The most common cyber threats to businesses, the principle of defence in depth, the 3-2-1 backup plan, and practical steps to keep customer data safe under Indonesia's Personal Data Protection Law.
"We're a small business — who would want to hack us?" We hear this often. In reality, many attacks are automated and random: phishing emails go out to thousands of addresses, and weak systems become victims — regardless of the size of the business.
| Threat | How it works | Main defence |
|---|---|---|
| Phishing | Fake emails/WhatsApp messages asking for a login or transfer | Staff training, MFA, two-way verification |
| Ransomware | Files are locked and a ransom is demanded | Separate backups, system updates, least-privilege access |
| Weak passwords | Guessed or leaked from other sites | Password manager, MFA |
| Data leaks | Open databases or carelessly shared files | Encryption, access restrictions, audits |
| Invoice fraud | A vendor's bank account number is "changed" | Confirm account changes by calling an official number |
Good security is like a house with a fence, locked doors, a safe, and CCTV — if one layer is breached, the next still protects you. In IT, the layers are: perimeter (firewall), network (VLANs, separate guest Wi-Fi), endpoint (antivirus, updates, MFA), application (role-based access), and data (encryption & backup).
A simple rule: keep 3 copies of your data, on 2 different media, with 1 copy off-site (for example in the cloud) where ransomware can't change it. What is often forgotten: test restores regularly — a backup that has never been tested is as good as no backup.
Write this plan on one page: who to contact, which devices to disconnect from the network, and how to recover. In a panic, a simple document is far more useful than memory.
Law No. 27 of 2022 on Personal Data Protection requires data controllers to keep personal data secure and to act on data protection failures. For hotels, clinics, schools, or online shops, this means guest and customer data must be collected only as needed, stored securely, and accessed only by authorized people.
The zero trust approach — "never trust, always verify" — is becoming the new standard, including for remote work. Meanwhile, attackers use AI to create more convincing phishing, so staff awareness training remains an irreplaceable defence.
Disconnect the affected devices from the network (cable and Wi-Fi) without forcibly shutting them down, contact the person responsible for IT, and don't pay the ransom straight away. Assess the scope of the attack, then restore from a separate, tested backup.
No. Antivirus is just one endpoint layer. Without system updates, MFA, least-privilege access, network separation, and backups, a single phishing email can open the door to attackers. Defence in depth is far more resilient.
Ideally a short session during onboarding for new employees, then regular reminders — for example every three months — with recent phishing examples. Internal phishing simulations help measure awareness and show who needs extra support.
The PDP Law requires data controllers to keep personal data secure and to act on data protection failures. That means security measures such as access restrictions, encryption, and backups aren't just good practice — they are part of meeting a legal obligation.
PT Bali Eka Mediatama helps with networks, cloud, security, software, data, ERP & CRM, and online, offline, airport, and broadcast advertising campaigns.
