Small-Business Cybersecurity

What you'll learn

Small businesses lose money to cybercrime in a few predictable ways. In 2025, people and businesses reported USD 20.9 billion in losses to the FBI's Internet Crime Complaint Center; business email compromise alone accounted for USD 3.05 billion across 24,768 complaints. Verizon's 2026 Data Breach Investigations Report found ransomware in 48% of breaches, and stolen credentials and exploited vulnerabilities behind most of the rest. None of this needs a security team to prevent. It needs the right settings, a few habits, and a plan, chosen by someone who understands why each one matters.

This course teaches exactly that, through one business. Harbor & Pine Bakery, the family bakery on the Port Alder waterfront whose website was built in RNK-WEB-201, hosted in RNK-HOST-301 and contracted for in RNK-CON-201, now needs to protect itself: twelve staff, an office PC, the owner's laptop, two point-of-sale tablets, a shared mailbox for orders, a payroll service, an online ordering platform, and an agency (Northwind Web Studio) that runs its website.

Every module pairs a lesson with a lab that measures something real about the bakery: which of its risks cost the most, which passwords would survive, whether a passkey can be phished, whether its mail passes DMARC, which messages in a mailbox are fraud, which update to install first, whether its backups restore after ransomware, what its cloud settings leave open, which log entries reveal a mailbox takeover, and who must be told what, by when, after an incident.

Learning outcomes

By the end of the course, you can:

1. Inventory a business's assets, score its risks, estimate annualized loss, and organize the work with the NIST Cybersecurity Framework 2.0.
2. Write and enforce a password policy that follows NIST SP 800-63B-4, screen passwords against breached lists without disclosing them, and store passwords safely.
3. Deploy multi-factor authentication, explain why one-time codes can be relayed by a phishing site while passkeys cannot, and plan recovery.
4. Configure and verify SPF, DKIM and DMARC (RFC 9989), read DMARC aggregate reports, and move a domain to enforcement safely.
5. Triage suspicious messages, and set up payment-verification procedures that stop business email compromise even when the email itself is genuine.
6. Keep an inventory of devices and software, prioritize updates with known-exploited lists and exploit predictions, and manage end-of-support systems.
7. Design backups that survive ransomware (3-2-1-1-0), detect mass encryption, and prove a restore.
8. Audit a cloud office suite, file sharing, a Wi-Fi router and a website's security headers, and choose a card-payment integration that keeps PCI DSS scope small.
9. Detect password spraying, guessing, MFA fatigue, mailbox takeover and privilege changes in logs, and tune rules against false alarms.
10. Respond to incidents with a plan, meet notification deadlines, run tabletop exercises, and choose a year's security work within a budget.

Who it's for

• Owners and managers of small businesses, practices and nonprofits who make the security decisions
• Office managers and the "person who knows computers" in a business of 5 to 50 people
• Freelancers and small agencies (like Northwind) who look after clients' systems
• New IT generalists and managed-service technicians who want a practical, standards-based foundation

Prerequisites

Comfort with a computer's terminal and willingness to read and change short Python scripts and JSON files; every lab gives the exact commands. No security background is needed. The three earlier Digital Business Foundations courses help but are not required.

Equipment and software

See the setup guide. Python 3.12 or newer and a text editor; nothing else is required. Git is recommended.

The full setup guide, with verification steps, is in your learning materials when you enroll.

Format and study time

40 guided hours (10 modules × 4 h) plus ~12 h capstone. Instructor-led cohort, 5-day intensive, or self-paced with office hours.

Each scheduled class below states its own format, every meeting date and time, and its time zone.

What a seat includes

Curriculum

1. 01
   Security risk for a small business

   4 h · Lab: An asset inventory, a scored risk register and the price of twelve controls
2. 02
   Passwords and accounts

   4 h · Lab: A modern password policy, a checked set of staff passwords, breached-password lookups, safe storage
3. 03
   Multi-factor authentication and passkeys

   4 h · Lab: TOTP to the RFC test vectors; a phishing relay played against codes and passkeys
4. 04
   Email authentication: SPF, DKIM, DMARC

   4 h · Lab: The bakery's mail authenticated offline; two months of DMARC reports read; a path to p=reject
5. 05
   Phishing and payment fraud

   4 h · Lab: A 24-message mailbox triaged; five payment-verification policies over a simulated year
6. 06
   Devices, updates and vulnerabilities

   4 h · Lab: An inventory checked against advisories; five patching strategies measured against exploitation
7. 07
   Backups and ransomware

   4 h · Lab: Versioned backups, a simulated encryption detected, a verified restore, object lock tested
8. 08
   Cloud services, Wi-Fi and the website

   4 h · Lab: Audits of the office suite, shared files, the router and two web pages' headers
9. 09
   Detecting trouble in logs

   4 h · Lab: Seven detection rules scored on four weeks of logs; thresholds tuned; a takeover reconstructed
10. 10
    Incident response and the security program

    4 h · Lab: An incident timeline, notification deadlines, two tabletop exercises, a budgeted roadmap
11. ★
    Capstone clinic & presentation day

    Lab: Capstone project

Assessment and completion

• Pass: ≥ 70% overall, with the capstone ≥ 70% and at least 8 of 10 labs submitted
• Merit: ≥ 80% overall
• Distinction: ≥ 90% overall, and the capstone includes a tested incident plan (a tabletop exercise run with at least two other people, with its findings fixed) and a verified restore from the proposed backup design

Simply opening a lesson or a video never counts as completing an assessment. Completion is recorded only when the published requirements are met and your instructor has confirmed the result.

Course policies

• Authorization: work only on the lab data and on systems you own or are explicitly authorized, in writing, to assess. Do not scan, test or probe anyone else's systems, and do not send simulated phishing to real people unless the business has approved a written plan that includes who is told, when, and how results are used. A lab or capstone that breaks this rule receives no credit.
• Real data: if your capstone uses a real business, remove or replace names, account numbers, passwords and anything else personal before you submit. Never submit real passwords, keys or recovery codes.
• Late work: −10% per day, up to 3 days; after that, by arrangement. One free 48-hour extension per student.
• Collaboration: discuss freely; write your own reports. Capstone teams of two document who did what.
• AI assistants: allowed, with disclosure in each report. You must be able to explain everything you submit. Do not paste real credentials, logs or customer data into AI services.
• Legal material: the course summarizes laws (state breach-notice laws, the FTC Safeguards Rule, the GDPR, PCI DSS) for orientation, as of October 2026. It is not legal advice; a real incident needs a lawyer.
• Accessibility: materials are searchable PDFs; their Markdown sources are available on request. Contact the instructor for accommodations.
• Attendance (A/B): ≥ 80% required for certification; missed sessions can be made up by submitting the lab with a 1-page reflection.

Upcoming classes