Online Business Security Best Practices That Actually Hold Up

Break-ins at small companies rarely start with clever code. They start with a password that was already for sale from somebody else's breach, or with a login page that looked right.

Give every person their own account, on every tool. Shared logins feel efficient until someone leaves and you have no idea which of the eleven services they can still reach. Individual accounts also make offboarding a checklist instead of an archaeology project. Put the passwords in a shared vault, one unique password per service, and let the vault generate them so nobody is inventing patterns.

On passwords themselves, the current guidance is the opposite of what most people were trained on. NIST SP 800-63B tells verifiers to accept up to 64 characters, to allow spaces and any printable character, to check new passwords against known-breached lists, and to stop demanding a symbol, a capital and a number. It also tells them not to force scheduled resets. Rotation on a calendar produces predictable increments, and predictable increments are what credential-stuffing tools try first.

Multi-factor is where the real gain sits, and the type matters more than the fact of having it. A modern phishing kit sits between you and the real login, collects the code you type, and steals the session cookie the moment the login succeeds, which defeats app codes and SMS alike. A hardware security key does not fall for it, because the key checks the domain it is signing for and will not respond to a lookalike. Keys cost money and you need two, one in use and one in a safe, or a lost key locks you out of your own store.

Print the recovery codes for the handful of accounts that would end the business if you lost them, once, and lock the paper away. A pad from our notepads range is a reasonable place for the short incident call list that goes with it. If you are still setting the business up, the guide to starting an e-commerce business covers the account structure to build before you have staff.

An online business has physical edges. The parcel leaving your bench, the documents you post, the bench itself where somebody makes the decision to click. Print is not a replacement for any control above, and anyone selling it as one is overselling. It covers four specific gaps.

The seal is the one worth understanding properly. A normal paper label is not tamper-evident, because it lifts off in one piece and goes back down looking untouched. A holographic seal across the flap either destroys its own pattern when it is removed or leaves a visible residue, so the customer opening the box can tell you whether it reached them intact. That turns an argument into evidence. Read the guide to packaging labels, seals and tape for how the seal sits alongside branded tape, and browse the rest of the range in custom labels and custom stickers.

The poster above the packing bench is the cheapest control on this page. Two lines, large enough to read from the far side of the room: confirm any change of bank details by phone, and never open an attachment from a supplier who has not sent one before. Order it with the rest of your marketing print rather than as a special job, which the print for e-commerce brands guide walks through.

The cheapest data to protect is the data you never collected. Before adding a field to a form, ask what you would do with it and how long you need it, then set a deletion date. A customer list you deleted last year cannot leak this year.

Back up on the 3-2-1 pattern: three copies, on two kinds of media, one of them off-site, and make at least one copy immutable or offline so ransomware cannot encrypt the backup alongside the original. Then restore from it. An untested backup is a belief, not a backup, and the thing people discover during a real incident is not that the files are missing but that a full restore takes eleven hours they had budgeted as one. Write the actual restore time down after you test it.

Review access every quarter. Who still has admin on the store, who still has a key to the analytics, which contractor from March is still in the shared drive. Offboarding runs off the same list. Every US state now has a data-breach notification law, so the clock in an incident is legal as well as commercial, and the plan you want is a single page: who calls the bank, who calls the processor, who talks to customers, and where the backups live. Print it. If the incident is an outage, the online copy is exactly the copy you cannot reach.

Keep trading while you fix it. A numbered order pad and a pen at the counter means the day is not lost, and the copies reconcile afterwards. Our business form printing guide covers the part counts, and NCR form security features explains what sequential numbering and a void pantograph actually prove. More operational guides sit in business applications.