Cybersecurity fundamentals

Why it matters

The ACSC receives tens of thousands of cybercrime reports each year, and a large share come from small and medium businesses. The direct losses from redirected invoices, ransomware and stolen funds are painful, but the second-order costs often hurt more: days of downtime, a breach notification to customers under the Privacy Act, lost contracts with larger clients who audit their suppliers, and the owner’s time consumed for weeks. A few hours of setup prevents most of it.

How the common attacks actually work

Most incidents start with an email. Phishing messages impersonate a bank, a supplier, the ATO or a colleague and ask you to click a link, open an attachment or log in to a fake page. Once an attacker has one staff password, they read the mailbox quietly, learn who pays whom, and then send a convincing "our bank details have changed" message to your customers or your accounts team. This is business email compromise, and it is the single most expensive category of loss for Australian SMBs.

Ransomware takes a different path. Malware delivered by an attachment, a compromised website or an exposed remote-access service encrypts your files and demands payment. Modern variants also steal the data first and threaten to publish it. Credential stuffing attacks simply try passwords leaked from other sites against your accounts, which is why reusing a password anywhere is dangerous.

The controls that matter most

Multi-factor authentication (MFA) is the single most effective control available. It means a stolen password alone is not enough to log in. Turn it on for email first, then banking, accounting software, your website admin, cloud storage and anything with customer data. Use an authenticator app rather than SMS where you can.

Keep everything updated. Attackers exploit known flaws in software that has a fix available, so turning on automatic updates for operating systems, browsers, phones and business applications removes a huge share of the attack surface. Use a password manager so every account has a long, unique password nobody has to remember. Limit administrator rights to the people who truly need them, and remove access the day someone leaves.

Finally, back up. A tested backup that an attacker cannot reach is what turns ransomware from a crisis into an inconvenience. Keep at least one copy offline or in a separate cloud account with its own credentials, and restore a file from it every month to prove it works.

People are the control, not the problem

Security awareness training is often sold as a way to stop staff clicking things. A better framing is that staff are your detection system. Someone who knows what a phishing email looks like, feels safe reporting that they clicked one, and knows the payment verification rule is more valuable than any filter.

Keep training short and regular. A fifteen-minute conversation every quarter about the latest scams doing the rounds, plus a clear "if in doubt, forward it to this address" instruction, does more than an annual compliance video. Reward reporting, never punish an honest mistake, and make the owner follow the same rules as everyone else.

• A written rule for verifying bank detail changes by phone.
• A simple way to report suspicious emails and a promise that nobody gets in trouble for asking.
• Phishing examples shared when they arrive, so people see real ones.
• MFA and password manager setup done with new starters on day one.

Know what you will do when it happens

Even well-protected businesses have incidents. Write a one-page plan that says who is in charge, who to call (your IT provider, your bank, your insurer, your lawyer), how to isolate an affected device, and when you must notify. In Australia, a data breach likely to cause serious harm must be reported to the Office of the Australian Information Commissioner (OAIC) and affected individuals under the Notifiable Data Breaches scheme if the Privacy Act applies to you, and cybercrime should be reported to the ACSC through ReportCyber.

If you do not have an IT provider, consider one. Managed monitoring, patching and backup from a provider such as SMBH Consulting’s AIOps and operations team costs far less than a single incident, and it gives you someone to call at two in the morning.

How to set a security baseline in a week

1. Turn on MFA everywhere Email and banking today, then accounting, cloud storage, website and social accounts.
2. Enable automatic updates Computers, phones, browsers and business software. Replace anything that can no longer be updated.
3. Roll out a password manager Every account gets a unique password. Share credentials through the manager, never by email or chat.
4. Set up and test backups Daily, with one copy separate from your live systems. Restore a file to prove it works.
5. Review who has access Remove old staff and unused accounts. Limit admin rights to two trusted people.
6. Write the payment verification rule Bank detail changes are confirmed by phone on a known number, no exceptions.
7. Brief the team Fifteen minutes on phishing, reporting and the new rules. Repeat quarterly.
8. Write the one-page incident plan Who is in charge, who to call, how to isolate, when and whom to notify.

Real-world example

A Parramatta accounting practice nearly pays a fake invoice

Harbourside Advisory has six staff and manages lodgements for around two hundred clients. A junior accountant enters her password on a convincing fake login page. Over the next fortnight the attacker reads her mailbox, then sends the practice manager an invoice from their regular IT supplier with a new BSB and account number and a note about "changing banks".

The practice manager had been through a fifteen-minute briefing the month before and follows the new rule: she phones the supplier on the number from last year’s invoice. The supplier has not changed banks. The practice resets every password, turns on MFA for all accounts (which had been "on the list" for a year), finds and deletes the forwarding rule in the junior’s mailbox, and reports the attempt to ReportCyber. Because no client data was accessed, there is no notifiable breach, but the owner engages an IT provider for monitoring and backups the same week.

Common mistakes

• Treating MFA as optional for the boss Owners’ accounts are the most valuable targets because they can approve payments. Lead by example.
• Backups on the same network A backup drive permanently connected to the server gets encrypted along with everything else. Keep a copy offline or in a separate cloud account.
• Shared logins One "admin" password everyone knows cannot be audited or revoked when someone leaves.
• Paying the ransom as a first response Payment does not guarantee recovery, may be unlawful depending on who you pay, and funds the next attack. Call your IT provider, insurer and the ACSC first.
• Blaming the person who clicked It drives reporting underground. The next person who clicks will hide it, and the attacker will have weeks instead of hours.

KPIs to track

• MFA coverage Share of business accounts with MFA enabled. Target: 100% of email, finance and admin accounts.
• Patch currency Share of devices fully updated. Anything more than a month behind is a red flag.
• Last successful restore test Date you last restored a file from backup. Should be within the last month.
• Phishing reports per quarter Rising reports usually mean awareness is working, not that attacks have increased.
• Time to remove departed staff access Should be same day. Measure it; it slips when nobody owns it.

Frequently asked questions

What is the Essential Eight?

A set of eight baseline mitigation strategies published by the ACSC covering application control, patching, MFA, admin privileges, hardening, backups and more. It is written for larger organisations, but the small business checklist above covers the same ground in plainer terms.

Do I need cyber insurance?

It can cover response costs, business interruption and some liabilities, and insurers increasingly require MFA and backups before they will quote. Talk to a broker about what is covered, what is excluded, and what controls the policy assumes you have.

Is antivirus software enough?

No. Modern endpoint protection is useful, but most incidents start with a stolen password or a convincing email, which antivirus does not stop. MFA, updates, backups and awareness do more.

Who do I report a cyber incident to?

Report cybercrime to the ACSC through ReportCyber, notify your bank immediately if money is involved, and if personal information was accessed and the Privacy Act applies to you, assess whether the breach must be notified to the OAIC and affected individuals.

Key takeaways

• Small businesses are targeted because the basics are often missing, not because they are special.
• MFA, updates, unique passwords and tested backups prevent most incidents.
• Verify every bank detail change by phone on a number you already hold.
• Make it safe for staff to report mistakes; speed of detection decides the size of the loss.
• Write the one-page incident plan before you need it.