Cybersecurity doesn't have to be expensive
When it comes to cybersecurity, many SMB owners immediately think of large budgets, expensive consultants, and complex software. This misconception leaves thousands of African businesses completely unprotected.
The truth: 5 basic measures — multi-factor authentication, tested backups, restricted permissions, updates, and an incident response plan — block the majority of attacks. And they're free.
Here is your action plan, ready to implement this week.
Reflex 1: Enable Two-Factor Authentication (MFA)
The problem
A password alone is no longer enough. Cybercriminals use stolen databases, phishing, and automated tools to crack your passwords within minutes.
The free solution
Enable MFA (multi-factor authentication) on all your critical accounts:
- Professional email (Gmail, Outlook, etc.)
- Online banking and Mobile Money
- Company social media accounts
- Cloud tools (Google Drive, Dropbox, etc.)
Use an app like Google Authenticator or Microsoft Authenticator (both free) rather than SMS, which can be intercepted.
Impact
According to Microsoft, MFA blocks 99.9% of automated attacks on accounts.
Reflex 2: The 3-2-1 rule for backups
The problem
If ransomware encrypts your files and you have no backup, you lose everything. This is the most devastating scenario for an SMB.
The free solution
Apply the 3-2-1 rule recommended by ANSSI:
- 3 copies of your important data
- On 2 different media (e.g., computer + external drive + cloud)
- Including 1 offline copy disconnected from the network (a drive you unplug after each backup)
Free cloud services to get started: Google Drive (15 GB), OneDrive (5 GB), or Mega (20 GB).
Impact
A business with tested backups recovers from ransomware in a matter of hours rather than weeks — or never.
Reflex 3: Keep everything updated, all the time
The problem
Cybercriminals exploit known security vulnerabilities in software. These vulnerabilities are patched through updates — but if you don't install them, you remain exposed.
The free solution
- Enable automatic updates on Windows, macOS, Android, iOS
- Update your browser (Chrome, Firefox, Edge)
- Update your applications and plugins (WordPress, etc.)
- Don't forget your Wi-Fi router (firmware)
Impact
Most ransomware and malware exploit vulnerabilities that have already been patched for months. A simple update stops them cold.
Reflex 4: Use a password manager
The problem
"Dakar2024!", "company123", your children's names followed by their birth year — weak and reused passwords are the leading cause of account breaches.
The free solution
Use a password manager like Bitwarden (free and open source):
- It generates unique, complex passwords
- It stores them in encrypted form
- It auto-fills them on your websites and apps
- You only need to remember one master password
Impact
A unique 16-character password per account eliminates the risk of credential stuffing (attacks using passwords stolen from another site).
Reflex 5: Restrict access rights
The problem
In many SMBs, everyone has access to everything — accounting files, customer data, admin tools. If just one account is compromised, the attacker gains access to the entire company.
The free solution
Apply the principle of least privilege:
- Each employee only accesses data necessary for their role
- Admin accounts are reserved for administrative tasks only
- Remove access for former employees immediately upon departure
- Conduct an access audit every quarter
Impact
If an account is compromised, the damage remains contained to that user's scope.
Reflex 6: Train your team (even 30 minutes)
The problem
95% of cyberattacks exploit human error. Clicking a malicious link, opening an attachment without thinking, sharing a password over WhatsApp — it only takes one mistake from a single team member.
The free solution
Organize a 30-minute session with your team. Cover the essentials:
- How to spot a phishing email — check the sender, hover over links before clicking, be wary of urgency
- Never share passwords — not by email, not over WhatsApp, not over the phone
- Report incidents — encourage reporting without blame (a false alarm is far better than an ignored attack)
- Lock your workstation — Windows + L or Cmd + Q when stepping away from your desk
Free resource: the Cybersecurity Toolkit by the Global Cyber Alliance (GCA), sponsored by Mastercard, available in French at gcatoolkit.org.
Impact
Half a day of training reduces the risk of human error by 60 to 80%.
Reflex 7: Prepare your emergency response plan
The problem
When an attack strikes, panic takes over. Who do you call? What do you disconnect? How do you notify clients? Without a plan, the response is chaotic and the damage compounds.
The free solution
Create a simple document (1–2 pages) that answers these questions:
- Who is the cybersecurity point of contact within the company?
- Emergency contacts: IT provider, authorities (DSC in Sénégal), insurance
- Isolation procedure: how to disconnect an infected device from the network
- Backup location: where they are and how to restore them
- Communication: a message template to notify clients in case of a data breach
Print this plan and post it visibly — in the event of an attack, your IT systems may be inaccessible.
Impact
A prepared response plan reduces recovery time by an average of 74%.
Summary checklist
| Reflex | Time | Cost | |--------|------|------| | MFA on all accounts | 1h | Free | | 3-2-1 backups | 2h | Free (cloud + external drive) | | Automatic updates | 30 min | Free | | Password manager | 1h | Free (Bitwarden) | | Access rights audit | 1h | Free | | Team training | 30 min | Free | | Emergency response plan | 1h | Free |
Total: less than one workday to protect your business against 80% of cyberattacks.
Conclusion: start today
You don't need a corporate-level budget to protect your SMB. The 7 reflexes above are free, straightforward to implement, and block the vast majority of attacks.
The best time to secure your business was yesterday. The second best time is right now.
Need personalized guidance? Rostel High-Tech offers security audits and training programs tailored to Senegalese and African SMBs. Request your free assessment.
Sources: ANSSI — Cybersecurity Guide for Small Businesses 2026, Microsoft Security Report, Global Cyber Alliance (GCA), NinjaOne — Cybersecurity Statistics 2026.
