Cyber Safety for Australian Business

What cyber safety actually means for a business

Cyber safety is the everyday practice of protecting the accounts, devices and data your business runs on: strong unique passwords, two-factor authentication, staff who can spot a fake message, software kept up to date, and care about the networks you connect to. It is not a product you buy once. It is a short list of habits applied consistently by everyone on the team.

Cybercrime is not confined to covert operations between countries. Cybercriminals are getting bolder and regular people are feeling the effects: 6.09 million Australians fell victim to cybercrime in a single year (the figure we reported in 2018). Between 1 July 2019 and 30 June 2020, the Australian Cyber Security Centre responded to 2,266 cyber security incidents, and the Australian Government’s Cyber Security Strategy put it plainly: “malicious cyber activity is one of the most significant threats impacting Australians.”

Why the risk grows as you digitise

As businesses digitise their systems and operations, any increase in digital capability and connection is also an increase in the risk of cyber and spam attacks. Employees working outside the office may reach sensitive business data through home Wi-Fi networks that lack the security controls (firewalls among them) used in offices. More connectivity from more locations means a greater focus on data privacy, and hunting for intrusions across more entry points.

In the rush and panic to set remote working practices up, even simple data protection practices were ignored.

The attacks themselves are mundane and effective. Employees have been sent WhatsApp messages from people asking for money transfers while pretending to be their managers, and hackers trick people into downloading viruses and then demand a ransom. BBC News reported one IT boss saying: “We see tens of different hacking attacks every single week. It is never ending.” Businesses understand cyber risk better than they did a few years ago, but most employees have still not received any training on cyber threats, or on how to protect themselves against a security breach.

It’s perhaps the most important time to pay attention to your online history, specially as everyone is using all sorts of digital tools to stay connected.

1. Passwords are your first line of defence

Passwords must be taken seriously and updated regularly. Make sure nobody picks something that can be guessed easily: no pet names, no favourite football teams. Remembering a different password for every account is hard, which is why we are big fans of 1Password, which manages passwords across a number of accounts.

A password manager makes it easy to never re-use a password, so if a site gets hacked and that password is stolen, it cannot be used to get into any of your other accounts. It also makes strong, random, 15-plus character passwords practical, because nobody has to remember them. Installing one and working through your accounts to replace old passwords with strong, unique ones is probably the single biggest thing you can do to reduce your risk of falling victim to hackers.

Password habits worth writing down

• Update passwords regularly.
• Read the previous point again.
• Use a password management tool if you can.
• Do not text, email or send passwords to anyone.
• Do not store passwords or logins anywhere that can be easily accessed.
• Double confirm before transferring money, even if that means ringing the person and going through the account details.

To find out whether your information has already been exposed, subscribe to haveibeenpwned.com.

2. Turn on two-factor authentication

Our CTO and Chief Information Security Officer, Iain Chalmers, recommends enabling 2FA (two-factor authentication) wherever it is offered. There are a few common forms with differing levels of security, but all of them are more secure than not using them at all.

Not all 2FA is equal

SMS codes are perhaps the least secure common option: an attacker can call your phone company and try to convince them to allow access to your account, or to set up a new SIM. This happens far more often than you would expect and is much easier than most people think, so be careful.

Apps and hardware keys

A selection of phone apps generate authentication numbers that change every 30 seconds (known as TOTP, or Time-based One Time Passwords). Google Authenticator, Authy and 1Password all do this. At the highest level are hardware 2FA keys such as YubiKey or Google’s Titan Security Key, which generally plug into a USB port or connect over Bluetooth and let you tap a button to authenticate.

Keep in mind that as you make it harder for an attacker to break in, you also make it harder to log in yourself. Keep two YubiKeys in a safe place and put your 2FA app on at least two devices, so a broken, lost or stolen phone does not lock you out.

3. Know the difference between fishing and phishing

Fishing is the fun thing kids do with their dads. Phishing refers to fake messages that try to trick you into giving out personal details. Anyone can fall for one, and spam emails are becoming harder to identify. Just because an email looks genuine, or seems to come from someone you know, does not guarantee it is legitimate.

Spam comes in all shapes and forms. It is not just the long-lost uncle offering you a fortune. Employees should be wary of anyone asking for details such as date of birth or bank account numbers. If someone receives a suspicious message, they should not click any links or open any attachments, and should report it right away.

4. Update everything

Yes, it can be a drag, but making sure everyone keeps their software up to date really is one of the easiest ways to protect a business online. Updates add new features, install bug fixes and close security holes that could otherwise let cybercriminals in.

Tell employees not to install third-party software unless they are absolutely sure it is safe. Some programs will quietly install applications that can hack into a laptop camera. There are also sensible measures for backing up work and restoring files, whether to the business’s main system or the cloud; the Australian Cyber Security Centre publishes step-by-step guidelines on its website that are worth a look.

5. Be wary of the Wi-Fi networks you use

Plenty of people take their laptop to a cafe. Unless they are tethering to their phone for data, they are opening themselves up to the dangers of public Wi-Fi, where without the right protection cybercriminals could see confidential information. Be especially careful with online banking, online shopping or anything involving sensitive information, and limit the activities that require employees to send or receive confidential data over networks you do not control.

What your devices already know about you

Mobile devices sense and share a great deal: location, motion, camera and microphone. Used with consent, that is useful. Know which sensors your own apps use, why, and what you tell people.

Make it policy, not just advice

The most useful step is to update your company cyber-security policy and train your people against it, because a breach does not only cause damage. Employers also carry obligations around data security and privacy. Teach staff what phishing looks like, make reporting suspicious activity routine, and check that password and 2FA practices are being followed.

At Mobiddiction we take a number of measures to keep our own systems and team protected. M4, our multi-tenant platform, supports multi-factor authentication and role-based permissions, and it is developed and operated under Mobiddiction’s Information Security Management System, certified to ISO/IEC 27001:2022 by an independent, accredited auditor. We build and run Government and Enterprise programs on it. Tell us what your program needs and we’ll show you what M4 already covers, what we’d extend and what we’d build for you. See how we handle security.