In an effort to strengthen the cybersecurity defences of small and medium-sized businesses (SMBs), the National Cyber Security Centre (NCSC) unveiled a new guide – Using Online Services Safely. 

The guide, which is geared towards organisations without dedicated IT or support staff, aims to mitigate the potential impact of cyber-attacks on businesses which rely on online services. 

“This is specifically written for small and medium sized enterprises (SMEs), who may be overwhelmed by our existing cloud security guidance,” wrote Amelia H of the NCSC’s Economy and Society team. 

“It’s important that they are set up in such a way that they’re safe from online risks, whilst also reflecting your organisation’s priorities,” she continued. 

The guidance comes in the midst of an increased reliance on cloud and online services, which was accelerated by the surge in remote work following the pandemic. 

“Many SMEs already rely on online services for day-to-day tasks, even if they’re not aware of it. This includes email and instant message communications, cloud storage, website/shop hosting, online accounting and invoicing, or simply using social media to engage with customers,” said Amelia.

Recommended reading

• NCSC Reveals Russian Cyber Interference in UK Politics
• Report: SMBs Facing Growing Cyber-threats in 2023
• How are Tightening Budgets Affecting UK SMB Ransomware Fears?

In a report from April 2023, almost one third of UK businesses experienced a security breach or cyber-attack in the preceding 12 months, and that number rose to 59% when just looking at SMBs. 

The new guide is therefore a proactive guide empowering SMBs to safeguard their online operations. The guide, spanning 10 pages, offers practical advice on essential cybersecurity measures, such as choosing the right service, data backup, domain name security, creating and securing user/admin accounts, and defending against malware.

Additionally, it provides insights into leveraging built-in security features of popular cloud services and recovering hacked accounts or services post-cyber-attack.