Cybercrime is on the rise, is your business prepared for what's to come?
The latest Cyber Threat report released by The Australian Cyber Security Centre (ACSC) has revealed a continued rise in the number of sophisticated cyber threats against Australian businesses and an overall increase in cybercrime activities.
With predictions that 2022 will likely present similar risks, businesses can no longer afford to overlook investing in cyber defence and protection.
During the 2021-22 financial year, more than 76,000 cybercrime reports were made to the ACSC, an increase of nearly 13% from the previous year. This equates to an alarming one report every seven minutes.
The average cost per cybercrime report has also been increased by 14%, with medium-sized businesses being hit the hardest. According to the report:
- For small businesses, the average was over $39,000
- For medium businesses, the average was over $88,000
- For larger organisations, the average was over $62,000
Many businesses have also maintained a hybrid working model because of the pandemic, which has introduced new risks to the cyber landscape. Employees are regularly switching between personal and corporate devices and working from home office modems that are often insecurely designed with minimal security maintenance, becoming an appealing target to cyber criminals.
What were the most common types of cybercrimes?
Fraud, financial and identity theft, and Business Email Compromise (BEC) continued to be the most common cyber threats due to their volume and ability to cause significant business disruption and financial and reputational damage.
Many reported incidents were also caused by simple techniques, including spear phishing and exploiting unpatched or misconfigured systems.
Ransomware groups continue to target Australian businesses that are high profile, high value, or provide critical services. And while ransomware accounted for only a small percentage of the total cybercrimes reported, according to the ACSC, it still remains the most destructive cybercrime threat for businesses.
What can I do to protect my business?
Cyber security doesn't need to be difficult. There are simple measures that, if understood and implemented correctly, can significantly avoid or help reduce the impact of a cyber security incident on your business.
Investing in preventative measures is also typically more cost-effective in terms of time, money and effort compared to responding to a large-scale cyber incident once it has happened.
As a baseline, the ACSC recommends businesses implement their 'Essential Eight'. The mitigation strategies that make up the Essential Eight are:
- Application Control - Implementing application control on important servers can help to prevent the installation or use of unapproved/malicious programs.
- Patch Applications - Testing and deploying updates to software, applications and systems running on your employees' computers. This helps to reduce the risk associated with bugs and security vulnerabilities within those applications.
- Configure Microsoft Office macro settings - Microsoft Office applications contain embedded code (macros) to automate routine tasks. However, some may contain malicious code resulting in unauthorised access to sensitive information. Macros should be disabled for users that do not have a demonstrated business requirement.
- User Application Hardening - Limit the opportunity for attacks by removing unnecessary system applications and placing restrictions on application functions that are vulnerable to malicious use.
- Restrict Administrative Privileges - validate the requirement for employees to be granted administrative privileges to particular operating systems and applications based on the users role. Restricting all access and allowing on a business case basis is a simplified way to provide users with only the access they require.
- Patch Operating Systems - this improves the security of operating systems by fixing known vulnerabilities. Cyber criminals exploit these vulnerabilities as soon as they are publicly disclosed so organisations should patch their applications within 48 hours of the security vulnerability being identified.
- Multi-factor Authentication - Multi-factor Authentication involves a two or more step process to log in to a device. This will typically include a password and an additional step such as a code sent to a mobile device to gain access to an account or business network.
- Regular Backups - performing regular backups of important new/changed data, software and configuration settings can help to ensure you have a safe and up-to-date copy of your files should something happen to your computers. It also helps to make sure the data isn't being encrypted, corrupted, or deleted by ransomware or other destructive malware, accidental mistakes, or system failures.
How Coverforce can help
As technology advances and more businesses have an online presence, it also opens up a new set of liability and cyber risks.
Our team of experienced brokers are here to provide personalised risk advice and tailored, competitive insurance solutions that can help minimise your financial losses as a result of a cyber incident. If you haven't already, get in contact with your local Coverforce Office today or call 1 3000 COVER.
The information provided in this article is of a general nature only and has been prepared without taking into account your individual objectives, financial situation or needs. If you require advice that is tailored to your specific business or individual circumstances, please contact Coverforce directly.
REFERENCES
Find this article helpful? Click on one of the links below to share the content.
