Cybersecurity basics every Indian business should get right

The threats are real and they are not just for big companies

There is a dangerous assumption among small and mid-size Indian business owners that cybercriminals only target large corporations and banks. This is completely wrong. Smaller businesses are often easier targets precisely because they lack basic security measures. Ransomware does not check your company's turnover before encrypting your files.

The Indian Computer Emergency Response Team, CERT-In, reported a significant increase in cybersecurity incidents targeting Indian organisations in recent years, with phishing, ransomware and business email compromise leading the list. Many of these incidents affected companies with fewer than a hundred employees. The attacks are automated and opportunistic. If your defences are weak, you will be found.

The financial impact goes beyond the ransom or the stolen money. Downtime while you recover your systems costs revenue. Customer data breaches damage trust that took years to build. And under the Information Technology Act, businesses that fail to implement reasonable security practices can face legal liability for data breaches.

Passwords and access controls that actually protect you

Single-factor passwords are the weakest link in almost every Indian business. People use the same password across multiple accounts, share login credentials with colleagues and never change passwords unless forced. Start by implementing a password policy that requires at least twelve characters, a mix of uppercase, lowercase, numbers and symbols, and no reuse of the last ten passwords.

Better yet, implement multi-factor authentication everywhere you can. MFA adds a second verification step, usually a code sent to a mobile phone or generated by an authenticator app. Even if someone steals or guesses a password, they cannot access the account without the second factor. Google, Microsoft and most cloud services offer MFA at no additional cost. There is no valid excuse for not using it.

Limit access on a need-to-know basis. Not everyone in your company needs access to every system, every file share and every customer database. Create user roles with the minimum access required for each person's job. When someone leaves the company, disable their access immediately. The National Informatics Centre has published guidelines on access control for government systems that provide a useful framework for private businesses too.

Backups that support recovery after an incident

If ransomware encrypts your files and you have no backup, you are at the mercy of criminals who may or may not give you the decryption key after you pay. If you have a clean backup from yesterday, you format the affected machines, restore from backup and get back to work. The choice is obvious.

Follow the 3-2-1 backup rule. Keep three copies of your important data, on two different types of storage media, with one copy stored offsite or in the cloud. Automated daily backups to an external drive are the minimum. Weekly backups to a cloud service like Google Drive, AWS S3 or Azure Blob Storage add the offsite component.

The critical detail that many businesses miss is testing their backups. A backup that does not restore properly is not a backup. Schedule a quarterly backup restoration test where you actually recover files from your backup to a test machine and verify that everything works. This takes an hour of effort every three months and could save your business.

Phishing awareness and employee training

The most sophisticated firewall in the world will not protect you if an employee clicks a malicious link in an email that looks like it came from their bank. Phishing attacks have become very convincing. They use real company logos, Indian English phrasing and create urgency around things like KYC updates, income tax notices and UPI payment confirmations.

Run a phishing simulation every quarter. Send a realistic test email to your team and see who clicks. There is no need to shame anyone. The goal is to build awareness. People who fall for the simulation get a brief training session explaining what to look for: unexpected sender addresses, urgency or threat language, requests for credentials and links that go to unfamiliar domains.

Create a simple reporting process. If anyone receives a suspicious email, they should have a clear way to report it, whether that is forwarding it to a dedicated mailbox or flagging it in a chat channel. Make reporting easy and reward people for doing it rather than creating a culture where people are afraid to admit they almost clicked something.

CERT-In reporting and incident response

• Confirm incident reporting duties and deadlines with the responsible security and legal team using current CERT-In directions.
• Agree applicable logging, retention, access and storage requirements with the security team.
• Create a written incident response plan that names specific people responsible for each step.
• Test the incident response plan with a tabletop exercise at least once a year.
• Keep offline contact information for your IT team, ISP and CERT-In in case your email is compromised.
• Document every incident and the response actions taken for legal and insurance purposes.

If your business does not have a cybersecurity plan or you are unsure whether your current setup is adequate, we can help assess your situation. Share the basics of your setup, how many people use your systems, what kind of data you handle and what security measures you have in place, through our enquiry page.