Cyber security is one of those words that most people don’t think applies to them because it brings to mind shiny office blocks and hackers in basements. Cyber security breaches are things that banks and governments have to think about, not sole traders who don’t even have a proper office, right? Not so much.
How many of us keep all of our clients details on our phones, not to mention banking apps, emails, photos of jobs, and WhatsApp chats containing sensitive details? How many of us think nothing of nipping into the shop and leaving the phone (or the paper booking details, quote or diary) on the passenger seat? If your van gets broken into and your phone or paperwork is stolen, that could expose sensitive information and potentially constitute a personal data breach. It could also be an enormous pain in the posterior, because most of us don’t bother backing our phones up, and most of us use them as a mobile office.
This isn’t an article designed to frighten the bejesus out of you but because most digital security advice is written for people with offices and IT departments and the time to get this stuff sorted out. I wanted to write a guide for people doing everything themselves, about how you can keep things safer without spending lots of time or money you don’t have.
Passwords
I know it. We need passwords for everything and remembering them all is impossible, so using the same one for everything seems like a good idea, and if it’s something you can remember easily, like your birthday or your dog’s name, so much the better. The problem with this approach is that it’s pretty easy to guess a password that relates to something or someone in your life. But having a different and strong password for everything is impossible to manage and forgetting the password to something crucial, like a banking app can throw your whole day off.
The answer is to use a password manager. There are lots to choose from, including free options like Bitwarden, Proton Pass and Google Password Manager. Setting them up is more straightforward than you imagine and once done you only have to remember one (strong) password. As an added bonus, these password managers all create unique passwords too, so variants on birthdays and names will be a thing of the past.
I would also strongly recommend setting up two step or multi-step verification where it’s available or suggested. If someone gets hold of your password, two-step verification adds another layer of security and can help prevent them accessing your account.
Phone Security
Step one here is, you guessed it, a strong password. Use a random pin of at least six digits, rather than something that can be guessed such as a date or the last few digits of the telephone number. Set up fingerprint or face recognition too, it takes seconds on new smartphones. And while you’re thinking about it, switch on Find My (or the equivalent on your phone), which can help you locate your phone, lock it remotely and, if necessary, erase its data. Check how to suspend payment cards in your digital wallet if your phone is stolen while you’re at it.
Clear the dashboard.
If you regularly work from your car or van between jobs, sending invoices and quotes, taking notes from a client enquiry and updating your diary or delivery route on the fly, the likelihood is that you could have sensitive information just lying around on view.
It's not likely that an opportunist thief will break in to steal your scribbled notes about Mrs Jones of Smith Avenue's kitchen, dog or childcare issue. But what if those notes include her phone number, details of when she's away from home, or instructions for getting into her property? And what about the quotes, job sheets and customer lists that could tell someone else who you're working for, what you're charging and where you'll be next? If you subcontract for other businesses, you may also be handling information that isn't yours to share, from customer details to project plans and pricing.
The simple rule is to keep sensitive information out of sight when you're not using it. Put paperwork away, lock your van and avoid leaving notebooks, job sheets or documents where they can be seen through a window. It's a small habit that helps protect your customers, your business and the people you work with.
Don’t share the work laptop
Not easy if it’s the only one and the kids need it for homework, so making sure your anti-virus software is up to date, and your firewall is on are the bare minimum. It’s possible to have separate user accounts on a single laptop or PC, with separate permissions, passwords and desktop, which adds a layer of security if your children download games and music. If you upgrade and give your children your old laptop wipe any sensitive data first to reduce the risk of someone accessing your personal or business information. This goes for any old tech that you are thinking of selling. Factory reset the device before you send it anywhere out of your immediate control. Make sure you follow the manufacturers instructions for this step to make sure all data is erased, and don’t forget to back everything up first.
Keep your email account secure
For most of us, access to our email accounts grants us access to pretty much everything else. How many times have you forgotten a password and need to get a code sent to your email so you can reset it? I’ve certainly done it more than once. Being permanently logged in on your phone or laptop is fine if you don’t share these devices, but if you do, make sure you log out before handing either to someone else, even if it is a member of your family. If you regularly use café or hotel Wi-Fi, be cautious about the networks you connect to. Check that the web addresses look genuine, keep your devices updated and avoid ignoring security warnings.
Scams and phishing
Nobody thinks they’re going to fall for a scam until they do. It’s probably happened to all of us - mine was being fooled into thinking the website link I’d clicked on was the HMRC self-assessment page. Luckily I noticed the web address and didn’t input anything, but it was a close run thing and has made me much more wary about clicking on Google search results. If you get an email from a supplier you’ve used for years telling you they’ve changed their bank details, make sure the email address is legitimate, and if in doubt contact them direct on a number you already have (not the one in the email) to ask.
Back it up
If your laptop stopped working tomorrow, what would you lose? If the answer is anything important, make sure you have a backup. Automatic cloud backups are worth setting up, so you don't have to remember to do it yourself. And those software update notifications you keep putting off? Many include security fixes, so don't keep ignoring them, even if they are super annoying. Set the updates to run overnight so they have less of an impact.
One more thing here - think about anyone who's had access to your accounts in the past. Maybe someone helped with your books or set up your website. Check they no longer have access if they don't need it. Change passwords or remove their login details where necessary.
What about AI
I love AI and I think it can be a game changer for sole traders in many ways, but it’s not just a powerful tool for nice people like us. It’s being used by bad actors too, and the ways they use it are getting more sophisticated and harder to spot all the time. Cloned voices generated by AI are of increasing concern, and what’s most troubling is that they play directly on our emotional response to someone we love being in trouble.
The scam works like this – you get a call from someone in your immediate circle and that someone has had an accident, been arrested or left stranded somewhere, and they need your help. You believe them of course, because it sounds just like them, and you act fast, because the situation is urgent. And that’s where the scammer gets you. The whole thing hinges on not giving you time to think and rationalise. There are versions of this that appear to come from employers, suppliers and banks and they all work in a similar way.
The rule for dealing with this is the same for any scam, whether it’s by email, voice or text. Never give your bank or card details or any PINs, security codes or passwords out to someone who has called or emailed you, and particularly if they want you to act quickly. Always call the bank/supplier/family member on the number you already have for them and not the one they want you to call, so that you can independently verify what’s going on.
AI can sometimes help you identify warning signs in a suspicious message, but it can get things wrong. Remove personal and confidential information before sharing anything and verify suspicious requests independently. Don't rely on AI alone to decide whether something is genuine. Above all else, don’t act immediately, take some time to decide whether the request is likely to be genuine.
Do these three today
I hope I haven’t put the fear of God into you, but I also think that knowledge is power, and forewarned is forearmed. Doing everything on this list immediately isn’t realistic for most of us, but gradually working through it over the next few weeks should be. And if you’re itching to start on your cyber security today, do these three things first. They should all be pretty straightforward and a really good starting point:
Turn on two-step login for your email
Check your phone has a proper lock and Find My switched on
Check your work stuff is backing up somewhere other than the device itself
If you want to know more about cyber security, how the latest scams are affecting businesses in the UK and where to report cyber attacks and scams check out the links below. And if you need help getting your business information organised so you can find what you need when you need it, get in touch at hello@inthefieldai.com
UK Government cyber security guidance for businesses