1

Top 10 Security Best Practices for Small Businesses Practical Guide to Protecting Your Business Today

SMB TOP 10 BEST PRACTICES | 2

Why are Small Businesses Increasingly Targeted? Small and medium-sized businesses (SMBs) are now just as likely to be targeted for cyber attack as large enterprises. Why?

• Fewer IT and security staff

• Limited security budgets

• Less security infrastructure

• Lack of continuous monitoring capabilities

• Growing volumes of digital data

The majority of actors for both large and small companies continue to be primarily financially motivated external actors of the organized crime variety.

— 2025 Data Breach Investigations Report (DBIR), Verizon Business

Though 94% of respondents say they’re knowledgeable about cybersecurity threats, many fall short on training, tools, and consistent execution of their security strategy.

— The State of SMB Cybersecurity Survey, Crowdstrike, 2025

The average loss for SMBs due to security incidents in 2024 surged to US$1.6 million...a concerning 68% of SMBs feel under-prepared compared to their peers.

— Navigating the Rising Tide, TechAisle

https://www.verizon.com/business/resources/reports/dbir/ https://protect.checkpoint.com/v2/___https://www.crowdstrike.com/explore/crowdstrike-content/report-state-of-smb-cybersecurity-survey?utm_medium=ref___.YzJlOmNwYWxsOmM6bzo2NjljMGE5NTI2ODNmYzkwNzhiMDQ3YzA5ZTBjY2Q0Mzo2OjEwZmQ6MDNlMjMwM2JmMmQ0ZWFmNmRhYzk0NDhlMThmMGQxMDdkZDU2NTE5MDg4YzFiZGU3YmRiMjQ3NDNmMjQ0NDI5NTpwOlQ6Tg https://protect.checkpoint.com/v2/___https://techaisle.com/blog/600-techaisle-2025-security-survey-reveals-smb-realities___.YzJlOmNwYWxsOmM6bzo2NjljMGE5NTI2ODNmYzkwNzhiMDQ3YzA5ZTBjY2Q0Mzo2OjE1MDQ6NDYyYzdmYWUxZGE1Y2IzMTJiMjZkMmQzZjlkMGNhNDVhYmE2YjdkYjU4NmJiODAzMTFiNDEwM2IyYjEyMmRkMjpwOlQ6Tg

SMB TOP 10 BEST PRACTICES | 3

Ways Your Business Can be Threatened

Ransomware is the cause of 88% of SMB breaches —2025 Verizon DBIR

Stolen credentials are the primary hacking tactic in 33% of SMB attacks —2025 Verizon DBIR

Security failures related to Internet-connected devices cost businesses an average of $330,000 per incident — NIST

More than 3.4 billion phishing emails are sent daily — DeepStrike

Why don't SMBs Focus on Security?

Many are caught between growing risk and limited internal resources

Budget is critical—business size highly determines security posture

Security complexity overwhelms decision-makers and stalls progress

https://protect.checkpoint.com/v2/___https://www.nist.gov/___.YzJlOmNwYWxsOmM6bzo2NjljMGE5NTI2ODNmYzkwNzhiMDQ3YzA5ZTBjY2Q0Mzo2OjBjODE6YzI1NDljNGQyYThkNTRiYWNmNTBjZTk0MjUyNjFkZTZmODE4NDVmMjNiMWZmMjkwMzU2Y2I1MzQ4NjUwMzhhMjpwOlQ6Tg https://protect.checkpoint.com/v2/___https://deepstrike.io/blog/Phishing-Statistics-2025___.YzJlOmNwYWxsOmM6bzo2NjljMGE5NTI2ODNmYzkwNzhiMDQ3YzA5ZTBjY2Q0Mzo2OmU0NzM6Nzc1OTAxYmIwNTM2YmY3ZThjYTZkNTBkMDcxZTM4YWFhNzhhYjdkNGFmMTE4YjUyM2M5NzBmN2M2MGNiYzQ5NTpwOlQ6Tg

SMB TOP 10 BEST PRACTICES | 4

Top Security Best Practices #1

#1: Common Passwords Are Bad Passwords

Passwords are your first line of security defense. Weak passwords and access management are among the top security issues for SMBs. Cybercriminals trying to gain access to your organization's network will try the most common passwords first.

BEST PRACTICES: Create long, strong passphrases. Make them complex, with upper and lower case, numbers or symbols. Apply password encryption. Implement multi-factor authentication (MFA). Test passwords using an online testing tool. Change privileged (not personal) passwords regularly. Use password managers1.

The 24 Most Common Passwords2

123456

123456789

12345678

password

qwerty123

qwerty1

111111

12345

1 https://www.beyondtrust.com/blog/entry/top-15-password-management-best-practice 2 https://nriglobe.com/technology/worlds-top-25-most-common-passwords-in-2025-are-you-at-risk/

1

secret

123123

1234567890

1234567

000000

qwerty

abc123

password1

iloveyou

11111111

dragon

monkey

123123123

123321

qwertyuiop

00000000

SMB TOP 10 BEST PRACTICES | 5

Top Security Best Practices #2

#2: Secure Every Entrance

It only takes one open door for a cybercriminal to enter your network. Just like you secure your home by locking the front door, back door, and all the windows, think about protecting your network in the same way. Consider all the ways someone could enter your network, then ensure that only authorized users can do so.

• Ensure strong passwords on laptops, smartphones, tablets, Wi-Fi access points, and all Internet-connected devices.

• Use a firewall with threat prevention to protect access to your network (like Check Point Quantum Spark).

• Secure endpoints, such as laptops, desktops, and servers with comprehensive security software such as anti- virus, anti-SPAM, anti-phishing, anti-bot, and sandboxing capabilities.

• Instruct employees not to plug unknown USB devices into the network or endpoints.

2

SMB TOP 10 BEST PRACTICES | 6

Top Security Best Practices #3

#3: Segment Your Network

Zero Trust Architecture protects your network by separating it into zones and protecting each zone appropriately. Segmenting the network limits access to data by unauthorized users, it limits network exposure to attackers, and it limits the damage that a successful attack might cause. One zone might be for internal use or critical work only. Another might be a guest zone, where customers can surf the internet but not access your work network. Consider separating your network by business functions—customer records, finance, general employees, manufacturing, and others that make sense for your industry.

• Segment your network and place more rigid security requirements where needed.

• Create strong device identities to avoid untrusted devices on the network.

• Apply strict access controls and least-privilege access.

• Implement MFA to ensure users are who they claim to be.

• Public-facing web servers should not be allowed to access your internal network.

3

SMB TOP 10 BEST PRACTICES | 7

Top Security Best Practices #4

#4: Define and Enforce Policy

Decide which applications should be allowed on your network and which should not. Establish security policies for applications and enforce policy using your firewall threat prevention solution. Educate employees on acceptable use of the company network and enforce it by monitoring for policy violations and excessive bandwidth use.

• Set up appropriate use policy for allowed/disallowed apps and websites.

• Do not allow risky applications such as Bit Torrent or peer-to-peer file sharing applications, which are common methods of distributing malicious software.

• Block free software like The Onion Router (TOR) and other anonymizers that seek to hide behavior or circumvent security.

• Consider your position on social media policy—does the company have social media accounts that should have security policy applied? Do you allow employees to have social media accounts on the business network? At minimum, no confidential or sensitive data should be revealed via social media nor should any posts be made that impact the company's reputation.

4

SMB TOP 10 BEST PRACTICES | 8

Top Security Best Practices #5

#5: Be Socially Aware

Phishing, spearphishing, and social engineering attacks all begin by cybercriminals collecting personal data. Social media sites are a gold mine for finding information on people and improving their attack success rate.

• Educate employees to be cautious with sharing on social media sites, even in their personal accounts.

• Let users know that cybercriminals build profiles of company employees to make phishing and social engineering attacks more successful.

• Train employees on privacy settings on social media sites to protect their personal information.

• Users should be careful of what they share, since cybercriminals easily guess security answers (such as your dog’s name) to reset passwords and gain access to accounts.

5

SMB TOP 10 BEST PRACTICES | 9

Top Security Best Practices #6

#6: Encrypt Everything

One data breach could be devastating to your company. Encryption is the best way to protect sensitive data and it should be easy for your employees to do so.

• Ensure encryption is part of your corporate policy.

• Install pre-boot encryption on company-owned devices to prevent access to company resources if they are lost or stolen.

• Buy hard drives and USB drives with encryption built in.

• Use strong encryption on your wireless network, such as Wi-Fi Protected Access 2 (WPA2) with Advanced Encryption Standard (AES)-compliant encryption.

• Protect data from eavesdroppers by encrypting wireless communication using Virtual Private Network (VPN).

6

SMB TOP 10 BEST PRACTICES | 10

Top Security Best Practices #7

#7: Maintain Your Network

Your network and all of its connected components should run like a well-oiled machine. Regular maintenance helps ensure it continues to roll along at peak performance and security.

• Ensure all laptop and server operating systems are updated.

• Uninstall software that isn’t used or needed, such as Java, so you don’t have to check for regular updates.

• Keep browsers, drivers, and applications updated on your servers and laptops.

• Turn on automatic updates where available: Windows, Chrome, Firefox, Adobe, and Apple.

• Use Intrusion Prevention System (IPS) features, like that on Check Point Quantum Spark to prevent attacks on non-updated laptops.

7

SMB TOP 10 BEST PRACTICES | 11

Top Security Best Practices #8

#8: Secure Your Cloud

Like any infrastructure, cloud has its share of security risks. Attackers use the same tactics—ransomware, credential theft, phishing, web application, and intrusion—to gain access to cloud-based SMB data and assets. In cloud environments, responsibility for security is shared between the cloud provider and the customer.

• Use cloud providers' security features and tools.

• Prioritize configuration management and conduct regular audits.

• Implement strong access controls, including MFA.

• Configure application security settings, manage access controls, encrypt data, and implement endpoint security measures.

• Encrypt content, including system backups.

8

SMB TOP 10 BEST PRACTICES | 12

Top Security Best Practices #9

#9: Don’t Let Everyone Administer Systems

Laptops and other devices can be accessed via user accounts or administrative accounts. Administrative access allows users much more freedom and power on their laptops, but that power moves to the cybercriminal if the administrator account is hacked.

• Don’t allow employees to use Administrator privileges for day-to-day activities.

• Limiting employees to User Account access prevents malware from doing damage at more privileged levels.

• Always change default passwords—on laptops, servers, routers, gateways, printers and all Internet-connected devices.

9

SMB TOP 10 BEST PRACTICES | 13

Top Security Best Practices #10

#10: Set BYOD Policy

Create a Bring-Your-Own-Device (BYOD) policy if you allow employees to use their own devices—whether laptops, tablets, or phones. Educating users about security risks attacking through their devices is essential.

• Consider allowing Internet-only guest access to your network for employee-owned devices.

• Enforce password locks on user-owned devices.

• Allow access to sensitive information only through encrypted VPN.

• Don’t allow storage of sensitive company information—such as customer contacts or credit card information— on personal devices.

• Have a plan to turn off access credentials and other resources if an employee device is lost or stolen.

10

SMB TOP 10 BEST PRACTICES | 14

Enterprise-Grade Cyber Protection for SMBs Enterprise-size cyber threats require enterprise-level protection. You need industry- best security and outstanding network connectivity for business resilience, with security expertise built in. Check Point Quantum Spark™ 2500 Series security gateways deliver it all—proven gateways tested, approved, and deployed by thousands of enterprises worldwide—but simpler, more affordable, and tailored to an SMB.

Quantum Spark 2500 Gateway Series • Uncompromising all-in-one performance: Quantum Spark optimizes high-bandwidth

connectivity over MPLS, broadband, 5G Cellular, Wi-Fi 7, and more. It includes sub- second failover for unstable connections; monitors link health; and supports multiple internet service providers.

• The best prevention: A 3x faster firewall makes sure security doesn't slow you down. Get the industry's best malware catch rate and stop phishing sites in real time. Built- in security policies deliver protection immediately, and allow you to tailor policies for your business.

• Easy setup: Plug it in, follow a simple set-up wizard, and your network is secure.

• Easy management: Ongoing management and upkeep is simple with a mobile app to monitor and mitigate any security issues while on the go.

• Affordable price: Quantum Spark delivers affordable protection. Ask your MSP for Check Point Quantum Spark.

• An all-in-one solution

• Proven #1 threat catch rate

• High-speed connectivity

• Delivering enhanced business resilience

SMB TOP 10 BEST PRACTICES | 15

Take Charge of Your Security Quantum Spark security capabilities give you enterprise-level control over who accesses your network, prevent attacks and threats, and secure communications with your business from remote employees or multiple locations.

• Next-Gen Firewall: Ensures only the traffic that should be allowed on the network traverses the network. Prohibited traffic is blocked before it ever enters the network. The firewall delivers 2.7 Gbps of threat prevention and three times faster security inspection, so security doesn't slow down your business.

• Fast connectivity: There's no waiting with up to 2.4x faster Wi-Fi 7 access, 5G cell connectivity, and 10x faster Internet speeds. High- bandwidth 10GbE ports need fewer connections for outstanding performance.

• Application Control and URL Filtering: Ensures only authorized applications are used on the network and only allowed websites can be visited.

• User Awareness: Allows you to set policies that allow or prohibit network activity based on user identity or role.

• QoS: Quality of Service (QoS) enables you to prioritize your most important traffic for higher performance and business resilience.

• Built-in resilience: Dual power supplies deliver redundancy for uninterrupted uptime, while dual ISP support enables high-quality conference calls and dual SIMs ensure 5G cellular failover.

SMB TOP 10 BEST PRACTICES | 16

The Best Threat Prevention Put the best security in action the minute you turn it on. Get large-enterprise features to prevent the most devastating threats.

• #1 Malware catch rate: Quantum Spark security gateways catch 99.9% of malware within 24 hours of identification.

• Anti-phishing: Stop phishing sites in real time, even those never seen before. Gain real-time scanning of all online forms to help prevent data loss to phishers.

• IPS: Intrusion Prevention System (IPS) searches traffic for attacks targeting business computers and devices and protects them—even those without the latest patches.

• Anti-Virus: Malware results in more breaches for SMBs than any other cause (2025 Verizon DBIR). Anti-Virus blocks malware before it can get into the network.

• Anti-Spam: Unwanted email is always a problem, but Anti-Spam blocks spam email messages that often deliver malware or lead users to malicious sites.

• Anti-Bot: Bots collect information to send to their command and control center for further malicious activity. Anti-Bot detects and blocks that communication.

• Sandboxing: Launches suspicious files in a virtual sandbox to discover malicious behavior and then prevents it from entering the network. It prevents infection from undiscovered exploits, zero-day, and targeted attacks.

SMB TOP 10 BEST PRACTICES | 17

Protect Business Data Encrypting data during network communications prevents it from being captured by attackers. Virtual Private Network (VPN) capabilities encrypt data traversing the network, allowing only intended receivers to read the information.

• Remote Access: Encrypts traffic from user devices to the network, whether devices are in the office or on the road.

• Site-to-Site VPN: This feature allows you to encrypt all communications between multiple office locations.

Quantum Spark Management App for MSPs The Quantum Spark Management app is a powerful tool designed specifically for MSPs to efficiently manage their SMB customers’ networks. It offers centralized visibility into customer security and connectivity posture, real- time alerts for issues requiring attention, in-depth dashboards for monitoring and analysis, zero-touch gateway provisioning with configuration templates, and task delegation to end customers. The app, accessed from the Infinity Portal, simplifies complex operations, enabling scalable, streamlined, and proactive service delivery.

Web Browser and Mobile App for On-the-Go Management Easily manage Quantum Spark security gateways from a web portal or mobile app. Check Point’s WatchTower iOS and Android mobile application enables staff to monitor security status and quickly mitigate any threats wherever they are.

SMB TOP 10 BEST PRACTICES | 18

Secure Endpoints If you don’t have a system backup and restoration plan, consider Check Point Harmony Endpoint security solution.

Ransomware Protection

When an anomaly or malicious behavior is detected, Harmony Endpoint blocks and remediates the full attack chain without allowing leftover malicious traces. Harmony Endpoint uses a unique vaulted space locally on the machine that is only accessible to Check Point-signed processes. If the malware attempts to perform a shadow copy deletion, the machine will not lose any data.

Phishing Protection

Prevent credential theft with Zero-Phishing® technology that identifies and blocks the use of malicious phishing sites in real time. Zero-phishing blocks users from entering credentials—even preventing corporate credential re-use.

SMB TOP 10 BEST PRACTICES | 19

Secure Mobile Devices Check Point Harmony Mobile is the market-leading mobile threat defense solution. It keeps business data safe by securing employees’ mobile devices across all attack vectors—apps, network, and operating system. Easy to deploy, it prevents threats without affecting the user experience or privacy.

Secure Cloud Applications Harmony Email & Collaboration is threat prevention for cloud email and office applications, such as Microsoft Office 365 and Google G Suite, as well as Microsoft Teams, OneDrive, and SharePoint. It connects to cloud applications using native APIs, making it invisible to attackers. No network changes are required.

Once deployed, Harmony Email & Collaboration scans cloud mailboxes and applications for existing threats. When a user receives an email, file, or message through an Office 365 or G Suite application, it examines the email for malicious content and determines if it needs to be quarantined, cleaned, or removed. Check Point APIs analyze data in transit and at rest to make sure no malicious content penetrates or propagates within the organization. Prevent cloud email and application threats from a single, user-friendly management platform and one license for email, office, and enterprise applications.

SMB TOP 10 BEST PRACTICES | 20

Protect Against Business Email Compromise Harmony Email & Collaboration inspects communication metadata, attachments, links and language, as well as all historical communications, to determine prior trust relations between the sender and receiver. This increases the likelihood of identifying user impersonation or fraudulent messages to prevent business email compromise (BEC).

Prevent Account Takeover Prevent unauthorized users and compromised devices from accessing your cloud email or productivity suite applications. Transparent to users, Harmony Email & Collaboration also provides insight into the identity provider’s authentication process, so suspicious logins—such as those seen in two different locations or logins with bad IP reputations—are immediately denied and blocked.

Find Your Cybersecurity Partner Nearly two-thirds of SMBs say they lack the in-house skills and infrastructure to build and manage a robust cybersecurity framework. That's where Managed Service Providers (MSPs) who provide security solutions can help. As proactive cybersecurity defenders, they can provide you with access to advanced security tools, proactive threat management, compliance support, security awareness training options, and ongoing assistance in defending against emerging threats. Look for an MSP who can help you create a clear strategy for securing your business and provide guidance.

SMB TOP 10 BEST PRACTICES | 21

Worldwide Headquarters 5 Shlomo Kaplan Street, Tel Aviv 6789159, Israel | Tel: +972-3-753-4599

U.S. Headquarters 100 Oracle Parkway, Suite 800, Redwood City, CA 94065 | Tel: 1-800-429-4391

www.checkpoint.com

Why Check Point? The world's leading companies, as well as hundred of SMBs worldwide, depend on Check Point for the industry's best security and threat prevention. Security for a small business is too important to ignore. Let Check Point help you find a solution partner to begin protecting your business.

Learn more about Quantum Spark security gateways, as well as other Check Point solutions for small and medium business security today.

https://protect.checkpoint.com/v2/___https://partnerlocator.checkpoint.com/___.YzJlOmNwYWxsOmM6bzo2NjljMGE5NTI2ODNmYzkwNzhiMDQ3YzA5ZTBjY2Q0Mzo2OjM4MTk6ZDc0ODMxYmM2ZWYzYjU0ZDNmODAwMGFjZDIzNTRkOWEyNmZiZTFjYjY4OGUwNDAzMjhmMThkMWJkZjQzODM0ZDpwOlQ6Tg#/ https://protect.checkpoint.com/v2/___https://www.checkpoint.com/quantum/next-generation-firewall/small-business-firewall/___.YzJlOmNwYWxsOmM6bzo2NjljMGE5NTI2ODNmYzkwNzhiMDQ3YzA5ZTBjY2Q0Mzo2OmJlNTg6MjYyMDU3MTQwNzQxMzVjYTk3MGY4MzljNDczYjE1NmRjYzE5MzkzY2RjNzM1NjhlY2M1YmVmZmZmZGY4OGI0NjpwOlQ6Tg https://protect.checkpoint.com/v2/___https://www.checkpoint.com/solutions/small-medium-business-security/___.YzJlOmNwYWxsOmM6bzo2NjljMGE5NTI2ODNmYzkwNzhiMDQ3YzA5ZTBjY2Q0Mzo2OmI1OTI6NTAwMWQ5MDlmYjgxNWNkNTk2NjVmNjkyZjgyOWQwZGFjYzE5OTExYzAzNjU1M2Y0N2QwZjAwZjgwZDY1OGY3NDpwOlQ6Tg