Small companies assume attackers go after big banks. In practice, criminals target whoever is easiest: a company with one shared password, an old website plugin or a finance clerk who trusts an email. The good news is that a handful of habits stops most attacks. Here is a practical checklist for a UAE business.

1. Passwords and sign-in

  • Use a password manager and unique passwords of at least 12 characters.
  • Turn on two-factor sign-in for email, banking, your hosting account, accounting and admin panels.
  • Never share logins. Give each person their own account and remove it the day they leave.
  • Change default passwords on routers, cameras and printers.

2. Phishing and fake invoices

Most attacks start with an email or WhatsApp message that looks urgent: a fake courier notice, a supplier “changing bank details”, a boss asking for a transfer. Teach staff to pause, check the sender address, and confirm any change of bank details by phone using a number you already have. Report suspicious messages to one person, and celebrate the people who report.

3. Keep software updated

  • Update operating systems, browsers, website platforms and plugins promptly.
  • Remove software and plugins you no longer use.
  • Replace systems that vendors no longer support.

4. Back up and test the restore

Ransomware is far less painful if you can restore. Keep daily backups of business data, store a copy away from the main server, and test a restore at least every quarter. A backup you have never restored is only a hope. Our admin panel includes a one-click database backup, and you should keep your host’s own backups switched on as well.

5. Limit who can see what

Give staff only the access their job needs. In business systems, use roles and an audit log so you can see who viewed or changed sensitive records. Our data protection checklist covers questions to ask vendors.

6. Protect your website

  • HTTPS everywhere, with automatic renewal.
  • A strong admin password, two-factor sign-in and a limit on login attempts.
  • Regular backups and updates, and spam protection on forms.
  • No old test pages, sample files or exposed configuration files. See our website checklist.

7. Secure devices and Wi-Fi

Lock screens, encrypt laptops and phones, use a separate guest Wi-Fi network, and enable remote wipe for lost devices. Keep antivirus or endpoint protection on all computers.

8. Have a simple incident plan

  1. Write down who to call: your IT contact, hosting provider, bank and an adviser.
  2. Disconnect affected devices, change passwords and contact your bank at once if money moved.
  3. Preserve evidence: screenshots, emails and logs.
  4. Check whether personal data is involved and what notification the law requires.
  5. After the incident, fix the cause and update the checklist.

Where to get help

The UAE has national bodies and guidance on cyber security, and your bank often publishes fraud alerts. For your own systems, we can review the security of the software we build for you, set up backups and add roles, logs and two-factor sign-in. See our software modernisation service.

This guide is general information, not legal or tax advice. Rules and thresholds change, so confirm current requirements with the relevant authority or a licensed adviser before you act.

Need software built around how your UAE business really works? Tell us what you need or browse our software and request a demo. We customise, install and support it.