When things go sideways, a bit of cybersecurity training and the right kind of service can make the difference between a flustered reaction and one that is calm and methodical for an Australian SME. There is nothing complicated about it: we are here to see that your staff can put customers first and defend the business from an outage, a wayward phishing email or a password that has been compromised.
I am Isla North. In all the years I have spent guiding people through uncharted territory I have found that when it gets rough, preparation is what counts. Cybersecurity is no different. A good plan and some habits you have put in practice will do more for a small business than a nice looking binder left to collect dust by the dunny.
Build Practical Cyber Resilience
For an Australian small or medium enterprise the cyber threats are as wide ranging as they are for the big organisations, only you may not have the headcount or a security team to speak of. Under those circumstances practicality is worth more than jargon, which is why practical digital capability workshops can help.
Proper support means having technical controls, incident response, business continuity and risk management at hand so an owner or employee can act without hesitating like a motorist who has just put in a call to find the nearest pump is 300km off.
What Resilience Really Means
It is the capacity to put down a cyber incident and recover from it, not just detect some malware. You need secure access, data protection, to test your recovery and be able to make the hard calls as an executive.
A business with resilience has a handle on its most important digital assets and knows how to keep working and tell its customers if systems are down. We are not going to tell you there will never be an incident, any more than you would expect to get through summer without a mozzie or two.
Why SMEs Need Stronger Defences
Then there is human error. An employee in a hurry might authorise a payment he should not have or follow a link in an invoice that looks legitimate. The attacker does not require a computer room fit for Hollywood to get in.
And small businesses have a lot to lose: intellectual property, supplier credentials, payment records and customer information. By the time you have made sense of a disruption your reputation and cash flow could already be suffering.
What Catches Teams Out
In my experience teams go about the technical side wrong in one of two fashions: purchase a product and think they are done, or put together a policy of such size as to be unreadable. Neither will address poor recovery set ups or weak passwords.
You also find that much of the risk is not in the office. Cloud accounting, point-of-sale, remote staff, website hosts and payroll are all part of the equation. Your risk register ought to be as concerned with them as the laptops under the desk.
Cover The Right Training Areas
We prefer our training for small business to be brief and to the point. Staff should be shown what a threat is in the tools of their trade, not asked to commit a textbook description of a denial-of-service to memory.
There is the matter of being in step with the way business is done in Australia, from mobile devices and cloud to the demands of the Privacy Act and Notifiable Data Breaches scheme.
Core Topics For Staff
You will find a sensible programme deals with multi-factor authentication, safe document sharing, software updates, phone scams and how to report an incident. It is important staff do not feel shame in putting in a quick report; it is the only way to ring the bank or cordon off a device before it gets costly.
Training For Leaders
Leaders have to operate on another level. They are the ones who cannot wait for a technical inquiry to decide on matters of law, contract or cyber insurance.
It is well and good to have employee awareness training but if the manager is seen to approve an urgent payment from an unknown source the team will take note. Culture is a reflection of behaviour. We run workshops where people can put into practice how they would deal with a suspected breach or a system that is not responding.
Make Awareness A Daily Habit
Do not expect an annual presentation to alter anyone’s ways. You will find effective employee awareness in the day to day, be it onboarding, a quarterly refresher or some brief reminder of a scam making the rounds. Simulated exercises are part of the routine as well.
For their security review, an Australian business can make use of the public guidance put out by the ACSC (the Australian Cyber Security Centre). The best approach is to take what the ACSC has to offer by way of official cyber security guidance and tailor it to the risk appetite of the staff and systems in question.
Realistic Practice
There is nothing like training that is reminiscent of the work at hand for making an impression. A wholesale operation may run through a spurious change to a supplier’s bank details; a professional firm might deal with a mailbox that has been compromised. An operator in the regions could be made to prepare for an outage come the wet season, when one can expect less certainty with access and connectivity.
One should not make a theatre of it, however. Exercises are there to be of support so as to uncover any gaps in contact details or access, or processes that are open to confusion, ahead of a criminal.
Reducing Downtime And Risk
The objective of cyber resilience services is to bring together technology, process and people. Support for a business might entail anything from patch management and vulnerability reviews to security testing, endpoint protection and recovery exercises. Where a full internal team is not warranted, managed cyber services afford ongoing oversight. A managed security service provider will have a SOC to monitor alerts and see to the investigation and escalation of anything of concern.
Aligning Controls With Risk
An SME does not require a one size fits all technology stack. The risk profile of a ten-strong consultancy running cloud systems is not the same as a manufacturer with its contractors, warehouses and operational technology.
| Business Need | Useful Service | Practical Outcome |
|---|---|---|
| Inconsistent security decisions from staff | Cybersecurity training, simulations | Fewer mistakes to be made, quicker reporting |
| Lack of in-house monitoring | MSP or managed cyber services | Alerts are reviewed and escalated on a regular basis |
| Incident responsibilities are not defined | Tabletop testing and incident response planning | Decisions and recovery steps are unambiguous |
| Data belonging to a customer or employee is left exposed | Guidance on privacy and breach response | Notification and handling is done with consistency |
| Leadership requires an outside opinion | Virtual CISO | Direction at a senior level sans the full-time hire |
A risk register scored on a five-point scale for likelihood and impact (25 being the most) is a simple way for a leadership team to put priorities in perspective without the meeting degenerating into alphabet soup. It is no replacement for having an expert look at things, but it is useful.
Safeguard Continuity
Do not just buy a backup, test it. Your procedures ought to specify who gives the go-ahead for normal operations to resume, how long critical work can be done by hand and what is to be put back first. Put in place alternate means of communication, offline records and a process for your customers as part of continuity planning. Should the system go down and that is where the only copy of the plan is kept, the plan is not faring much better.
Outsourcing
It is sensible for an SME to outsource cybersecurity if the in-house staff do not have the hours, the expertise or the 24/7 coverage to contain risk. Growth, a migration to the cloud or the need to put forward stronger security evidence to customers are other reasons to do so. That is not to say you are abdicating responsibility; the provider will respond and advise, but the information and the decisions remain yours.
When To Call In Help
If leaders are hard put to explain the aftermath of a suspected breach, or if software updates are perpetually put off, former employees still have access and backups are untested, then external support is called for. There is no one reviewing the alerts.
An MSP is apt for the management of technology on a daily basis, a SOC for continuous escalation and monitoring. For policy development and board reporting without the expense of a CISO, virtual CISO services are an option for an SME.
Selecting A Partner In Australia
What you want is a partner who can put risk in plain English and relate its recommendations to your operations. See for yourself that it has experience with small and medium enterprises and a response model for after hours. Do not sign on the dotted line without asking the hard questions. If the provider gets evasive over data location, exit arrangements or who owns an incident, take note of the red flag.
Make Sure To Compare Capabilities
- Is the process for incident response and escalation something they can lay out?
- Are technical services matched with training for the staff?
- Will you get an oversized list or have priority actions pointed out?
- Does the documentation cover suppliers, access, recovery and backups?
- Can they put forward the necessary references, qualifications or certification?
- And are the terms of the contract, the pricing and how data is handled transparent?
Request an AUD quote in writing and have the provider put a line between one-off work and any recurring fees. You will find costs are a function of staff headcount, the systems and locations involved, compliance and response demands as well as monitoring hours. A proposal of merit will make it plain what is part of the package, what is at your option and what will incur extra charges.
Australian Compliance Duties
The onus for cybersecurity compliance in Australia is dictated by the industry, the contracts in place and the information a business has to hold. Where personal data is being stored or collected the Privacy Act and the Notifiable Data Breaches scheme will be of relevance.
But do not confuse security with compliance. An active administrator account that has been overlooked can coexist with a policy designed to pass an audit. Proper governance is about having documented controls and the evidence to back up that they are working in the real world.
Frameworks You Can Put To Use
For a sensible set of baseline controls the ACSC offers sound guidance. Organisations required to put forward a formal information security management system, or to prove to partners and customers that their governance is in order, may find ISO 27001 applicable.
There are introductory, technical and leadership courses to be had from Australian providers of cybersecurity training; which is right will be determined by the role of the learner. A system administrator is likely to want more out of his time than an awareness video of ten minutes duration, and there is no call for a manager to turn into a penetration tester.
Getting Plans Off The Ground
A staged implementation is the way to go. Put the programme to the test, get some visibility and deal with the risks that matter most before making improvements based on the evidence. It is an approach that busy businesses in Australia can appreciate as it makes headway without the pretence of sorting every issue on a Friday afternoon.
- Make a list of your key suppliers, digital assets, information types and critical systems.
- Do a review of multi-factor authentication, patching, backups and who has administrator access.
- Put leaders and staff through their paces with examples drawn from the business.
- Have an incident response plan in writing, complete with authority levels and the necessary contacts.
- When you test recovery, note down any failures and put an owner to the task of fixing them.
- Risks should be seen to on a regular basis, particularly if there has been a change of supplier, new software or staff.
In Case Of A Bad Day
Should one day be all you have to put things in better order, then reporting, patching, backups and account protection are where the priority lies. See that employees are aware of how to flag a suspicious message and that your backups are restorable. Multi-factor authentication ought to be in place for important accounts.
It is also wise for teams to have emergency contacts to hand when the usual systems are down: your IT and managed security service providers, insurer, bank, legal adviser and those within the organisation who make the decisions.
Keep To A Rhythm
High-risk accounts and patches warrant a regular look in. Put on a tabletop exercise for an incident if there is a major change to your staff or systems and run some brief awareness refreshers over the course of the year.
Then there is seasonality. For a retailer the trading calendar is demanding; in northern Australia one has to factor in cyclone alerts and wet season disruption from November through April. Your cyber planning should be part of the operating calendar, not something apart from it.
Frequently Asked Questions
When SMEs in Australia are weighing up managed services, compliance and training these are questions one encounters. The following are straightforward answers to get you started but they do not take the place of counsel tailored to your obligations and systems.
What Are The Best Cybersecurity Certifications In Australia?
That is a matter of career objective and role. Foundational study is of benefit to the novice, a practitioner in the technical side might require one in cloud security, penetration testing, governance or operations. Any employer would do well to look at the certificate and the person’s communication skills and experience too.
Is 40 Too Old For Cyber Security?
Not at all. The field puts a premium on judgement, problem-solving and an understanding of business. One can come to it at 40 with a background in law, finance, teaching or customer service that is of value. Build a case with projects or supervised work and follow a practical learning path.
What Are Cyber Resilience Services?
They are there to see a business through a cyber incident, from prevention and detection to response and recovery. The service can encompass risk assessment, virtual CISO, backup reviews, business continuity, security testing and so on.
Where Can I Find Hands-On Cybersecurity Training?
Seek out an Australian provider with workshops and exercises suited to the role. You want to know if the training involves decision-making and investigation or is just a presentation. The ACSC is a good place to begin for official resources and public education.
Does Every SME Need A Managed Security Provider?
Some can handle core controls in house with the odd specialist. But if an organisation has no monitoring capability or is bound by contract to certain security standards an MSP or SOC is called for. It comes down to the complexity and risk and what the cost of downtime would be.
On To The Next Step
Any worthwhile SME solution will be predicated on a frank appraisal of the people, the priorities and the systems. Concentrate on the processes and information that would do the most harm were they to fail and put your technical support and training there.
With the right mix of controls and recovery steps that have been put to the test, an Australian SME can lower its exposure to threats and carry on when the going gets rough. That is what you expect from a cybersecurity service in this country: for your teams to be left in a calmer, more capable state.
