Security Basics a Small Nepali Business Actually Needs

The short answer

Almost nobody is targeting your small Nepali business specifically. What reaches you is automated: bots trying known passwords, scanners looking for unpatched software, and phishing sent to a million addresses at once.

That is good news, because defending against automation is cheap. Five things stop most of it, and none of them require a security budget.

The five that matter

1. Two-factor on email first

Not on your website, on your email. Email is the master key: it resets every other password you own. If an attacker has your inbox they have your domain registrar, your hosting, your bank portal and your social accounts. Turn on two-factor there today, before anything else on this list.

2. A password manager, and no reuse

The common breach is not clever. Your password leaked from some unrelated site years ago, and a bot is now trying it everywhere. A manager makes unique passwords effortless, which is the only way they actually happen.

3. Update things

Most compromised websites in Nepal are running a plugin with a published vulnerability and a patch available for eighteen months. Automated scanners find them within hours. Keeping software current is unglamorous and does more than anything else on this list.

4. Fewest people with the most access

Not everyone needs an administrator account. The person who writes blog posts needs to write blog posts. When someone leaves, remove their access that week, not eventually. Count how many people can currently delete your database, and be uncomfortable with the number.

5. Backups you have tested

The control that works after everything else has failed. See what happens if the server dies tonight, and note the part about keeping one copy your production system cannot delete.

The attack that actually gets Nepali businesses

It is rarely technical. Someone emails your accounts person, apparently from a supplier, saying the bank details have changed. The invoice looks right, the amount looks right, and the money goes to the attacker.

No firewall stops that. What stops it is a rule everyone knows: bank detail changes are verified by phoning a number you already had, never a number in the email. Write the rule down, tell the people who pay invoices, and repeat it occasionally. It costs nothing and it is the single highest-value control a small business has.

What you can safely ignore for now

Penetration tests, security certifications and expensive monitoring tools are for businesses that have already done the five above. Buying a tool before you have two-factor on email is like fitting an alarm to a building with the front door open.

The exception is if you handle payments or health data, or a client contract imposes requirements. Then the obligations are not optional and the list is longer than this one.

Frequently asked questions

Does a small business in Nepal really get attacked?

Not targeted, usually. Scanned constantly, yes. The bots do not know or care where you are, which is why the baseline matters even when nothing about you looks worth stealing.

Is an SSL certificate enough?

No. HTTPS protects data in transit. It does nothing about weak passwords, unpatched software or someone being tricked into paying the wrong bank account.

What if we are already compromised?

Change passwords from a clean device, starting with email, revoke active sessions, and check for accounts and forwarding rules you did not create. Mail forwarding is the quiet one people miss. Then get help before deciding it is finished.

Do I need cyber insurance?

Possibly, once the basics are in place. It is not a substitute for them, and most policies ask whether you have the basics.

Who should be responsible for this?

Name a person. Security with no owner means nobody turned on two-factor and everybody assumed somebody had.