Let’s get your team trained and using Microsoft Copilot and moving your business forward. Click here to book +61 3 4803 4915Client PortalRemote Support
Belton IT Nexus
Belton IT Nexus · Est. 2004 · Newmarket, AucklandAbout us ›
Home/ Resources/ DIY Cybersecurity

Security basics you can do yourself

Practical steps to improve your security posture. No enterprise budget required.

8Fundamentals $0Budget to start TodayYou can begin now SMEBuilt for small business

Not every business can afford a full security team. But that does not mean you have to be an easy target. Most breaches exploit simple weaknesses. Reused passwords. Unpatched systems. Staff clicking links they should not. Fix these basics and you eliminate the majority of threats.

This guide covers the fundamentals. Things you can implement yourself, today, with minimal cost. They will not stop a nation-state attack. But they will stop the opportunistic criminals who target businesses without basic protections.

The basics
§01

Start with these eight fundamentals

Each closes a common attack vector
01 Enable multi-factor authentication everywhere Passwords get stolen. MFA means stolen passwords alone cannot grant access. Enable it on email, banking, cloud services, VPNs. Every login that matters. Use authenticator apps, not SMS where possible.
02 Use a password manager People reuse passwords because remembering unique ones is hard. Password managers solve this. They generate strong, unique passwords and remember them for you. Most have business plans that let you share credentials safely with staff.
03 Keep everything updated Most attacks exploit known vulnerabilities with available patches. Enable automatic updates on Windows, macOS, phones, browsers. Update your router firmware. Patch your web applications. Updates are free security fixes.
04 Back up your data properly Ransomware encrypts your files and demands payment. Good backups let you restore without paying. Follow the 3-2-1 rule: three copies, two different media types, one offsite. Test your restores. A backup that cannot be restored is not a backup.
05 Train your people Phishing works because people click without thinking. Regular, brief training keeps security awareness fresh. Teach staff to verify unexpected requests, hover over links before clicking, report suspicious emails rather than ignoring them.
06 Limit admin access Not everyone needs administrative privileges. Daily work should use standard accounts. Admin access only for tasks that require it. This limits damage when an account gets compromised.
07 Secure your email settings Configure SPF, DKIM, and DMARC records for your domain. These prevent attackers from sending emails that appear to come from your business. Most email providers offer guides. It takes an hour and costs nothing.
08 Know what you have You cannot protect what you do not know exists. Maintain a list of your devices, software, and cloud services. When vulnerabilities emerge, you will know what needs attention.

These fundamentals address the most common attack paths. Password attacks, unpatched vulnerabilities, phishing, and ransomware. Master them before worrying about advanced threats.

Security is a process, not a destination. Review these practices quarterly. Technology changes. New threats emerge. What protected you last year may not be enough next year.

When DIY is not enough.

These basics protect against opportunistic attacks. They may not be sufficient if you handle sensitive data, face regulatory requirements, or operate in a high-risk industry. If you are unsure about your risk level, a professional assessment can identify gaps you might miss.

We built this guide because good security information should not be locked behind consulting fees. These recommendations apply to businesses of any size. They require effort, not budget. If you find yourself needing more than basics, we can help. From security assessments to full managed protection. But start with these fundamentals. They matter more than any tool you can buy.

Ready for professional
security support?

A discovery & security session takes you from basic protection to a clear picture of your real risks. We review your setup, name the gaps, and give you the truth, whether or not you ever work with us.

NEW ZEALAND OWNED & OPERATED EST. 2004
Sovereign by design

New Zealand owned and operated.

Sovereign data centres across New Zealand and Australia, with your data kept onshore wherever it's required. Our team understands New Zealand, and our leaders have built, scaled and secured businesses right across the New Zealand landscape.

Sovereign data centres · New Zealand & Australia
  • Auckland
  • Christchurch
  • Sydney
  • Melbourne
  • Brisbane
  • Perth
International data-centre operations
  • Singapore
  • Germany
  • Netherlands
  • USA

Servers available in minutes, not days.

Explore data centres & hosting →
Accredited partners
Microsoft Solutions Partner Fortinet Partner Lenovo Partner HP Partner Apple Business Manager