Small and mid-sized businesses are the most targeted segment precisely because they are assumed to be unprotected. The good news is that most successful attacks on SMEs are not sophisticated — they exploit a handful of recurring weaknesses.
Five controls consistently remove the easy paths in:
- Multi-factor authentication on email, banking and ERP accounts
- Least-privilege access, so staff only see the records they need
- Patch management, including the router and the server nobody logs into
- Offline or immutable backups tested by an actual restore
- Staff training against invoice fraud, payment-diversion emails and phone-based social engineering
Invoice fraud deserves special emphasis in our market. Attackers impersonate suppliers and request payment to a new bank account; a two-person verification rule for changes to supplier payment details neutralises most of these attempts at almost no cost.
On the ERP side, security is mostly configuration: strong password policy, session timeouts, role-based permissions, a review of who holds administrator rights, and log retention. Reviewing user access quarterly catches the accounts that outlived their purpose.
The uncomfortable truth is that many breaches are inside jobs or simple negligence rather than external hacking. Segregation of duties — for example, the person creating a supplier cannot also approve its payments — limits both error and opportunity.
Start with the five controls above, verify them once a quarter, and document what you did. A short, honest security review is worth far more than a long, unread policy.
Want this working in your business?
Our team implements ERPNext, KRA eTIMS and M-Pesa integrations for organisations across Kenya and East Africa.
Get the next article by email
Practical ERPNext, eTIMS and cloud writing for African businesses. One short email every couple of weeks.
Double opt-in: confirm via the email we send. Unsubscribe any time.
