Ask a mentor – cybersecurity for business

The Australian Cyber Security Centre (ACSC) website is a good starting point for gaining information, guidance and templates.

Be very careful of generic advice, systems and templates. It is critical they are customised to reflect your business and its context. Consider formally engaging a reputable and experienced digital/cybersecurity business to work with you in this area.

Cyber threats are constantly evolving, with attackers finding new ways to exploit vulnerabilities. Businesses must stay informed about the latest trends and techniques to effectively counter these threats.

Rotating offsite backups, ongoing education of staff and hiding the firm's IP Wi-Fi address from the world has always saved the day for my clients.

Keep looking for the weakest link in your security and improve it.

Without good cyber-security, a business leaves themselves open to hacking that can not only cost a lot of money, but it can also cause needless stress in the workplace. There may also be legal implications.

• No sharing of passwords.
• No generic passwords (e.g. Cartherine1234, Maddy1234).
• If in doubt about a link sent via email or text message don't click, ask and discuss with your team first.

• Business Tech Toolkit – Telstra
• Small Business Cyber Security Guide – Australian Cyber Security Centre
• Cyber security – business.gov.au

Understanding cybersecurity is crucial for businesses due to the increasingly digital landscape and the potential risks posed by cyber threats. Here is why:

Protection of sensitive data
Businesses handle a vast amount of sensitive data, including customer information, financial records and intellectual property. Failure to secure this data can lead to data breaches, financial loss and reputation damage.

Legal and regulatory compliance
Many industries are subject to strict data protection regulations such as General Data Protection Regulation (GDPR) and Payment Card Industry Data Security Standard (PCI DSS). Failing to comply with these regulations can result in significant fines and legal consequences.

Reputation management
A data breach can severely damage a company's reputation and erode customer trust. Rebuilding trust after a breach can be difficult and expensive.

Financial impact
Cyberattacks can lead to financial losses through theft of funds, business disruption and recovery costs. Additionally, insurance premiums may increase after a cyber incident.

Business continuity
Cyberattacks can disrupt business operations, leading to downtime, loss of productivity and potential revenue loss. Having robust cybersecurity measures in place ensures business continuity.

Supply chain security
Many businesses are interconnected through supply chains. Weaknesses in one company's cybersecurity can expose the entire supply chain to risks.

Intellectual property protection
Companies invest heavily in research and development. Cyberattacks can lead to theft of intellectual property, harming a business's competitive edge.

Employee awareness
Employees are often the first line of defence against cyber threats. Proper training and awareness programs can help employees identify and prevent potential security risks.

Innovation and growth
As businesses rely more on digital technologies, understanding cybersecurity becomes essential for innovation and growth. Protecting new technologies and digital initiatives is crucial for sustained success.

Global connectivity
The interconnected nature of the modern business world means that cyber threats can come from anywhere. Understanding cybersecurity helps businesses anticipate and mitigate these threats.

• Essential eight – Australian Cyber Security Centre
• Small business cyber security – Australian Cyber Security Centre
• Scamwatch – Australian Government
• Office of the Australian Information Commissioner (OAIC)
• Payment Card Industry (PCI) – Data Security Standard
• Defence Industry Security Program – Department of Defence
• ISO standards – ISO/IEC 27001 Information security management systems
• ISO standards – ISO 31000 Risk management

Cyber threats are a real and growing risk for businesses of all sizes. Investing in robust cybersecurity measures is not just a matter of protection; it's a fundamental aspect of responsible business management that safeguards data, operations, reputation and customer trust. Increasingly there will be an emphasis on the government for business owners and directors to demonstrate their fiduciary responsibilities.

It's not a matter of if, but when. So you need to know how to deal with a cyber security incident.

A cyber-attack on your business can shut your business down for days or weeks, and in some cases result in closure. Not only can it seriously impact on your business, but it can also have negative impacts on your customers and suppliers.

The Australian Cyber Security Centre (ACSC) reports that the incidence and costs of cyber-attacks on Australian small-to-medium enterprises (SMEs) is on the rise.

A cybercrime was reported every 7 minutes on average in 2021–22.

The average cost of responding to a business email compromise incident was $64,000. The incidence of ransomware is also on the rise (although most SMEs are not required to report such incidents). Ransomware attacks rose by 75% over 2019–20.

150,000 to 200,000 small office/home office routers in Australian homes and small businesses are vulnerable to compromise.

Email phishing, invoice fraud, online banking and online shopping are key vulnerabilities for SMEs.

Ultimately the responsibility stops with the business owner(s) to ensure they are cyber resilient. They need to have a good understanding of their business's current cyber posture (or position) to address any vulnerabilities. Doing a basic cyber assessment (such as on the ACSC website) will be a starting point on the journey.

Apart from implementing strong security measures, do not overlook the importance of engaging and training your employees (and possibly contractors in your supply chain). Depending on your position, it may also be prudent to talk to your insurers about cyber insurance (beware premiums are on the rise).