--- title: Securing a Small Business Network and Card Payments url: https://hdiss.net/guides/secure-a-small-business-network/ business: High Desert Internet Services (HDISS) phone: 775-575-9593, 775-391-5660 email: info@hdiss.net mailing_address: Home base: 200 S Virginia St, Suite 760, Reno NV 89501 (dispatch office, not a walk-in store). Mail: Billing Dept., PO Box 11353, Reno NV 89510 hours: Office open 9:00 AM to 5:00 PM, seven days a week. Network watched around the clock. type: Fixed wireless internet service provider (homes and small businesses), web hosting, customer email, domain registration service_area: Northern Nevada - Washoe, Lyon, Storey, Churchill and Douglas counties and Carson City; availability is checked address by address (line of sight to a tower) plans: Bronze $50/mo up to 500 Mbps down, up to 200 Mbps up; Silver $75/mo up to 800 down, up to 200 up; Gold $99/mo up to 1 Gig down, up to 200 up; ask about the up to 1 Gig / 1 Gig ultra-low-latency service no_online_purchase: true (check your address or call; existing customers pay at https://www2.fernley.net/hdiss/onlinepay/paymentform.cfm) since: 2002 --- - [Home](https://hdiss.net/) - [Guides](https://hdiss.net/guides/) - Securing a small business network and card payments # Securing a Small Business Network and Card Payments Change default passwords, keep card data off your systems when you can, check payment terminals for tampering, install patches, and keep payment devices on a separate network from guests and staff phones. The PCI Council and the FTC list the same basics. A Wi-Fi router on a shelf. Stock photo: Adobe Stock. [Photo credits](https://hdiss.net/photo-credits/) On this page - [Passwords first](#passwords-first) - [Keep card data to a minimum](#keep-card-data-to-a-minimum) - [Terminals, patches and software](#terminals-patches-and-software) - [Separate the networks](#separate-the-networks) - [People and phishing](#people-and-phishing) A small business network is a router, a few computers and a card terminal, and attackers go after the easiest of them. The good news is that the standard advice is short and fits on one page. This guide follows the PCI Security Standards Council's Guide to Safe Payments (Version 3.0, April 2024) and the FTC's cybersecurity advice for small businesses. ## Takeaways - PCI lists basics: strong passwords and change default ones, protect card data and only store what you need, inspect terminals for tampering, use trusted partners, install patches. - The FTC advises passwords of at least 12 characters, never reused, and requiring multi-factor authentication. - PCI says that, in most cases, a wholly outsourced third party to capture and process payments is the safest option. - Different documents set different minimum password lengths: PCI seven characters, the FTC 12, CISA 16. Use the longest your systems allow. ## Passwords first Both documents start here. PCI's guide warns that equipment and software out of the box, including payment terminals, often comes with default passwords such as “password” or “admin,” which are commonly known by hackers and are a frequent source of small merchant breaches. It says to ask your vendors and service providers about default passwords and how to change them, and to give each employee a separate login. The FTC's page says a strong password is at least 12 characters, to never reuse passwords and not to share them by phone, text or email. The three agencies differ on length: PCI's guide says seven or more characters, the FTC says 12, and CISA says at least 16. Choose the longest your systems allow, and use a password manager; see [the password guide](https://hdiss.net/guides/passwords-and-password-managers/). ## Keep card data to a minimum PCI's advice is to protect card data and only store what you need. The surest way to protect data is not to have it. PCI says that for online payments, using a wholly outsourced third party to capture and process payments is in most cases the safest option, and to make sure they are a PCI DSS validated third party. Never write card numbers on paper or in a spreadsheet. If a terminal prints receipts, make sure the full number is not printed. Ask your payment provider which parts of the standard apply to you; the PCI Council notes that compliance obligations are set by your acquiring bank and the card brands. ## Terminals, patches and software Inspect payment terminals for tampering, which PCI lists among its basics; know what yours looks like, keep a list of serial numbers and check them regularly. Install patches from your vendors as they are released, and turn on automatic updates where you can, which the FTC also advises. Use anti-virus software, and scan for vulnerabilities and fix what they find. Retire devices that no longer get updates; see [end-of-life routers](https://hdiss.net/guides/end-of-life-routers/). ## Separate the networks Put the card terminals and the office computers on one network and the guest Wi-Fi, staff phones and cameras on others. Most small business routers can create a guest network, as in [guest Wi-Fi for customers](https://hdiss.net/guides/guest-wifi-for-customers/) and the [guest network guide](https://hdiss.net/guides/guest-networks-and-wifi-passwords/). CISA's home-network advice applies to the router too: change the admin password, use WPA3 or WPA2, update firmware, and turn off remote management, WPS and UPnP. See [the ten-minute checklist](https://hdiss.net/guides/secure-your-home-network/), which works for a shop. ## People and phishing Most breaches start with a message. The FTC's advice: make a call if you're not sure, hover over links before you click, verify requests through a known contact, and report suspicious email to reportphishing@apwg.org and ReportFraud.ftc.gov. Require multi-factor authentication for anything that holds sensitive information. Our guides on [two-step verification](https://hdiss.net/guides/two-step-verification/) and [what to do after a phishing click](https://hdiss.net/guides/clicked-a-phishing-link-what-now/) help your staff. Back up your data using the 3-2-1 rule, covered in [the business backup guide](https://hdiss.net/guides/cloud-backup-for-a-small-business/). Choosing a provider starts with an address, so send yours through the check form; the path from the nearest tower is then checked by a person, who calls you. ### Sources - [listings.pcisecuritystandards.org/pdfs/Small_Merchant_Guide_to_Safe_Payments.pdf](https://listings.pcisecuritystandards.org/pdfs/Small_Merchant_Guide_to_Safe_Payments.pdf) (PCI Security Standards Council, Guide to Safe Payments v3.0, April 2024, read 10/15/26) - [ftc.gov/business-guidance/small-businesses/cybersecurity](https://www.ftc.gov/business-guidance/small-businesses/cybersecurity) (FTC, Cybersecurity for Small Business, read 10/15/26) - [cisa.gov/secure-our-world/use-strong-passwords](https://www.cisa.gov/secure-our-world/use-strong-passwords) (CISA, Use Strong Passwords, read 10/15/26) - [cisa.gov/news-events/news/home-network-security](https://www.cisa.gov/news-events/news/home-network-security) (CISA, Home Network Security, read 10/15/26) ### Talk to a person - Call [775-575-9593](tel:7755759593) [775-391-5660](tel:7753915660) Open 9-5 every day - Email [info@hdiss.net](mailto:info@hdiss.net) [Check my address](https://hdiss.net/check-availability/#check) Local since 2002 Fixed wireless from towers in Northern Nevada. Three plans, no contracts, local support, 4.8 on Google from 36 reviews. [About High Desert](https://hdiss.net/about/) ### Keep reading - [Card readers and point-of-sale: what connection they need](https://hdiss.net/guides/card-readers-and-point-of-sale/) - [Guest Wi-Fi for customers](https://hdiss.net/guides/guest-wifi-for-customers/) - [Cloud backup for a small business: what upload speed buys you](https://hdiss.net/guides/cloud-backup-for-a-small-business/) - [Passwords and password managers in plain words](https://hdiss.net/guides/passwords-and-password-managers/) - [Secure your home network: a ten-minute checklist](https://hdiss.net/guides/secure-your-home-network/) ## More on business - [Internet for a home office vs a storefront](https://hdiss.net/guides/home-office-vs-storefront/): High Desert's three plans are labeled for residential and small business use, so the same price list covers a home office and a shop. What differs is what you ask for: a home office needs steady upload for calls, a - [Card readers and point-of-sale: what connection they need](https://hdiss.net/guides/card-readers-and-point-of-sale/): A card reader sends very little data, so what matters is that the connection stays up, not how fast it is. Ask your payment company which connections the terminal can use, whether it can hold sales offline and what its o - [VoIP phones over fixed wireless](https://hdiss.net/guides/voip-phones-over-fixed-wireless/): VoIP phones can run over a fixed wireless connection when the link is steady, because one voice call needs only a small slice of the speed. The things to settle are the phone provider's own requirements, power durin ## Questions people ask ### Do I need to be PCI compliant if I only have a card terminal? Your acquiring bank or processor sets the requirements. Ask them which questionnaire applies, and follow the basics above in the meantime. ### Is the guest network really necessary? It keeps customer devices away from your card terminal and computers. It takes a few minutes to set up.