Zero trust for small businesses: what actually keeps your website and customer data safe

Security advice for small businesses is usually either too vague ("use strong passwords") or written for banks. This is the practical version: what zero trust means, and what it looks like for a business with a website, a few staff and customer data to protect.

The idea in one paragraph

Older security worked like a castle: a strong wall around the office network, and everyone inside it trusted. Once a password was stolen or a laptop infected, an attacker inside the wall could reach almost everything. Zero trust drops the idea of "inside". In 2020 the US National Institute of Standards and Technology described it in its publication SP 800-207: no one is trusted because of where they connect from, every request is checked, and access is limited to what each person or system needs.

Four habits that cover most of it

1. Strong sign-in everywhere

Stolen and guessed passwords are among the most common ways in. In 2019 Microsoft reported that accounts using multi-factor authentication were more than 99.9% less likely to be compromised. Passkeys go further: they use the fingerprint or face unlock on your own device, there is no password to steal, and they cannot be typed into a fake login page.

Turn on passkeys or two-step sign-in for email, your domain registrar, hosting, payments and your website admin, in that order. Email comes first because it resets everything else.

2. The least access each person needs

• Give every person their own login. Shared logins make it impossible to remove one person or to know who did what.
• Give editors editor rights, not administrator rights.
• Remove access the day someone leaves, including freelancers.
• Check what each plugin, app and integration is allowed to read and change.

3. Fewer moving parts

Every plugin, app and script is code written by someone else that runs with your site's permissions. Remove what you do not use, keep the rest updated, and be suspicious of anything abandoned by its author.

4. Assume something will go wrong

• Keep automatic backups somewhere separate from the site itself, and restore one now and then to prove they work.
• Keep a log of sign-ins and important changes, so you can see what happened.
• Collect less personal data, and delete it on a schedule. Data you never kept cannot leak.

How I applied it to iVishwa's client portal

When I built the portal where our clients approve designs, share files and pay invoices, I followed the same rules:

• Passkeys first. Clients sign in with a passkey. An optional password is first stretched on their own device, so the plain password never reaches our server.
• Every request is checked on the server. Each screen and file request proves who is asking and which client account it belongs to. Hiding a button in the browser is never treated as security.
• Roles. A client's team members can be owners, approvers, billing contacts or viewers, and each role can do only its own tasks.
• Private files. Files are stored privately and only open for a signed-in member of that client's team.
• A record of everything that matters. Approvals are signed with a typed name and recorded with the time and device. Sign-ins, payments and changes go into an activity log the client can read.
• Sessions you control. Clients can see every device signed in to their account and sign any of them out.

None of this needs a large security team. It needs the decisions to be made at the start, which is far cheaper than adding them later.

What zero trust is not

• Not a product. A vendor can sell you parts of it, such as sign-in or device management, but the idea is a way of deciding who gets access to what.
• Not a VPN. A traditional VPN lets someone onto the network and then trusts them. That is the castle model again.
• Not only for big companies. The four habits above cost little and stop the most common attacks.

Written by Vish Jay

I design and build websites, online stores and business systems for clients in the US, UK, Europe, Australia and Canada, from Colombo, Sri Lanka. When you work with iVishwa, you talk to me directly, from the first call to launch and after.