Cyber threats are a significant risk to businesses of all sizes in Australia. But you don’t need to be a large corporation to build a robust defence. By following a structured approach, you can significantly reduce your risk of a cyberattack and protect your business’s critical assets, reputation, and customer data.
This checklist is based on key principles from the Australian Cyber Security Centre (ACSC) and is designed to be a practical, actionable guide for any Australian business. For expert support in implementing these steps, Orro’s team of cybersecurity specialists provides a complete suite of services to ensure your business is resilient.
1. Implement Multi-Factor Authentication (MFA)
Why it matters: A staggering number of cyberattacks start with compromised passwords. MFA adds an essential second layer of security, making it exponentially harder for cybercriminals to access your accounts even if they have stolen a password. The Australian government considers it one of the most effective controls you can implement.
- Action: Enable MFA on all critical accounts, starting with email, banking, social media, and any cloud services (e.g., Microsoft 365, Google Workspace, cloud accounting software)
2. Patch Your Systems and Software
Why it matters: Software vulnerabilities are a primary entry point for cybercriminals. By regularly applying security patches, you close these loopholes before they can be exploited by malicious actors.
- Action: Set all operating systems (Windows, macOS), web browsers, and applications to update automatically. Create a schedule to manually check for and install updates for any software that doesn’t have an automatic update feature.
3. Back Up Your Data (And Test the Backups)
Why it matters: A robust backup strategy is your best defence against ransomware and data loss from a system failure. Without it, you could lose everything.
- Action: Regularly back up all your critical business data. Follow the “3-2-1 rule”:
- 3 copies of your data.
- 2 different media types (e.g., an internal drive and an external hard drive).
- 1 copy stored offsite (e.g., in a secure cloud service or at a separate physical location).
- Crucially: Periodically test your backups to ensure you can actually restore your data when needed.
4. Train Your Employees to Spot and Respond to Threats
Why it matters: Your employees are your first and best line of defence. An attack like a phishing email is only successful if someone clicks on it.
- Action: Conduct regular, mandatory cybersecurity awareness training for all staff. Focus on how to identify phishing scams, recognise suspicious links, and safely handle sensitive information. Encourage a culture where employees feel comfortable reporting anything that looks suspicious without fear of punishment. Orro provides security awareness training as part of our managed security services.
5. Restrict Administrative Privileges
Why it matters: Giving too many employees “admin” access to systems and networks significantly increases the risk of a breach. If a single account with high-level access is compromised, the damage can be catastrophic.
- Action: Grant administrative access only to those who absolutely require it for their job. Create separate standard user accounts for day-to-day activities, even for IT staff. Regularly review who has admin privileges.
6. Develop an Incident Response Plan
Why it matters: When an incident occurs, time is of the essence. A pre-defined plan ensures you can contain the damage, communicate effectively, and recover quickly.
- Action: Create a simple, clear plan that answers the following questions:
- Who is on the response team? (e.g., an IT person, a business owner, a legal contact).
- What are the immediate steps to contain the breach? (e.g., disconnect a compromised device from the network).
- How will you communicate with staff, customers, and the media?
- When do you need to report an incident to authorities like the ACSC and the Office of the Australian Information Commissioner (OAIC)?
- Orro’s Incident Response team is available 24/7 to help you develop a comprehensive plan and act as your first responders in a crisis.
7. Secure Your Network and Devices
Why it matters: Your network is the gateway to your business. Ensuring it is properly configured is fundamental to your security.
- Action: Install and maintain up-to-date antivirus and anti-malware software on all computers and devices. Change the default password on your Wi-Fi router. Create a separate guest network for visitors and personal devices. Use a firewall to control incoming and outgoing network traffic. Orro provides Managed Security services, including 24/7 monitoring from our Australian-based Security Operations Centres (SOCs), to take the stress out of securing your networks.
8. Know Your Legal Obligations Under the Privacy Act
Why it matters: Australian law, particularly the Notifiable Data Breaches (NDB) scheme, requires you to report data breaches that are likely to cause “serious harm.” Failure to comply can result in significant penalties and reputational damage.
- Action: Understand what constitutes an “eligible data breach.” Ensure your incident response plan includes a clear process for assessing and, if necessary, notifying the OAIC and affected individuals. Have a clear, up-to-date privacy policy on your website. As a trusted partner, Orro can provide expert guidance to help you navigate compliance and regulatory requirements.
9. Control the Use of USBs and External Devices
Why it matters: External devices can be a vector for malware. A simple USB stick found in a car park and plugged into an office computer can unleash a devastating attack.
- Action: Create a policy for staff on the use of external devices. If possible, configure network policies to prevent the use of unauthorised USB drives. Ensure all devices are scanned for viruses before any data is transferred.
10. Engage with the Australian Cyber Security Community
Why it matters: Staying informed is crucial in the ever-changing world of cyber threats. Government and industry bodies offer a wealth of free resources.
- Action: Join the ACSC Partnership Program. Subscribe to ACSC Alerts. Leverage free resources from cyber.gov.au and business.gov.au. For a more proactive approach, contact Orro for a Security Maturity Assessment to identify and control your security weaknesses before they can be exploited.
