If you're building tech at a small or medium-sized business (SMB), chances are you’re wearing multiple hats. One day you're optimizing a database query, and the next, you're the de facto CISO trying to figure out if your AWS S3 buckets are actually private.
Let's face it: SMB cybersecurity is often an afterthought until a breach happens. But for developers, AI engineers, and tech builders, baking security into your organization's DNA early on is far easier than retrofitting it after a disaster.
Whether you're a CTO, a solo DevOps engineer, or a full-stack dev looking out for your company, this pragmatic business cybersecurity checklist will help you secure your infrastructure without grinding feature development to a halt.
1. Implement Zero-Trust Identity and Access Management (IAM)
The days of the "trusted internal network" are over. When it comes to small business IT security, identity is your new perimeter.
Enforce Multi-Factor Authentication (MFA) Everywhere
Every single account—from your AWS console and CI/CD pipelines to your GitHub organization and your company Slack—needs MFA. Hardware keys (like YubiKeys) are the gold standard, but authenticator apps (TOTP) are a great start. Avoid SMS-based 2FA if possible, as it's vulnerable to SIM swapping attacks.
Principle of Least Privilege (PoLP)
Don't give every developer admin access to production. Implement Role-Based Access Control (RBAC). Developers should only have access to the resources they need to do their specific jobs. If temporary access is needed for debugging, automate temporary credential issuance.
2. Secure Your Application Layer
Your application is the most public-facing part of your business. Securing it requires a mix of good architecture and automated tooling.
Sane Defaults with HTTP Headers
A shocking number of attacks can be mitigated just by setting the right HTTP headers. If you're building a Node.js API, using a middleware library like helmet is a no-brainer for immediate protection against common web vulnerabilities like Cross-Site Scripting (XSS) and clickjacking.
const express = require('express');
const helmet = require('helmet');
const app = express();
// Helmet secures your Express apps by setting various HTTP headers
app.use(helmet());
// Customizing Content Security Policy (CSP)
app.use(helmet.contentSecurityPolicy({
directives: {
defaultSrc: ["'self'"],
scriptSrc: ["'self'", "trusted-cdn.com"],
objectSrc: ["'none'"],
upgradeInsecureRequests: [],
}
}));
app.get('/api/health', (req, res) => {
res.json({ status: 'Secure and running' });
});
app.listen(3000, () => console.log('Server running securely on port 3000'));
Dependency Scanning
Your proprietary code might be perfectly secure, but what about the 500 open-source packages you just installed? Integrate tools like Dependabot, Snyk, or native npm audit commands into your CI/CD pipeline to catch vulnerable dependencies before they hit production.
3. Harden Network Security
Even if you're fully cloud-native, network security matters heavily. Leaving databases exposed to the public internet is a classic startup mistake that leads directly to data ransoms.
- Use Virtual Private Clouds (VPCs): Isolate your environments. Your database should live in a private subnet, accessible only by the application tier living in the public subnet (or via a secure VPN/bastion host for your engineering team).
- Strict Firewall Rules: Security Groups in AWS (or equivalents in GCP/Azure) should default to
deny all. Open only the specific ports necessary for communication (e.g., port 443 for HTTPS traffic).
4. Prioritize Data Protection for Business
Robust data protection for business means safeguarding data both at rest and in transit. This is especially critical if you are handling user PII or training data for AI models.
Encryption is Mandatory
- In Transit: Enforce TLS 1.2 or higher for all communications. Let's Encrypt makes SSL/TLS certificates free and easy to automate, so unencrypted HTTP should never see the light of day.
- At Rest: Ensure that your databases, object storage (like S3 buckets), and block storage (EBS volumes) have encryption at rest enabled. Modern cloud providers offer this as a single-click toggle—there is zero excuse not to use it.
Backups and Disaster Recovery
Ransomware doesn't care if you're a bootstrapped 10-person startup. Implement automated, encrypted backups. More importantly, routinely test your restoration process. A backup you've never restored from in a sandbox environment is just a Schrödinger’s backup.
5. The Human Element: Phishing Prevention
You can build the most robust infrastructure in the world, but if a team member gets socially engineered into handing over their credentials, it’s game over.
Phishing prevention goes way beyond just setting up a basic spam filter. It involves creating a blameless culture of security:
- Implement DMARC, SPF, and DKIM: Configure these DNS records to protect your company domain from being spoofed by attackers.
- Security Awareness: Educate your non-technical staff. Tech builders often spot weird URLs instantly, but folks in HR or Sales might not.
- Blameless Reporting Channel: Create a clear, penalty-free channel (like a
#security-reportsSlack channel) for employees to report suspicious emails or to alert the team if they accidentally clicked a bad link. Speed of reporting is everything.
Final Thoughts
Cybersecurity isn't a fixed destination; it's a continuous, evolving process. By checking off these fundamental boxes, you'll significantly raise the baseline of your infrastructure's resilience. Start small, automate where possible, and treat security as a feature, not a bug.
Stay secure, builders!
Originally published at https://getmichaelai.com/blog/the-ultimate-cybersecurity-checklist-for-small-and-medium-si
Top comments (0)