Securing a Small Business Network and Card Payments

A small business network is a router, a few computers and a card terminal, and attackers go after the easiest of them. The good news is that the standard advice is short and fits on one page. This guide follows the PCI Security Standards Council's Guide to Safe Payments (Version 3.0, April 2024) and the FTC's cybersecurity advice for small businesses.

Passwords first

Both documents start here. PCI's guide warns that equipment and software out of the box, including payment terminals, often comes with default passwords such as “password” or “admin,” which are commonly known by hackers and are a frequent source of small merchant breaches. It says to ask your vendors and service providers about default passwords and how to change them, and to give each employee a separate login. The FTC's page says a strong password is at least 12 characters, to never reuse passwords and not to share them by phone, text or email.

The three agencies differ on length: PCI's guide says seven or more characters, the FTC says 12, and CISA says at least 16. Choose the longest your systems allow, and use a password manager; see the password guide.

Keep card data to a minimum

PCI's advice is to protect card data and only store what you need. The surest way to protect data is not to have it. PCI says that for online payments, using a wholly outsourced third party to capture and process payments is in most cases the safest option, and to make sure they are a PCI DSS validated third party. Never write card numbers on paper or in a spreadsheet. If a terminal prints receipts, make sure the full number is not printed.

Ask your payment provider which parts of the standard apply to you; the PCI Council notes that compliance obligations are set by your acquiring bank and the card brands.

Terminals, patches and software

Inspect payment terminals for tampering, which PCI lists among its basics; know what yours looks like, keep a list of serial numbers and check them regularly. Install patches from your vendors as they are released, and turn on automatic updates where you can, which the FTC also advises. Use anti-virus software, and scan for vulnerabilities and fix what they find. Retire devices that no longer get updates; see end-of-life routers.

Separate the networks

Put the card terminals and the office computers on one network and the guest Wi-Fi, staff phones and cameras on others. Most small business routers can create a guest network, as in guest Wi-Fi for customers and the guest network guide. CISA's home-network advice applies to the router too: change the admin password, use WPA3 or WPA2, update firmware, and turn off remote management, WPS and UPnP. See the ten-minute checklist, which works for a shop.

People and phishing

Most breaches start with a message. The FTC's advice: make a call if you're not sure, hover over links before you click, verify requests through a known contact, and report suspicious email to reportphishing@apwg.org and ReportFraud.ftc.gov. Require multi-factor authentication for anything that holds sensitive information. Our guides on two-step verification and what to do after a phishing click help your staff.

Back up your data using the 3-2-1 rule, covered in the business backup guide. Choosing a provider starts with an address, so send yours through the check form; the path from the nearest tower is then checked by a person, who calls you.