When it comes to security, businesses can be at a loss when the crime occurs online. No robber hides around the corner; no corner store gets held up. In fact, cybercrime can happen in broad daylight with just a few lines of text in an email.\u00a0<\/span><\/p>\n We spoke with Ed Blackman, Reckon\u2019s CTO, to get him to weigh in on Cybersecurity Month. One of Blackman\u2019s many duties is reviewing and implementing Reckon\u2019s cybersecurity policy, which keeps Reckon staff and customers safe from online attacks.<\/span> The industry behind cybersecurity is huge. More and more businesses and individuals are affected, amounting to <\/span>eye-watering damages<\/span><\/a> that have crippled businesses big and small. The need to protect yourself on an ongoing basis is becoming more evident.<\/span><\/p>\n According to the 2022-2023 Cyber Threat Report from the Minister of Defence, Richard Marles, and the Australian Signals Directorate, average losses by size of business due to cybercrime are up by 14% from 2021 to 2022.<\/span><\/p>\n Now, more than ever, small businesses must consider their security. Blackman defines cybersecurity simply for small business owners.<\/span><\/p>\n Well, it\u2019s basically just protecting yourself, personally, and your business against threats in the cyber world that could harm or cause you and your business loses. <\/i><\/b><\/p>\n<\/blockquote>\n Understanding how much you need to invest in your small business\u2019s security is important. But it\u2019s not as simple as it seems.<\/span><\/p>\n It really depends on the size of the business and its risk. So, there is certainly not a one-size-fits-all answer for all types of businesses.<\/i><\/b><\/p>\n<\/blockquote>\n Your <\/span>cybersecurity policy<\/span><\/a> and protections need to be scalable to your means and realistic in response to your risk exposure.<\/span><\/p>\n Your policy should address the common threats cybercriminals pose to you and your small business.<\/span><\/p>\n The two most common threats are financial loss and data breach. They\u2019re probably the two biggest things businesses need to consider protecting themselves against.\u00a0<\/i><\/b><\/p>\n<\/blockquote>\n When cybercriminals try to access your data, your <\/span>cybersecurity plan<\/span><\/a> should consider several things.<\/span><\/p>\n Turn on multi-factor authentication for all your accounts that contain valuable data, even those that don\u2019t, because people can attack those to access more valuable accounts.\u00a0<\/i><\/b><\/p>\n<\/blockquote>\n Another policy to implement is passphrases instead of regular passwords.<\/span><\/p>\n A passphrase helps you think of a couple of completely unrelated words to create a long password that is difficult for an attacker to crack.<\/i><\/b><\/p>\n When cybercriminals try to crack a password, using a particular passphrase can be the difference between needing a <\/i><\/b>couple of days to break the password or 36 years<\/i><\/b>.<\/i><\/b><\/p>\n<\/blockquote>\n Passwords and passphrases are a fact of life now. You need to protect yourself and your business. Having trouble remembering the never-ending list of passwords? No worries, Blackman has a solution.<\/p>\n The best place to start is with a password manager. This tool allows you to have unique passwords without constant individual maintenance. All it requires is for you to come up with your original password\/passphrase to get access, and you can let the service do the rest.<\/i><\/b><\/p>\n<\/blockquote>\n Cybercriminals are after more than raw data. As we\u2019ve seen recently, attacks involve cybercriminals gaining access to personal information and important accounts related to either bank accounts or business systems.<\/span><\/p>\n They\u2019re trying to get PII (personally identifiable information) about you or your customers so that they can proceed with further attacks.\u00a0<\/i><\/b><\/p>\n They will also want to access your account and look at things like invoices. Cybercriminals will draft new copies using your invoices and the design and resend them with your spoofed email address. This is an everyday fraudulent financial activity that businesses experience.<\/i><\/b><\/p>\n<\/blockquote>\n Cybercrime, while occurring virtually, resembles how theft is carried out physically. There are opportunistic attacks, where an attacker has, by chance, noticed a vulnerability and will exploit it, versus targeted attacks, which are pre-meditated. Think of a targeted attack like a thief casing a bank to plan their next heist.<\/span><\/p>\n Knowing the difference is key to a sound cybersecurity strategy, and a policy that mitigates these types of attacks is vital.\u00a0<\/span><\/p>\n The critical difference is that you basically need to put the key mitigations in place to prevent all threats.<\/i><\/b><\/p>\n The key difference between an opportunistic and a targeted attack is the level of the person they\u2019re going after or the type of person. A more targeted attack will be aimed at a senior leader in a business.\u00a0<\/i><\/b><\/p>\n<\/blockquote>\n Ultimately, it comes down to people. Cybercriminals exploit knowledge gaps to gain access to sensitive information. By educating yourself and your staff, you can learn to spot phishing attempts or scams and mitigate or prevent critical losses.<\/span><\/p>\n Another key defence you must implement is regular training for yourself and your staff on recognising attacks. Ensure your staff, especially those in key positions, know basic fraudulent attacks, such as <\/i><\/b>phishing and spear phishing tactics<\/i><\/b><\/a>.<\/i><\/b><\/p>\n<\/blockquote>\n Small businesses can be confused about where to turn after a breach or an attempted breach. When a breach occurs, you can\u2019t just call 000. That\u2019s where the Australian Signals Directorate (ASD) comes in.<\/span><\/p>\n If you don\u2019t think you\u2019re sufficiently skilled, the first thing to do is get help. The government has an excellent resource called <\/i><\/b>cyber.gov.au<\/i><\/b><\/a>. That is my advice; the first place you should go is there.\u00a0<\/i><\/b><\/p>\n There\u2019s a whole section on what to do when you\u2019ve been breached; work through the advice and the steps that they suggest. If you have any breaches, attempted breaches, or are unsure, go there.<\/i><\/b><\/p>\n<\/blockquote>\n
<\/span>
<\/span>So, what is cybersecurity? And what can small businesses do to stay safe?<\/span><\/p>\nDefining Cybersecurity<\/b><\/h2>\n
\n
![\"\"](\"https:\/\/www.reckon.com\/reckon-blog\/wp-content\/uploads\/2024\/10\/ASD-Infograph-3-300x150.png\")
<\/p>\n\n
Investing in your security<\/b><\/h2>\n
\n
\n
Cybercriminals, tools, and tactics<\/b><\/h2>\n
\n
\n
\n
![\"\"](\"https:\/\/www.reckon.com\/reckon-blog\/wp-content\/uploads\/2024\/10\/Cyber-icon-2-300x182.png\"){kind=icon}
<\/p>\nAre cybercriminals looking for more than just data?<\/b><\/h3>\n
\n
![\"\"](\"https:\/\/www.reckon.com\/reckon-blog\/wp-content\/uploads\/2024\/10\/Cyber-Icon-300x182.png\"){kind=icon}
<\/p>\nOpportunity vs. targeted cyber attacks<\/b><\/h2>\n
\n
\n
Cyber-breach aftermath\u00a0<\/b><\/h2>\n
\n
![\"\"](\"https:\/\/www.reckon.com\/reckon-blog\/wp-content\/uploads\/2022\/08\/Ed-Blackman-300x300.png\")
<\/p>\n