If you don’t think your small business is at risk, you haven’t been paying attention. Data breaches are everywhere, and the bad guys are increasingly targeting small businesses.

Hackers assume, rightly in many cases, that small businesses lack the resources needed to protect their network infrastructure. But no matter how limited your resources, you cannot afford to put cyber security on the back burner. Here are some essential best practices every small business owner should be following.

Lock Down Personal Devices
These days everyone carries a powerful computer in their pocket and allowing that computer on to your network could comprise your security. If you are not locking down personal devices and monitoring their use, you are putting your business at risk.

Every business, no matter how small, should have a formal policy on the use of personal electric devices. Training new hires on the use of those devices, including examples of what is and is not allowed, is essential, and it should be part of your onboarding process.

If you have a wireless network for business purposes, you should restrict access from personally-owned devices. You can always set up a guest network for employee and visitor use. Doing so could protect your network infrastructure.

Use the Least Access Principle
Granting too much access to staff members is just asking for trouble, yet this is the strategy many small business owners follow. If you want to protect your business and your trade secrets, pay attention to which files new hires have access to.

Following the least access principle is essential, so grant privileges to only the files each worker needs. You can always expand access on an as-needed basis but starting with maximum restriction is the best way to protect the sensitive data on your network.

Prepare for the Worst
As a small business owner, you always hope for the best, but you also need to be ready for the worst. If you don’t have a disaster recovery plan in place, your small business could be living on borrowed time.

Your disaster recovery plan does not have to be expensive and elaborate, and its nature will depend on your business needs. What is essential is having a plan in place, so you will know what to do if the worst happens.

Train Employees Like Your Business Depends on It
The people you hire can be your first line of cyber defense, or the weak link in the chain. The difference is training, and you should train like your business depends on it - because it does.

Cyber security training should begin on day one, and awareness should be an integral part of the onboarding process. That training and awareness should continue every day on the job and not be treated as a mere afterthought.

Employees should be encouraged to report suspicious activity on the network and watch for strange emails in their inboxes. The vigilance of your workers can be your best defense strategy, but you need to use it wisely.

Small business owners are at special risk in the dangerous world of cyber security and data breaches. If your small business has not yet suffered such a breach, you should consider yourself lucky. But relying on luck is not enough - you need to use your common sense and follow best practices.