Current Topics

If the recent Optus and Medibank attacks have left you worried about the health of your business’ cyber security, you are not alone. Small businesses are one of the primary targets for cyber-attacks, with criminals preying on the underprepared small business owner.

Some of the most common cyber-attacks on small business are:

Phishing – spam emails which ask for sensitive information. These can sometimes look like they have come internally, but review of the sender’s email can identify the fraud.

Hacking – accessing a system or network. Resulting in loss of information, being held to ransom, or emails being sent internally and looking legitimate which request sensitive information.

• Ransomware – this is a program downloaded onto your system or network which blocks your access. The attacker then requests payment of a ransom to ‘unlock it’ for you.
• Intercepting emails – Cyber criminals intercept an email between sender and receiver, they can then adjust payment details on an invoice to their own bank account.

So, what can you do about reducing your business’ risk of cyber threats? Firstly, the Australian Government has a comprehensive small business cyber security guide which is available at Australian Cyber Security Centre – Small Business Cyber Security Guide

Some other simple steps you can take are:

• Keep your software updated. For all your trusted software and firmware, turn on automatic updates. Your providers are aware of how their systems are being used by cyberhackers and constantly revising their security through their updates.

Make sure you are keeping external back ups of your data and systems. Make sure these backups are on an external device which can be removed from the network. USBs kept in a laptop can still be hacked by attackers.

Turn on multi-factor authentication. If the website or program you are accessing has the option, always use it. This will be the first alert to you if you are under cyber-attack.

• Confirm email requests for sensitive information from colleagues with a phone call or in-person. Especially emails asking for full lists of client data, bank account access details, or other sensitive information.

Always call to confirm change of bank account details with suppliers or employees. If you have received an email advising of change of bank account details, ring sender to confirm. Make sure you add this to your internal procedures for any update to banking details.

Although you can never reduce the risk of cyber-attack in your business to nil, taking simple steps and talking to your staff about the types of attacks and preventative measures can help reduce the threat and prevent some of the most common incidents from occurring.

November, 2022