A cyber security plan is vital for mitigating online risks – but it can be hard to know where to start, especially for small businesses. The statistics are alarming.

  • Cybercrime costs the Australian economy more than an estimated $1 billion annually
  • Up to 22 percent of the small businesses that were breached by the 2017 Ransomware attacks were so affected they could not continue operating
  • In total, 87 percent of small businesses believe themselves to be safe from cyber-attacks because they use antivirus software.

Some of the important factors to consider in formulating a cyber security plan include:

Have a policy

Develop a business-wide policy so staff know cyber security is a priority. Ensure the policy addresses issues such as the scenarios in which business information is shareable, appropriate use of devices and online tools, and storage of sensitive material.

Update security software

Antivirus software is not enough to stop cyber attacks. PCs and mobile devices integrate security software as standard these days, so make sure devices are regularly updated. Microsoft Windows has the free built-in Windows Defender Firewall, which is considered to be as good as any paid anti-malware platform.

Evaluate exposure

Conduct Security Vulnerability Assessments. Steps can then be identified to reduce the risk of compromise, educate staff on best practice, and implement actions to build security.

Cyber security training

It’s important to separate cyber security from standard Information and Communications Technology (ICT), because it applies to anyone who uses the internet. Ensure staff are made aware of the business’s cyber rules from day one. This can be through HR processes, or in meetings to communicate the results of regular Security Vulnerability Assessments. Train staff in what a potential attack looks like, so they know how to recognise them to avoid falling into phishing, malware and ransomware traps.

Cyber attack response

Conduct a security audit, analyse and document how the incident transpired, isolate affected systems, collect evidence to understand the gravity of the incident, tighten network security and document findings needed for stakeholders and appropriate regulatory bodies.