Your Data and Layered Defense

A plumber with nine employees does not think of herself as a data company. But look at her laptop. It holds the customer list, the invoices, the bank login, the employees' Social Security numbers for payroll and the photo of the check that came in Tuesday. If that laptop vanished tonight, the business would limp for weeks.

That is the starting point for the whole course. Your business is already a data business. The only open question is whether you protect the data on purpose or by luck.

What data does a small business hold?

Walk through your own shop and write down what you find. Most small firms hold more than the owner expects, and most of it is somebody else's information that you are trusted to keep.

Notice the last row. Control of a business email account is worth more than almost any other single thing a criminal can get, because "forgot password" links go to that inbox. It is also where fraudsters read your real invoices and then copy them.

Where does it live: local or online?

Two words come up constantly, so define them now. The cloud means computers owned and run by another company, reached over the internet. When your email sits on a provider's servers and not on a machine in your closet, that is the cloud. SaaS (software as a service) is a program you rent and use through a browser or app: online accounting, payroll, a booking system, Microsoft 365, Google Workspace. An endpoint is any device a person uses to reach the data: laptop, desktop, phone, tablet. Endpoints are where data is opened, copied, emailed and lost.

Most small businesses are a mix, and that matters, because each location has a different kind of weak spot.

Moving to the cloud does not make the risk disappear. It moves some of it to a company with a full-time security staff and leaves the rest with you, mostly the sign-in and the settings. Lesson 4 spells out who owns what.

Why small businesses get targeted

Owners often say, "Why would anyone bother with us?" Criminals do not pick targets one at a time by name. They run automated scans and mass emails and then work whoever answers. A business with 12 people and an unpatched laptop is a fine result.

The numbers, as of October 2026:

• The FBI's Internet Crime Complaint Center (IC3) received 1,008,597 complaints in 2025, with reported losses of $20.877 billion (2025 IC3 report). The report does not break out small businesses as a group, so be careful with anyone who tells you a precise small-business share from it.
• Business email compromise (BEC) ranked second by losses: 24,768 complaints and $3,046,598,558. Divide the money by the complaints and you get about $123,000 per complaint. That is a rough average of reported cases, and a few very large losses pull it up, but it is the size of money a fake invoice can move.
• Ransomware: 3,611 complaints with adjusted losses of $32,320,105 in the IC3 data. Many victims never file, so treat that as a floor, not the whole picture.
• Verizon's 2026 Data Breach Investigations Report says 31% of breaches began with exploited software vulnerabilities, ahead of stolen passwords as the top entry method, and that ransomware was involved in 48% of breaches studied (Verizon DBIR). Those figures cover all sizes of organization. They still point at two plain jobs for a small shop: keep software updated and keep backups.
• IBM's 2026 Cost of a Data Breach report puts the global average cost of a breach at about $4.99 million (IBM). That average is dominated by large organizations. Do not read it as the bill a 10-person shop would face. Read it as proof that the cost of cleanup is far higher than the cost of prevention.

Why small firms in particular? A short list of reasons from the field, none of them mysterious. Small firms usually have no one watching the systems. They often hold payment ability, because the owner can approve a wire with one phone call. They are connected to bigger companies as vendors, so a hacked small supplier is a way into a large customer. And owners are busy, which is exactly what a rushed-invoice scam counts on.

Layered defense, with an office analogy

Think about how you protect the physical office. You do not rely on one lock. There is a door lock, but also a back door that gets checked, a safe or locked drawer for the cash and the checkbook, a key list so you know who has one, an alarm or at least a neighbor who would notice, a camera, a fire extinguisher, insurance, and a copy of the important papers stored somewhere other than the office. If a thief gets past the door lock, the locked drawer still stands between him and the checkbook. If there is a fire, the offsite copy of the papers means you can reopen.

Layered defense (also called defense in depth) applies the same thinking to data. Each layer is imperfect. Together they make the attacker's job much harder and your recovery much shorter.

Figure: five rings of protection around the data. An attacker has to get through several, and a mistake in one ring does not hand over the data.

Those layers also map to four jobs. Security people use the words prevent, detect, respond and recover. NIST's Cybersecurity Framework 2.0 uses similar ones, and its small business quick start guide adds a sixth, "govern," which just means the owner decides and owns the plan (NIST SP 1300).

Most small firms put all their effort into prevent and almost none into recover. That is backwards. Prevention will fail sometime, because humans are in the loop. The business that survives a bad day is usually the one that can restore its files by lunch.

Who does what

In a business with no IT department, three kinds of people share the work. Writing it down avoids the common failure where everyone assumes someone else handled it.

If you have no outside IT provider, the owner and the person who handles the office share that third column, and the checklists in this course are written so a careful non-technical person can do them. If the job grows past an afternoon, that is the time to hire help for the technical parts.

How to use this course

Eleven lessons build on one another, but each one stands on its own. If you are short of time, read the Start here box and the "Do this this week" list in each lesson first, and do those items. Come back to the rest when you can.

• Lesson 2 covers accounts, passwords and two-step sign-in. If you only do one lesson, do this one.
• Lesson 3 covers computers, local data and backups, including ransomware.
• Lesson 4 covers cloud services, shared files and the settings in Microsoft 365 and Google Workspace.
• Later lessons cover secure email and browsing, networks and remote work, phones, scams aimed at businesses, payment cards and records, what to do when something goes wrong, and policies, training and a 90-day plan.

Laws and standards get only a pointer here. The companion management course covers them in depth, starting at why management owns risk. If your concern is the computer at your kitchen table, the home computer course at home computer security covers it.

Every lesson ends with a Reporting angle (where to report a problem and what evidence to keep) and a Research angle (primary sources to read). Prices and screens change. Where a lesson names a setting in a product, it points to the vendor's own help page, because menu names move.

Questions and answers

Do I really have to do all of this?

No. Do the "Do this this week" list in each lesson and you will be ahead of most small firms. The rest is there for when you have time or when a client, bank or insurer asks.

What is the single most useful thing I can do?

Turn on two-step sign-in for email and banking, and make sure you have a backup that is not plugged into the computer it protects. Lessons 2 and 3 cover both. If forced to pick one for money loss, it is a rule that payment changes get a phone call to a known number.

How much should a small business spend on security?

There is no single right figure. For a business of 10 or so, the basics in this course often run from a few hundred to a few thousand dollars a year, mostly for backup, a password manager and a managed device or support plan. Treat those as rough planning numbers and get real quotes. Lesson 11 has a budget table.

Can I handle this without an IT person?

For the first layers, yes. Two-step sign-in, a password manager, automatic updates, a backup and a payment rule need patience more than expertise. Bring in an outside provider for server setups, network changes, restoring after an incident, or anything you do not understand.

I only use Gmail and a few apps. Does this apply?

Yes. Your email account is the master key to everything else. Lessons 2 and 4 matter most for you.

What is the difference between a virus, malware and ransomware?

Malware is the umbrella word for harmful software. A virus is one older kind. Ransomware is malware that encrypts your files and demands payment, and it is the one that stops businesses.

Do I have to report an attack to anyone?

It depends on what was taken and what rules apply to you. Idaho has a breach-notice law for personal information, covered in lesson 10 of this course and in the management course. Reporting to IC3 and the FTC is voluntary but valuable, and a bank has to hear about fraudulent transfers right away.

Does cyber insurance fix this?

Insurance can pay for response costs. It does not restore your reputation, and applications now ask about controls like two-step sign-in and backups. Lesson 11 covers what insurers ask.

Hard questions

"Security is a cost with no return. Why spend on something that may never happen?"

Because the expected cost is not zero. The worked example above shows one outage costing about ten years of basic controls. Your own numbers will differ, but run them. Many controls here are free, and the paid ones cost less than a single weekend of lost jobs.

"My employees won't put up with two-step sign-in and passwords. It slows them down."

A password manager makes sign-in faster, and modern two-step prompts take seconds. Where staff push back, the usual cause is a poor rollout, not the control. Start with email and banking, help each person set up, and let the owner go first.

"You say the IC3 numbers are big, but those are reported complaints. Aren't they inflated or incomplete?"

They are incomplete in the other direction. IC3 counts only what people choose to report, so actual losses are likely higher. The report also does not say how many victims were small businesses, which is why this lesson avoids quoting a small-business share from it.

"If a criminal really wants in, nothing stops them. Why bother?"

A determined, well-funded attacker may get in. But most attacks on small firms are cheap and automated, and they move on from targets that fail quickly. Layers also change what a break-in costs you. A tested backup turns a catastrophe into an inconvenience.

"We're in the cloud already. Why does this course spend so much on laptops and passwords?"

Because cloud accounts are reached from laptops and phones with passwords. If the sign-in is weak or a device is infected, the cloud provider's security does not help you. The cloud shifts part of the work and leaves your part.