Cyber security

Have you ever thought about how much of your business information is stored on a smart phone, computer or online? Or what would happen if you lost access to that information or it became compromised?

When you consider the volume of vital business information that gets stored electronically, the need for good cybersecurity practices is a necessity for all small business owners.

Here are some practical steps to take to help protect your business.

Use strong passwords

The longer and more complex your passwords are the better. A good start is to have a mix of upper and lower case letters, numbers and symbols. If you find these hard to remember, try a passphrase – a combination of three of four random words that, when combined, provide a longer and harder to guess password (for example: PurpleDoorBananaFloor).

When it comes to your computers, networks (such as your Wi-Fi) and mobile devices, ensure that you have strong passwords that are regularly changed. In particular, if any devices come with default passwords (for example: your modem may have a default password to connect to Wi-Fi) you should change this password as soon as possible.

If you employ staff, you may also want to consider providing access to systems and passwords on a ‘need to know’ basis.

Enable two-factor authentication

Two-factor authentication provides an extra layer of security to your online accounts (such as your email, social media or internet banking) and makes it harder for someone to gain access, as they will need more than your user name and password.

It usually requires you to take an extra step to access online accounts, such as entering a personal identification number (PIN), responding to a notification on your smartphone or using fingerprint or facial recognition.

Most online platforms will allow you to enable two-factor authentication under their security and login settings.

Secure your devices and networks

There are a few practical things you can to do keep your devices and network secure, such as:

Having up-to-date security software installed and running regular anti-virus scans.

Avoiding the use of storage devices, like USBs or hard drives, that have come from unfamiliar sources (unless you can run an anti-virus scan on them first).

Ensuring all portable devices, such as smart phones and tablets, can only be unlocked by PIN.

Limiting the use of public Wi-Fi networks which may be unsecure or vulnerable. In particular, you should never use public Wi-Fi to make online payments and/or access financial records.

Regularly back-up your data

Having one back-up is a good start, but ideally, you should also have a back-up of your back-up too. Don’t worry, this isn’t as hard as it seems. Online and cloud storage are a popular back-up option, but unfortunately can also be compromised. Ideally, you should not only keep an online back-up of your data, but also have a physical storage device, like an external hard drive, that you regularly back-up your files to.

Read the Australian Cyber Security Centre's Small Business Cloud Security Guides to find out  more.

Educate your employees

If you employ staff, take the time to talk to them about the importance of cybersecurity and protecting any information relating to your business that they may store on computers or mobile devices. Explaining what you deem to be an acceptable use of business information and devices will ensure they have a clear understanding of your expectations.

You can also consider creating a cybersecurity policy for your workplace that sets our your expectations of staff and how you will handle sensitive data.

Be aware of the latest threats

Major cybersecurity threats are regularly reported in the media, so keeping up-to-date with the news can give you a heads up on the latest threats and attacks so you can stay one step ahead.

The Australian Cyber Security Centre (ACSC) also offers a free email alert service that can provide you with information on the latest online threats and what you can do to keep them at bay.

Assess how secure your business is

To help you find out how cyber secure your business is, use the free cyber security assessment tool on the Business.gov.au website.

By answering a series of question, you can use the assessment tool to determine how secure your business is and receive a list of recommendations and practical steps to follow to make improvements.

How to check if you have been hacked

If you believe you may have been the victim of a cyber crime, use the free Have you been hacked? tool from the Australian Cyber Security Centre. The tool walks potential victims through a series of scenarios to determine if they have been hacked and provides practical steps to follow to manage the situation.

*Source: ACSC Annual Cyber Threat Report, July 2021 to June 2022.