Want to improve cybersecurity?
Buying better security software may be part of the answer. But it is not the whole answer.
Cybersecurity is about protecting the technology and information your business depends on. That involves people, processes and technology.
Start with a simple question. What would cause the biggest problem if you suddenly could not access it?
Perhaps it is customer information. Your email. Financial records. A critical business system.
Understanding what matters helps you determine what deserves the most protection.
Your employees’ accounts can provide access to large amounts of business information.
That is why multi-factor authentication is important.
It means logging in requires another form of verification in addition to a password.
The Australian Government recommends multi-factor authentication as one of its fundamental measures for small businesses.
Updates might seem mundane. But they frequently fix known security weaknesses.
The Australian Government similarly identifies software updates as one of the basic measures businesses should take.
Ask yourself: If we lost our important information tomorrow, what would happen?
Then ask: Could we actually restore it?
Regular backups are another core recommendation in Australian Government small-business cybersecurity guidance.
Employees do not need to become security experts. They do need to know what to do when something looks suspicious.
Give people clear instructions and training about suspicious emails, passwords, sensitive information and reporting potential incidents.
Good security reduces risk. It does not eliminate it.
Your business therefore needs to know what happens when an incident occurs.
No. Antivirus is one control, but businesses also need protected accounts, software updates, backups, appropriate access, employee awareness and a plan for responding to incidents.
Multi-factor authentication requires an additional check when somebody signs in, such as approval through an authenticator application. This makes a stolen password less useful to an attacker.
The schedule should reflect how much information the business can afford to lose. Important systems may need backups several times a day, while less frequently changing information may require a different schedule. Backups should also be tested.
Updates often fix known security weaknesses as well as performance issues. Delaying critical updates can leave computers and applications exposed to methods attackers already understand
They should report it immediately through the organisation’s agreed process, even if they are uncertain. Fast reporting gives the response team more time to investigate, contain the issue and protect other accounts or systems. Businesses can also report cybercrime to ASD’s Australian Cyber Security Centre on 1300 CYBER1 (1300 292 371).
