A convincing email about an overdue invoice can cost a small business more than a broken laptop. A text pretending to be from a bank can expose a household’s savings in minutes. Cyber security is not just a concern for large companies with IT departments. It is the everyday work of protecting the accounts, devices and information you rely on.
For homes, remote workers and small businesses, the goal is not to turn everyone into a security expert. It is to put sensible protections in place, know what warning signs to look for, and have a clear plan when something does not seem right.
Why cyber security matters locally
Most cyber incidents do not begin with an advanced technical attack. They begin with a rushed click, a reused password, an unpatched computer, or a caller who sounds believable. Criminals target people and smaller organisations because they know there may not be dedicated support staff checking every email or monitoring every device.
The impact can be immediate. A compromised email account may be used to reset passwords for other services. A fake invoice can redirect a payment. Ransomware can lock important files, while a stolen mobile can give someone access to banking apps, email and saved passwords.
For a sole trader, even a short interruption can mean missed bookings, delayed quotes and unhappy customers. For households, the concern is often personal photos, tax records, school accounts and financial information. The right approach depends on what you use and what you stand to lose, but a few basics make a major difference.
Start with the accounts that matter most
Your email account is usually the key to your digital life. If someone gains access, they can often request password resets for shopping, social media, cloud storage and banking services. Give it the strongest protection first.
Use a long, unique password for every important account. A password manager is often the easiest option because it creates and stores complex passwords without requiring you to remember each one. The key is to protect the password manager itself with a strong master password and multi-factor authentication.
Multi-factor authentication, sometimes called two-step verification, adds a second check after your password. This may be an approval prompt in an authenticator app, a code, or a physical security key. App-based prompts are generally preferable to SMS where available, although SMS is still better than using a password alone.
Passkeys are also becoming more common. They let you sign in using your device’s screen lock, such as a PIN or fingerprint, rather than typing a password. They are convenient and can reduce the risk of fake websites stealing login details. They are not available everywhere yet, so use them where offered and keep multi-factor authentication enabled on critical accounts.
Recognise phishing before it reaches your wallet
Phishing messages are designed to create urgency. They may claim your account will be closed, a parcel is waiting, a payment has failed or a customer has sent an invoice. The message might use a familiar logo and look polished, but appearance alone is not proof it is genuine.
Pause before opening an attachment, scanning a QR code or following a link. Check the sender’s full email address, not just the display name. Look for odd wording, unexpected requests and pressure to act immediately. If a bank, supplier or government service contacts you, open the official app or type its known web address into your browser instead of using the message link.
Payment requests deserve an extra check. If a supplier sends new bank details, call a trusted number you already have on file. Do not rely on a phone number in the email, as the message itself may be fraudulent. For businesses, a simple verification process for changed payment details can prevent an expensive mistake.
If you have clicked something suspicious, do not panic. Disconnect from the internet if a file has started behaving strangely, change passwords from a known-clean device, and contact your bank promptly if payment or card information was involved. Acting quickly can limit the damage.
Keep devices updated and protected
Updates can feel inconvenient, especially when you are trying to start work. However, operating system, browser and software updates often fix security weaknesses that criminals actively look for. Set computers, mobiles and tablets to install updates automatically where practical, then restart them when prompted.
Use reputable security software on Windows computers and make sure the built-in protections on your devices are enabled. For Macs, mobiles and tablets, updates, strong screen locks and careful app choices are particularly important. No device is completely immune from scams or malicious software.
Only install applications from recognised sources, and avoid software that promises to clean, speed up or repair a device unless you trust the provider. Free downloads can carry unwanted programs that display ads, collect information or create security problems later.
For business devices, separate work and personal use where possible. A staff member’s personal downloads, shared family computer or unsecured browser extensions can introduce unnecessary risk. This does not always require expensive systems, but it does require clear boundaries and regular maintenance.
Protect your Wi-Fi and home office setup
Your internet router is the front door to your network. Change the default router administrator password, install firmware updates when available, and use WPA2 or WPA3 Wi-Fi security with a strong network password. Avoid sharing the main Wi-Fi password widely, particularly if customers, guests or contractors visit your premises.
A guest network is useful when your router supports it. It keeps visitors’ devices separate from the computers, printers and storage devices you use every day. This is especially worthwhile for home businesses that handle client information.
Remote work also needs a little discipline. Lock your screen whenever you step away, keep papers containing customer details out of sight, and avoid connecting to public Wi-Fi for sensitive tasks. If you must use public Wi-Fi, use your mobile hotspot where possible and avoid logging into banking or business administration accounts until you are on a trusted connection.
Back up what you cannot replace
Backups are one of the most practical forms of cyber security. They help when a device fails, is stolen, is affected by ransomware, or is simply damaged by an accidental spill. Cloud storage is useful, but synchronised files alone are not always a complete backup. If a file is deleted or encrypted and that change syncs everywhere, you may need version history or a separate backup copy to recover it.
Keep at least one backup separate from your main computer. For many households, this means cloud backup plus an external drive stored safely. Small businesses may need a more structured setup, including automated backups, retention periods and routine checks that files can actually be restored.
Focus first on irreplaceable material: family photos, financial records, customer files, quotes, invoices and business documents. A backup that has never been tested may provide false confidence, so periodically restore a few files and confirm they open correctly.
Give your small business simple security rules
Security procedures do not need to be long or complicated. They need to be understood and followed. If you have staff, contractors or family members helping in the business, make expectations clear: use individual logins, never share passwords by email or text, verify payment changes, lock devices and report suspicious messages early.
Limit access to information people genuinely need. The person handling appointments may not need access to accounting records, and a former employee should not retain access to business email, cloud files or social media accounts. Review access when roles change, not months later.
It is also worth writing down a short response plan. Include who to contact, where important account recovery details are held, how to notify your bank, and how to access backups. During a stressful incident, a straightforward checklist is far more useful than trying to remember every step.
When to ask for help
Some issues need fast, practical support. Repeated pop-ups, unknown software, login alerts you did not request, a slow computer after opening an attachment, or files that suddenly will not open are all reasons to get advice before continuing to use the device.
Likewise, if you are setting up a new computer, home office, printer or small business network, it is a good time to check security settings rather than leaving them for later. Tech Experts can assist on-site or remotely with practical device setup, updates, backups, Wi-Fi security and account protection for customers across Wellington, Hutt Valley and Porirua.
Good security is not about being fearful every time your phone buzzes. It is about building a few reliable habits so a suspicious message, lost device or technical fault does not become a much bigger problem.