Protecting a one-person business: passwords, backups and safe Wi-Fi

A big company has an IT team. You have you. The good news is that most of the damage small businesses suffer comes from a few common problems (reused passwords, no backups, phishing emails), and each has a cheap fix.

1. Protect your email first

Your email account is the master key to your business: almost every other account can be reset through it. Lock it down before anything else.

• Use a long, unique password that you use nowhere else.
• Turn on two-step login (also called two-factor authentication or 2FA). An authenticator app or a hardware security key is safer than text messages.
• Save the backup codes somewhere safe, offline.

Then do the same for your bank, payment provider, domain registrar and website host.

2. Use a password manager

Nobody can remember a different strong password for fifty accounts, so most people reuse a few. When one site is breached, attackers try that password everywhere else.

A password manager creates, stores and fills a unique password for every account. You remember one strong master password; it remembers the rest. LastPass, Bitwarden, 1Password and the managers built into Apple and Google devices all do this job.

When choosing one, look at:

• whether it works on all your devices and browsers;
• whether it supports two-step login for the manager itself;
• the company’s security record: read how it has handled past incidents. LastPass, for example, disclosed a serious breach in 2022, and many reviews discuss what changed afterwards.

Whichever you choose, protect the master password with two-step login and never reuse it.

3. Back up with the 3-2-1 rule

Laptops get stolen, drives fail and ransomware locks files. The 3-2-1 rule keeps you covered:

• 3 copies of your important files,
• on 2 different kinds of storage (say, your laptop and an external drive),
• with 1 copy off-site (a cloud backup).

Backup software such as Acronis or EaseUS can back up your whole computer automatically on a schedule. Cloud storage services like Google Drive, Dropbox or iCloud are useful, but note that syncing is not the same as backing up: if a file is deleted or encrypted on your laptop, the change can sync too. A proper backup keeps older versions.

Test your backup. Once a quarter, try restoring one file. A backup you have never restored is a backup you hope works.

4. Be careful on public Wi-Fi

Cafés, hotels, airports and co-working spaces are where many solopreneurs work. On networks you don’t control, a VPN encrypts your connection so others on the same network can’t see or tamper with your traffic.

Most popular VPNs (Surfshark and NordVPN among them) offer apps for laptops and phones. For a one-person business, useful features are:

• enough devices on one plan (Surfshark has no device limit);
• a kill switch, which blocks the internet if the VPN drops;
• a clear privacy policy, ideally checked by an independent audit.

At home or on your phone’s own mobile data, you need it less.

5. Spot phishing and keep things updated

• Phishing emails pretend to be your bank, a client or a service you use. Be suspicious of urgency (“your account will be closed today”), unexpected attachments and login links. When in doubt, go to the site directly instead of clicking.
• Invoice fraud: if a supplier emails to say their bank details have changed, confirm by phone using a number you already have.
• Updates: turn on automatic updates for your computer, phone and browser. Most attacks use holes that were fixed long ago.
• Antivirus: the built-in protection on modern Windows and Mac covers the basics. Paid suites such as Norton add features like identity monitoring if you want them.

A 30-minute security checklist

1. Two-step login on email, bank, payments, domain registrar and hosting.
2. A password manager, with your most important accounts moved into it first.
3. Automatic backup of your computer, including one off-site copy.
4. A VPN on your laptop and phone for public Wi-Fi.
5. Automatic updates turned on everywhere.
6. Write down what to do if your laptop is lost: which accounts to secure first, and where the backups are.

Thirty minutes now can save you weeks of recovery later.

Tools mentioned in this guide

Frequently asked questions