Cyber security and your SME: What to expect in 2019

admin |

The cyber threat to Australian small business is unquestionable, incessant and showing no signs of abating. The Cyber Security Review – from the Department of the Prime Minister and Cabinet – has estimated that the cost of cybercrime in Australia is rising exponentially, costing the economy an estimated $1 billion annually, in direct cost alone.

 

Historically, major cyber-attacks have been focused on government and corporates. However, it’s increasingly small to medium businesses who are facing the biggest threats. With small business, the target of 43% of all cybercrimes, their size, lack of skilled employees and limited budgets make them especially attractive to cybercriminals.


 

Despite these statistics, many small businesses don’t consider themselves a target for cybercriminals…

87% of small business owners surveyed said they didn’t feel they were at risk of experiencing a data breach.

This false sense of security is at odds with reports –  1 in 4 Australian small businesses have fallen victim to cybercrime – up from 1 in 5 in 2016.

This growth in cyber-attacks is matched by a rise in financial loss. In 2017, the estimated average cost of an attack on an Australian SMB was $10,299. In 2016, this figure was $6,591 – a 56% increase in just one year.

Cyber-attacks have the potential to cripple SMBs. Lengthy downtime and data breaches affect operations and damage business reputations. It’s never been more critical for SMBs to continue to increase their awareness of cybercrime and take steps to protect themselves.

Because these attacks occur in countless different ways, and multiply all the time, the key to protecting your business against cybercrime is to stay abreast of the latest cybersecurity trends and technology.

We’ve compiled below the trends and predictions from some of Australia’s leading cybersecurity experts. There is no question the threat landscape is changing and these consistent, yet contrasting, views are an interesting read.


ON PROTECTING DATA

Serkan Cetin, One Identity APJ technology and strategy regional manager, Security Brief

“In 2018 Australian businesses saw the implementation of Mandatory Data Breach Notification legislation which has shed light on which industries are struggling to keep Australian’s data safe. In 2019 we’ll start to see businesses adopt more secure measures like multi-factor authorisation in order to prove they are taking security seriously.

Biometric authentication will become more widespread to secure access and satisfy multi-factor authentication needs. Besides the physical biometric solutions, such as fingerprints and face detection, more emphasis will be put into analysing users’ behaviour for identification. Those organisations that need to meet the highest security standards, for instance, the finance sector, will complement their security analytics with behavioural biometrics capabilities that help analyse their privileged users’ activities.

How an individual types on a keyboard, their reaction time, or how they use systems and consume the services provided will be a more prevalent part of identification of the most important users to secure their access to sensitive data.

2019 will move us one step closer to a password-free future as technology companies lead the charge to develop new ways to securely authenticate individuals. More companies will embrace FIDO2, which has recently been approved for use.”

 

Alex Tilley, Secureworks Senior Security Researcher, Security Brief

“If Australia plans on effectively growing the cybersecurity sector in 2019, businesses must apply a risk-based approach to security.

IT teams must understand:

  •    What data is of value to their business and evaluate threats and risks to that data
  •    What attacks can be prevented and detect what attacks cannot directly be avoided.
  •    How to predict hackers next moves and be prepared to respond efficiently and effectively

 

In 2019, ‘business email compromise’ (BEC) tactics will continue to be successful against companies that don’t have fundamental security controls in place. Multi-factor authentication on internet-accessible email accounts, user awareness education on phishing, endpoint controls to detect malware running on machines, and log monitoring to detect anomalous login activity on accounts are all vital to creating a strong security platform.

Throughout the next year, ransomware tools will continue to gradually evolve. This will result in further criminal success and more mounted attacks involving compromise, long-term lateral movement and device discovery inside the victim network.”


ON PHISHING ATTACKS

Phishing emails are commonly used by criminals to steal financial details from Australian businesses with their methides continuing to grow in sophistication.

Sean Duca, Palo Alto Networks vice president and chief security officer, CSO

“Attackers continue to steal passwords and login details, giving them access to organisations via email. These hackers can pose as partners or internal stakeholders, tricking employees into providing more information, or even acting against the company’s best interests. Attackers range from mimicking corporate websites to targeting employees’ social media accounts to launch exploits. These methods are proving exceptionally effective, so attackers are likely to continue along these lines in 2019.”


ON CLOUD SECURITY

Cloud-first technologies offer plenty of benefits to small businesses including cost savings and improved business outcomes for organisations. However, they also bring security risks.

Sean Duca, Palo Alto Networks Vice President and Chief Security Officer, CSO

“As more organisations embrace cloud services and depend on a cloud-based infrastructure, more mission-critical data and systems will sit with third parties. Securing these assets at rest and in transit is a shared responsibility between the cloud provider and the business itself, so enterprises will need to develop a strong security strategy that leverages every possible advantage. Because cloud makes security a more complex proposition, questions around which security products to use will need to be answered. The ongoing skills shortage will also remain top of mind as organisations battle to attract and retain suitably-skilled security professionals who can help navigate the complexity of protecting data, applications, operating systems, network configurations, and more.”

Gary Denman, McAfee Vice President, Australia and New Zealand

“Australia has always been one of the fastest growing ‘cloud’ countries in the world per capita, and we’ll jump at any opportunity to become more efficient and advanced in our approach to the cloud. However… corporate data residing on the cloud will be a major target in the coming year. As much as 21% of content now managed on the cloud contain sensitive materials, and once information is accessed within the right regulations, it becomes a matter how it’s being used. Someone down the stream can become a target, and the data gets exfiltrated through a long pipe. Cloud-native attacks will soon become the launchpad for cryptojacking and ransomware attacks, which is why now, more than ever before, cyber resilience will become key, thwarting these types of attacks to the cloud.”


ON SECURITY PATCHES

Many cloud software vendors bundle security patches into software updates, and often it’s just a matter of a quick update to protect your business.

Jason Keogh, 1E Product Marketing Vice President, Security Brief

“Being particular about patching has always been smart security practice, but perhaps 2019 will be the year more organisations twig to just how vitally important it is. While new and exotic forms of ransomware hog the headlines, the majority of attacks are far more pedestrian in nature. They target known vulnerabilities which can and should be fixed before opportunistic hackers have time to worm their way in. What’s termed the ‘window of vulnerability’ – the time between a vulnerability being announced and its being successfully exploited by a hacker – has shrunk to around seven days. This means enterprises need to be ready to roll with an immediate patching protocol, not adding the task to the To Do list for attention some time down the track. The fact that data is fast becoming the lifeblood of the enterprise is beginning to dawn on organisations.

As more enterprises suffer the high costs associated with a significant attack or data breach – business disruption, notification compliance, legal costs and fines – making patching a priority may finally become a status quo in 2019.”


ON ARTIFICIAL INTELLIGENCE

2018 saw AI’s emerge as a driver in marketing and advertising technology. 2019 will see AI become more available and affordable for managing cyber security.

Richard Watson, EY lead partner APAC Cyber Security Risk Management, The Martec

“AI is now also being used to perform cybersecurity tasks. For example, some of the latest threat detection approaches are using AI and robotics to automate the identification of unusual activity on computer networks. This is then leading to the collapse of the traditional tiers of security operations. Levels 1, 2 and 3 are all merging into an automated threat detection capability, enabled by big data, robotics and artificial intelligence.”


ON THE INTERNET OF THINGS

The proliferation of IoT is exposing businesses to new levels of security risks. 2019 will see the increased need for data protection and privacy measures in SMEs.

Richard Watson, EY lead partner APAC Cyber Security Risk Management, The Martec

“(IoT) devices that have little or no inbuilt security are connected to the internet and are increasingly being connected to corporate IT systems. This creates a relatively easy access path for any would-be attacker. What’s more, these systems often control industrial processes where health and safety is a genuine concern. So any cybersecurity failings in the IoT systems might not just be embarrassing, they could be fatal.”


ON INSIDER THREATS

Although the number of internal attacks on SMEs are far fewer than their corporate counterparts, they tend to have a greater impact because employees in small businesses have access to more business-critical systems.

Nicholas Patterson, Deakin University lecturer, The Conversation

“The NDB scheme and reporting is an important way to shed light on the cyber security issues facing Australia, now and in the future. Knowing how breaches are occurring, how often and to which sectors will allow cyber security professionals and researchers to tackle these issues head on. Some breaches can be defended using technology, such as ransomware prevention tools. But breaches that result from human error are more difficult. Education and training for employees can assist them in preventing simple mishaps from occurring.

Bringing these numbers down will require a mix of technological solutions and education. Until we get this right, we’re likely to see more breaches in the near future, rather than less.”

The security risk to every organisation is different. If you’d like to discuss any areas of concern, we’re more than happy to assist.

Reach out to our team today to start the conversation.



[1]
Australian criminal Intelligence Commission https://www.acic.gov.au/about-crime/organised-crime-groups/cybercrime

[2]  The Australian Small Business and Family Enterprise Ombudsman, https://www.asbfeo.gov.au/sites/default/files/documents/ASBFEO-cyber-security-guide.pdf

[3] Are Small Business Owners Protecting Themselves from Cyber Attack? https://www.manta.com/resources/small-business-trends/small-business-owners-protecting-cyber-attack/

[4] NORTON SMB CYBER SECURITY SURVEY Australia 2017 http://now.symassets.com/content/dam/content/en-au/collaterals/datasheets/cybersecurity-simplified.pdf

[5] NORTON SMB CYBER SECURITY SURVEY Australia 2017 http://now.symassets.com/content/dam/content/en-au/collaterals/datasheets/cybersecurity-simplified.pdf