Cybersecurity and Ransomware Basics for SMEs

A practical cybersecurity course for owners, managers and the people who look after IT in small and mid-sized businesses. You will learn how attacks get in and how ransomware unfolds, then put the core controls in place: multi-factor authentication, patching, backups that survive ransomware, endpoint protection and least privilege. It covers awareness training, payment fraud, remote work and IT providers, incident response and the first hours of an attack, the ransom decision, Canadian breach notification duties, cyber insurance, frameworks such as the Cyber Centre baseline controls and NIST CSF 2.0, and a 90-day plan. It is general guidance, not legal or specialist technical advice.

Course structure

• Module 1: The Threat (4 lessons). Why SMEs are targets, how attacks get in, how ransomware unfolds and what an incident costs.
• Module 2: Core Controls (4 lessons). Multi-factor authentication and passwords, patching and secure setup, ransomware-resistant backups, endpoint protection and least privilege.
• Module 3: People, Payments and Partners (4 lessons). Security awareness that works, stopping payment fraud, remote work and devices, and IT providers, cloud services and suppliers.
• Module 4: Prepare and Respond (4 lessons). Incident response plans, the first hours of a ransomware attack, the ransom decision and breach notification duties in Canada.
• Module 5: Build Your Program (4 lessons). Cyber insurance, frameworks and certification, priorities and budget, and a 90-day plan.

Interactive labs

• Safe, verify first, or phishing?: Sort twelve messages a small business might receive into safe, verify first through a trusted channel, or report as phishing. Then check your answers.
• What a week offline would cost: Enter your revenue, margin, staffing and recovery estimates to see what a cyber incident that stops your systems would cost.
• Your cyber readiness self-assessment: Rate your business on eight areas of basic cyber readiness. The radar chart shows strengths and gaps, with a next step for each area. Retake it at the end of your 90-day plan.

How it works

• Work through 20 short lessons at your own pace. Each has key takeaways, an exercise for your own workplace and a quick knowledge check.
• Try the three interactive labs as you reach them in the course.
• Pass the 20-question final exam (70% or higher, unlimited retakes) to unlock your Chmltech certificate of completion.
• Free, with no sign-up. Your progress is saved in this browser.

Many owners assume attackers only go after banks and large corporations. In reality, most attacks are automated and opportunistic. Criminal groups scan the internet for any exposed, unpatched system and send phishing emails by the million. They are looking for an easy way in, not a particular company. A 20-person firm with a weak password on its remote access is as attractive as a large one, and usually easier.

Why SMEs are attractive

• Fewer defences: no dedicated security staff, older systems, and security handled by whoever is "good with computers".
• Money moves through them: invoices, payroll and supplier payments make SMEs targets for payment fraud.
• Valuable data: customer records, employee information and designs can be sold or held for ransom.
• A route to bigger targets: attackers use smaller suppliers to reach their larger customers.
• Dependence on IT: when systems stop, so do orders, production and shipping, which makes paying a ransom tempting.

The good news

Most successful attacks exploit a short list of basic weaknesses: stolen or weak passwords without multi-factor authentication, unpatched systems, exposed remote access, untested backups and staff who have not been shown what phishing looks like. Fixing these basics stops the large majority of opportunistic attacks and does not need a big budget.

This course is practical guidance for business owners and managers, not a technical security manual. For specialist work such as configuring firewalls or investigating an incident, use a qualified IT or security provider. The Canadian Centre for Cyber Security (the Cyber Centre) publishes free, practical guidance for small and medium organizations that complements this course.

Attackers use a handful of entry points again and again. Knowing them tells you where to put your effort.

Spotting phishing

Phishing messages often share signs: urgency ("your account will be closed today"), a request to log in, pay or open a file, a sender address that does not quite match, generic greetings, and links whose real address differs from the text. Generative AI now makes phishing messages fluent and personalized, so spelling mistakes are no longer a reliable sign. The safest habit is to treat any unexpected request to log in, pay or change details as suspicious, and to verify it through a separate channel you already trust.

The lab after this lesson asks you to sort messages into safe, verify first, and report as phishing.

Ransomware is malicious software that encrypts files and systems so they cannot be used, followed by a demand for payment, usually in cryptocurrency, for a decryption key. Modern ransomware groups operate like businesses, with affiliates, help desks and negotiators.

How a typical attack unfolds

1. Initial access: through phishing, stolen credentials, exposed remote access or an unpatched system.
2. Foothold and reconnaissance: the attacker quietly explores the network, often for days or weeks.
3. Privilege escalation: they obtain administrator accounts to control more systems.
4. Data theft: sensitive files are copied out.
5. Backup destruction: connected backups are deleted or encrypted.
6. Encryption and demand: systems are encrypted, often overnight or at a weekend, and a ransom note appears.

Double extortion

Because good backups let victims recover without paying, many groups now also steal data first and threaten to publish it. Even a company that restores everything from backup may face a demand to stop the leak, plus legal duties to notify people whose information was taken.

Why the timeline matters

Because attackers often spend time inside the network before encrypting, there are chances to detect and stop them: alerts from endpoint protection, unusual logins, new administrator accounts or large data transfers. Each stage also has a matching defence: MFA blocks many initial access attempts, limited admin rights slow escalation, and offline backups survive the destruction step.

A serious cyber incident affects much more than IT. Knowing the full cost helps you decide how much protection is worth.

Downtime is usually the biggest cost

Rebuilding systems after ransomware often takes days to weeks, even with good backups, because every system must be checked, cleaned and restored in the right order. Estimate the cost of a week without systems: lost gross margin on sales that could not be made, wages for staff who could not work, and recovery costs. The lab after this lesson calculates it.

Legal duties

Under Canada's federal private-sector privacy law (PIPEDA), organizations must report breaches of security safeguards involving personal information to the Office of the Privacy Commissioner of Canada when it is reasonable to believe there is a real risk of significant harm, notify affected individuals, and keep records of all such breaches. Some provinces have their own laws and requirements. A later lesson covers this in more detail.

With a realistic cost in hand, spending a few thousand dollars a year on the basics usually looks like good value, and the conversation with your insurer and bank becomes easier.

If you do only one thing after this course, turn on multi-factor authentication (MFA) everywhere it is available. MFA requires a second proof of identity, such as a code from an app, a push notification or a security key, in addition to the password. A stolen password alone is then not enough to log in.

Where MFA matters most

1. Email accounts, which are the key to resetting every other password.
2. Remote access: VPN, remote desktop gateways and remote support tools.
3. Administrator accounts for systems, cloud services and networks.
4. Banking and payment platforms.
5. Cloud applications holding business data: accounting, CRM, file sharing.

Stronger and weaker forms

Authenticator apps and hardware security keys are stronger than text-message codes, which can be intercepted or redirected. Phishing-resistant methods, such as security keys and passkeys, cannot be captured by a fake login page. Use the strongest option each system supports, especially for administrators. Train staff to reject MFA prompts they did not start: attackers sometimes send repeated prompts hoping someone approves one.

Passwords still matter

• Use a password manager so everyone can have long, unique passwords without remembering them.
• Use passphrases of several random words where you must remember one.
• Never reuse work passwords on personal sites; reused passwords leaked from other breaches are a common way in.
• Change default passwords on routers, printers, cameras and other devices.
• Remove accounts promptly when staff leave.

Attackers scan for systems with known, unpatched flaws within days, sometimes hours, of a fix being published. Keeping software up to date closes these doors.

Start with an asset inventory

You cannot protect what you do not know you have. Keep a simple list of:

• Computers, servers, laptops and phones that access business data.
• Network equipment: firewalls, routers, Wi-Fi access points, VPN devices.
• Software and cloud services, with who owns each.
• Internet-facing systems: anything reachable from outside your office.

Patch by priority

Turn on automatic updates wherever practical. Replace systems that no longer receive security updates, such as old operating systems and end-of-life firewalls; they cannot be patched.

Secure configuration

• Change default passwords and turn off features you do not use.
• Do not expose remote desktop directly to the internet.
• Use a business-grade firewall and keep its firmware updated.
• Separate guest Wi-Fi from the business network.

Production equipment controls and building systems that connect to the network need the same attention, coordinated with their suppliers.

Backups are your recovery plan when everything else fails. But attackers know this, and they look for backups to delete or encrypt before they launch ransomware. A backup that is always connected to the network can be destroyed along with everything else.

The 3-2-1 rule, updated

• 3 copies of important data: the original plus two backups.
• 2 different types of storage or locations.
• 1 copy offline or immutable: disconnected from the network, or stored in a way that cannot be changed or deleted for a set period, even by an administrator.

Many cloud backup services offer immutability or object lock. Make sure backup administration uses separate credentials with MFA, not the same accounts used day to day.

Back up the right things

• File shares and documents.
• Business systems: accounting, ERP, CRM databases.
• Cloud data: do not assume your cloud provider keeps restorable backups of your email and files for as long as you need; check the terms and consider a separate backup.
• System configurations, so servers and network devices can be rebuilt.

Test restores

A backup you have never restored is a hope, not a plan. Test restoring individual files every month and a full critical system at least once or twice a year. Time the full restore: if it takes four days to restore your ERP, that is part of your downtime estimate. Document the restore steps so someone other than your usual IT person can follow them.

Decide recovery targets

For each critical system, agree how much data you can afford to lose (for example, one day's work) and how long it can be down (for example, two days). These targets drive backup frequency and the recovery approach.

Several technical controls work together to stop attacks that get past the first line.

Least privilege

Give people and systems only the access they need for their job. In particular:

• Staff should not use administrator accounts for daily work like email and browsing. Use a separate admin account only when needed.
• Limit who can install software.
• Restrict access to sensitive folders and systems by role, and review access when people change jobs or leave.
• Protect and monitor the few accounts that can control everything, such as domain and cloud tenant administrators.

Least privilege slows attackers down: when a user's account is compromised, the attacker gets only that user's access, not the keys to everything.

Monitoring

Controls produce alerts. Someone must watch them and act, whether an internal person, your IT provider or a managed detection and response (MDR) service that monitors around the clock. An alert at 2 a.m. on Saturday is when ransomware often starts.

People are often called the weakest link. A better view is that people are your largest sensor network: well-trained staff who report suspicious messages quickly can stop an attack before it spreads.

What effective awareness looks like

• Short and frequent: a few minutes a month beats an annual hour-long video.
• Practical: real examples from your industry: fake invoices, delivery notices, shared-document links, payroll change requests.
• Phishing simulations: safe test emails show who clicks, followed by a short lesson on the spot, not punishment.
• Easy reporting: a "report phishing" button or a simple email address, and a quick thank-you every time.
• Role-specific: extra training for finance, payroll, executives and IT administrators, who are targeted most.

A reporting culture

The most important message is: if you clicked something you shouldn't have, tell us immediately. Someone who reports a mistake within minutes lets IT reset a password or isolate a computer before damage is done. Someone afraid of blame stays quiet, and the attacker keeps going. Thank people who report, even when it turns out to be a false alarm.

Cover the basics for everyone

• Recognizing phishing and verifying unusual requests.
• Using MFA and a password manager; never approving unexpected MFA prompts.
• Locking screens, protecting devices and reporting lost ones.
• Handling sensitive data and what not to paste into public AI tools.
• Whom to call and what to do if something seems wrong.

Business email compromise (BEC) and invoice fraud are among the costliest cyber crimes for businesses, and they often need no malware at all. A criminal impersonates a supplier, customer or executive and asks for a payment or a change of bank details. Money sent to a fraudulent account is often impossible to recover.

Common scenarios

• A "supplier" emails to say its bank account has changed and asks that the next invoices be paid to the new account.
• An "executive" asks finance to make an urgent, confidential payment.
• A real supplier's email account has been hacked, and the fraudulent request comes from their genuine address in an existing email thread.
• An "employee" asks payroll to change the account where their pay is deposited.

Controls that work

If it happens

Contact your bank immediately: the sooner they act, the better the chance of stopping or recovering the funds. Report to the police and the Canadian Anti-Fraud Centre, preserve the emails, and check whether your email account was compromised.

Staff now work from home, job sites, hotels and phones. Each place and device is another way in if it is not managed.

Company devices

• Use device management to enforce updates, screen locks, disk encryption and the ability to wipe a lost device.
• Install endpoint protection on laptops as well as office desktops.
• Encrypt laptop drives so a stolen laptop does not mean stolen data.

Personal devices

If staff use personal phones or computers for work, decide what is allowed. Many SMEs allow email and approved apps on personal phones through management tools that separate work data and can remove it without touching personal content. Avoid storing business files on unmanaged personal computers.

Remote access

• Use a VPN or a secure remote access service with MFA; never expose remote desktop directly to the internet.
• Prefer cloud services with strong authentication over remote access to office servers where practical.
• Remove remote access when staff or contractors no longer need it.

Networks

• Home routers should have updated firmware and a strong, non-default password.
• Public Wi-Fi is risky for sensitive work; use the VPN or a phone hotspot.
• In the office, keep guest Wi-Fi separate from business systems.

Lost or stolen devices

Make reporting a lost device immediate and easy. With device management, IT can lock or wipe it, and accounts can be signed out remotely. Check whether personal information was on the device, as this can trigger privacy obligations.

Most SMEs rely on outside parties: a managed IT provider (MSP), cloud software, payment processors and suppliers who connect to their systems. Each brings expertise, and each is also a possible way in.

Managed IT providers

An MSP often has administrator access to many clients at once, which makes it a valuable target. Ask your provider:

• Do you use MFA on all accounts that can access our systems, including your remote management tools?
• Who on your team has access to our systems, and how is it reviewed?
• How are our backups protected from deletion, and when was a restore last tested?
• What do you monitor, and who responds to alerts outside business hours?
• What will you do, and how fast, if we have an incident? Is incident response included or extra?

Put the answers in your contract or service agreement where you can.

Cloud services: shared responsibility

Cloud providers secure their infrastructure, but you are responsible for how you use it: user accounts, MFA, sharing settings, access permissions and, in many cases, backups of your own data. Misconfigured sharing, such as files shared publicly by link, is a common cause of data exposure.

Suppliers and partners

• Give third parties only the access they need, for as long as they need it.
• Require MFA for any external account on your systems.
• Ask key suppliers about their security, especially those handling your customers' data.
• Expect your larger customers to ask you the same questions; good basics help you win and keep contracts.

When an incident hits, people panic, systems are down and decisions are needed fast. A short plan written in advance makes the difference between a bad week and a disaster.

What the plan should contain

Keep it short and reachable

Two to five pages is enough for most SMEs. Keep printed copies at home and the office, and a copy on a phone, because the network may be unavailable during an incident. Include a simple decision tree for the first hour.

Practise it

Run a tabletop exercise once a year: gather the leadership team for 90 minutes, walk through a realistic scenario ("Monday 6 a.m., screens show a ransom note") and talk through each decision. Exercises reveal missing phone numbers, unclear authority and untested assumptions, cheaply and safely. The Cyber Centre and many insurers offer free scenarios.

Know your insurer's rules

Many cyber policies require you to call their hotline first and to use their approved response firms. Calling someone else first can affect coverage, so put the insurer's number at the top of the contact list.

What you do in the first hours shapes how bad the incident becomes. The goals are to stop the spread, preserve evidence and get expert help quickly.

Do

1. Isolate affected devices: disconnect them from the network by unplugging network cables or turning off Wi-Fi. Do not switch them off unless your responders advise it, because memory can hold evidence and sometimes encryption keys.
2. Call your incident lead and your insurer's hotline, then the incident response firm and IT provider as the plan says.
3. Protect backups: make sure offline backups stay disconnected until responders confirm it is safe.
4. Preserve evidence: photograph ransom notes and screens, keep logs, and write down a timeline of what was seen and done.
5. Use out-of-band communication: phones or a separate messaging service, since attackers may be watching email.
6. Reset credentials from a clean device, starting with administrator and email accounts, as responders direct.

Don't

• Don't wipe or rebuild systems before evidence is preserved and the entry point is understood; attackers may still be inside and reinfect restored systems.
• Don't contact the attackers or pay anything before talking to your insurer, responders and legal counsel.
• Don't announce details publicly before you understand the situation and have legal advice.

Recovery in the right order

Responders will typically confirm the attacker has been removed, then restore in priority order: identity systems and core infrastructure first, then critical business systems, then the rest, checking each before reconnecting. Report the incident to the Cyber Centre and the police; they can sometimes share decryption tools or intelligence and use reports to warn others.

Paying a ransom is one of the hardest decisions a business can face. Canadian authorities, including the Cyber Centre and the RCMP, discourage paying. The decision ultimately rests with the business, but it should never be made alone or in a hurry.

Reasons not to pay

• No guarantee: decryption tools may be slow, faulty or never delivered; stolen data may still be published or sold.
• Repeat targeting: organizations that pay may be seen as willing to pay again.
• Funding crime: payments fund further attacks.
• Legal risk: paying a group subject to sanctions can be unlawful; legal advice is essential.
• Recovery is still needed: even with a working key, systems must be cleaned, rebuilt and secured.

Why some businesses consider it

When backups were destroyed or never existed and the business cannot survive weeks of downtime, owners may feel they have no choice. This is exactly why tested, offline backups matter: they turn a desperate decision into a recovery project.

If the question arises

• Involve your insurer, legal counsel and incident response firm before any contact with attackers.
• Check what your backups can recover and how long it would take, so the choice is based on facts.
• Report the incident to the police and the Cyber Centre whatever you decide.
• Remember that payment does not remove legal duties, such as notifying people whose data was stolen.

The best answer to this question is to make sure you never have to ask it.

If an incident involves personal information, privacy law may require you to report it and to notify the people affected. Understanding the basics in advance helps you act correctly under pressure.

Federal law: PIPEDA

Under the Personal Information Protection and Electronic Documents Act, which applies to many private-sector organizations in Canada, an organization must:

• Report to the Office of the Privacy Commissioner of Canada any breach of security safeguards involving personal information under its control if it is reasonable to believe the breach creates a real risk of significant harm to an individual.
• Notify affected individuals in those cases, as soon as feasible, with enough information to understand the harm and protect themselves.
• Notify other organizations that may be able to reduce the harm, such as banks.
• Keep a record of every breach of security safeguards, whether or not it was reportable, for at least 24 months.

Significant harm includes things like identity theft, financial loss, humiliation and damage to reputation. The assessment considers how sensitive the information is and how likely it is to be misused.

Provincial laws

Some provinces have their own private-sector privacy laws with their own breach rules, such as Quebec's private-sector law as amended by Law 25 and Alberta's Personal Information Protection Act. Public bodies and health information are often covered by separate laws. Which law applies depends on where you operate and what information is involved.

Contracts

Customer contracts may require you to notify them of security incidents within a set time, sometimes 24 to 72 hours. Check your key contracts now, not during an incident.

This lesson is general information, not legal advice. Involve a lawyer with privacy experience as soon as an incident might involve personal information.

Cyber insurance can cover costs such as incident response, legal advice, notification, data recovery, business interruption and, in some policies, fraud losses. It also gives access to experienced responders through the insurer's hotline, which many SMEs could not arrange on their own at short notice.

Insurers expect the basics

Application forms and renewals increasingly ask detailed questions, and some insurers scan applicants' internet-facing systems. Common requirements include:

• MFA on email, remote access and administrator accounts.
• Offline or immutable backups that are tested.
• Endpoint detection and response on computers and servers.
• Prompt patching and no exposed remote desktop.
• Security awareness training and payment verification procedures.
• An incident response plan.

Answer truthfully: an inaccurate answer on an application can put a claim at risk. If you cannot answer yes to a requirement, fixing it often improves both your security and your premium.

Read the policy

• What is covered: response, business interruption, extortion, data restoration, fraud, regulatory costs?
• Limits and sub-limits for each type of loss, and the deductible or waiting period for business interruption.
• Exclusions, for example for unpatched known vulnerabilities, war or state-sponsored attacks, or social engineering fraud unless specifically added.
• Who you must call first, and whether you must use approved vendors.

Work with a broker who understands cyber policies, and check how cyber cover interacts with your other insurance. Insurance transfers part of the financial risk; it does not replace the controls that prevent incidents.

Frameworks give you a structured checklist so you do not have to invent a security program from scratch. Three are especially useful for Canadian SMEs.

The six functions in plain language

• Govern: someone owns cyber risk, with policies, roles and a budget.
• Identify: know your assets, data, suppliers and risks.
• Protect: MFA, patching, backups, training, access control.
• Detect: monitoring and alerts that someone acts on.
• Respond: the incident plan, contacts and first steps.
• Recover: tested restores and lessons learned.

Larger customers will ask

Manufacturers, distributors and service firms supplying large companies or governments increasingly receive security questionnaires or contract clauses requiring specific controls or certifications. Defence supply chains have their own, stricter requirements. Having a framework-based program, with evidence, turns these questionnaires from a scramble into a routine task.

Pick one framework, use it as your checklist and review progress every quarter. Check the Funding page on this site for programmes that may help SMEs pay for technology and cybersecurity projects, and confirm eligibility with each programme.

No SME can do everything at once. Prioritize the controls that stop the most common attacks for the least effort, then build up.

A practical priority order

Thinking about cost

Several of these cost little beyond time: MFA is included in most business email and cloud services; payment verification is a procedure; an incident plan is a few pages. Others, such as EDR, monitoring, backup services and training platforms, are usually priced per user or per device per month. Ask your IT provider for a quote per item, and compare the total yearly cost with your estimate of a week of downtime from the earlier lab.

Assign ownership

Name one person in the business as accountable for cyber risk, even if the technical work is done by an outside provider. Review progress at a management meeting each quarter, using a short scorecard: percentage of accounts with MFA, last restore test date, patch status of internet-facing systems, phishing simulation results and open actions.

A focused 90-day plan gets the most important controls in place and builds the habits to keep improving.

Measures to track

• Share of accounts with MFA (target: 100% for email, remote access and admins).
• Date and duration of the last successful restore test.
• Internet-facing systems fully patched and supported.
• Devices with EDR installed and reporting.
• Phishing simulation click and report rates.

Keep going

After 90 days, use the Cyber Centre baseline controls or the NIST functions to choose the next steps, and consider CyberSecure Canada certification if customers ask for evidence. Security is not a project with an end date: threats change, staff change and systems change, so the quarterly review is what keeps you protected.

Use the self-assessment lab after this lesson to see your strengths and gaps across eight areas, and retake it at the end of your 90-day plan.