugins updated. CISA’s Russia overview states: “Prioritizing patching of known exploited vulnerabilities is key to strengthening operational resilience against this threat.” Treat that as a triage rule: a vulnerability known to be exploited in the wild outranks a merely convenient update.
A workable patch routine
- List versions and owners. Record the software, device model, current version, internet exposure and person responsible for updates.
- Use vendor security notices and CISA advisories. Identify known exploited issues that affect your versions.
- Patch exposed and privileged systems first. Prioritize internet-facing gateways, remote-access services, identity systems and devices holding sensitive data.
- Back up configuration before a high-impact change. Keep a tested way to restore a firewall, router or critical application if an update fails.
- Test and verify. Confirm the installed version, check that remote access and business functions still work, and close the change ticket only after verification.
- Compensate when an immediate patch is impossible. Disable the exposed feature, restrict it to a management network, block external access or replace the unsupported product. Record an owner and deadline rather than leaving an exception open-ended.
Automatic updates are useful for supported desktops and browsers, but they do not replace an inventory. Network appliances, line-of-business applications and old equipment often require a separate maintenance process.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Reduce remote-access and lateral-movement risk
Remote access is valuable to a small business and attractive to attackers. Keep only the services you need, require MFA for each necessary service, and monitor their use. Disable unused remote desktop, administration interfaces and vendor accounts. Do not expose a management panel directly to the public internet when a private access method is available.
Apply practical restrictions
- Allow remote administration only from approved users, devices or network locations where your systems support that policy.
- Separate ordinary user networks from servers, backups, payment systems and device-management interfaces. A compromise on one workstation should not automatically provide a path to everything else.
- Use individual accounts and time-limited vendor access instead of permanent shared credentials.
- Review remote-access logs for sign-ins at unusual times, unfamiliar locations, repeated failures and new devices.
- Replace unsupported remote-access products and remove software that no one can explain or maintain.
Detailed segmentation and monitoring recommendations in federal guidance aimed at critical infrastructure may require more skill than a very small firm has internally. Adapt the principle to your environment: start by isolating the systems whose compromise would stop operations, and obtain qualified help for changes that could interrupt the business.
Make phishing harder to succeed
Technical controls cannot identify every convincing message. Give staff a short, repeatable reporting procedure: use the mail client’s report function or forward the message to the person responsible for security, then stop interacting with it. Encourage early reporting without punishment; a fast report can allow the business to revoke a session or reset a password before damage spreads.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Train for the decisions people actually face
- Check the sender address and the destination of links rather than trusting a familiar display name.
- Be suspicious of urgent requests to change bank details, buy gift cards, share invoices, approve MFA prompts or open an unexpected document.
- Verify payment and account-change requests through a known phone number or a second channel.
- Never approve an MFA prompt you did not initiate. Report repeated prompts as a possible attack.
- Use a separate channel to confirm a message that appears to come from an executive, supplier or customer.
Include owners, contractors and temporary staff in training when they can access business systems. Keep the lesson short, refresh it after a real incident or near miss, and make sure the reporting route works from a locked or isolated device.
Build backups that survive ransomware
A backup that an attacker can delete, encrypt or silently corrupt is not a dependable recovery plan. Keep copies of critical data offline or otherwise isolated from ordinary administrator credentials, encrypt them, and test restoration. Include email, shared files, accounting records, customer information, configurations and any data required to continue essential work.
Define and test recovery
- List the processes that must resume first, such as accepting orders, paying staff, serving customers or meeting regulatory obligations.
- Assign a recovery owner and a second person who can act if the owner is unavailable.
- Set a backup schedule that matches how much data the business can afford to lose.
- Protect backup administration with separate credentials and MFA; do not reuse the domain administrator password.
- Restore a representative file and a complete critical system on a schedule. Measure how long it takes and record what failed.
- Keep at least one copy unavailable to routine network access. Check that it is usable before an emergency, not only after an alert.
Restoration tests reveal problems such as missing encryption keys, expired licenses, incomplete application data and staff who do not know the recovery sequence. Fix those findings while systems are healthy.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Log enough to investigate
Turn on available logging for email sign-ins, MFA changes, administrator actions, password resets, remote access, firewall activity and backup jobs. Retain logs long enough to investigate a delayed discovery, protect them from ordinary users who might alter them, and check that critical alerts reach a person who is actually on duty. You do not need a large security operations center to benefit from a daily review of failed logins, new privileged accounts, disabled backups and unusual remote sessions.
Prepare an incident-response and continuity plan
Write down who can make urgent decisions, who owns technology, who speaks to employees and customers, who contacts insurers or legal advisers, and how to report an incident. Keep a printed or offline copy because the normal email and file systems may be unavailable.
If compromise is suspected
- Isolate affected systems. Disconnect a suspected computer from networks, disable a compromised account and restrict remote access. Do not wipe systems before preserving evidence unless safety or operational necessity requires it.
- Protect backups. Disconnect backup systems from potentially compromised credentials and pause automated jobs that could overwrite clean copies.
- Preserve and review evidence. Note times, users, devices, messages, alerts and actions taken. Save relevant logs and suspicious files in a controlled location.
- Call qualified support when needed. A provider with incident-response experience can help scope the compromise, contain it and determine whether credentials or data were exposed.
- Report through official channels. Use the reporting route your plan identifies for CISA or the FBI, and meet any contractual, regulatory or breach-notification duties that apply to your business.
- Recover deliberately. Reset credentials from a clean device, patch the entry point, restore from a verified clean backup and monitor closely for re-entry.
Do not negotiate, delete evidence or announce a conclusion about who attacked you based only on an email, IP address or malware name. Attribution is difficult; containment and recovery come first.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsBest Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Keep the business operating during an outage
For each critical process, define a manual or alternate method that can run for several days: a phone-based order process, offline customer contact list, printed payment instructions, alternate communication channel or temporary workspace. Decide in advance which systems may be taken offline and who can authorize that decision. Include suppliers and outsourced IT contacts in the plan, along with current phone numbers stored outside the affected systems.
Run a tabletop exercise at least once a year. Give participants a realistic scenario, such as a locked email account followed by an unavailable file share, and make them practice contacting each other, isolating devices, accessing backups and informing customers. Record decisions that were unclear and update the plan.
Use outside help without surrendering responsibility
CISA provides no-cost cyber-hygiene resources and guidance for managed service providers and small and medium-sized businesses. A firm without in-house expertise can ask a qualified provider to review MFA coverage, patching, backup isolation, restoration tests, remote access and incident-response readiness. Paid help is not automatically required, and no provider should be treated as endorsed merely because it offers a security service.
Questions to ask a prospective provider
- Will you inventory accounts, devices, internet-facing services and unsupported software?
- How will you verify that MFA covers email, remote access and privileged accounts, and that recovery methods are secure?
- Who owns patches, emergency updates and exceptions, and how will completion be documented?
- Are backups isolated from normal administrator credentials, and will you perform and report restoration tests?
- What happens at night or on weekends if ransomware or account takeover is suspected?
- Which logs and reports will the business receive, and how will access to them be protected?
Keep ownership of the accounts, backup keys, asset list and response plan. A contract that leaves the business unable to recover when the provider is unavailable is not resilience.
Quick Recap
A practical 30-day implementation plan
| Time frame | Actions | Evidence of completion |
|---|---|---|
| Today | Secure email and administrator accounts with MFA; remove former users; confirm backups are running; identify an incident contact. | Account list, MFA status, backup status and contact sheet stored offline |
| Days 2–7 | Inventory devices and internet-facing services; patch known exploited vulnerabilities; disable unused remote access; verify recovery addresses and MFA methods. | Asset register, patch records, remote-access review and recovery test |
| Days 8–14 | Separate administrator and ordinary accounts; restrict vendor access; review firewall and remote-access logs; train staff on reporting and payment-change verification. | Privilege review, vendor-access list, sample log review and training record |
| Days 15–21 | Test restoration of critical data; confirm backup isolation; document the order in which systems must return; gather official reporting contacts. | Successful restore record, recovery priorities and response checklist |
| Days 22–30 | Run a tabletop incident exercise; fix gaps; schedule recurring patch, access, backup and restoration reviews. | Exercise notes, assigned owners and calendar of recurring checks |
Common mistakes that leave small firms exposed
- Turning on MFA only for ordinary users: attackers target administrators and recovery accounts because they unlock more systems.
- Installing updates only when something breaks: delayed patching leaves known entry points open.
- Keeping backups permanently connected: ransomware that reaches the network may reach the backup as well.
- Allowing shared logins: you cannot tell who acted, revoke one person’s access cleanly or enforce individual MFA.
- Leaving remote desktop exposed: a convenient service can become a password-guessing target.
- Assuming a backup is good because a job completed: only a restoration test proves that the data and the recovery process work.
- Waiting for certainty before reporting: early containment is more valuable than a confident attribution made too late.
Security checklist for owners
- Every email, remote-access, file-storage and privileged account uses MFA, preferably phishing-resistant MFA where supported.
- Passwords are unique, administrator access is limited, and shared accounts are removed.
- Known exploited vulnerabilities and critical software updates have named owners and deadlines.
- Unused remote-access services are disabled; necessary access is restricted, authenticated and monitored.
- Employees know how to report phishing, unexpected MFA prompts and payment-change requests.
- Critical backups are encrypted, isolated from ordinary credentials and restored in scheduled tests.
- Logs cover sign-ins, privilege changes, remote access and backup activity, with someone assigned to review them.
- The business has offline contacts, an incident-response sequence, reporting routes and a continuity method for essential work.
How to protect a small business from Russian hackers: the priority order
Do not begin with an expensive tool or an attribution exercise. Begin by closing the accounts and vulnerabilities most likely to provide access, then make recovery independent of the compromised network. Strong MFA, prompt patching, restricted remote access, trained reporting, isolated tested backups and a practiced response plan address the historical methods identified by CISA, the FBI and NSA while improving resilience against many other criminal and state-sponsored threats.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
