Estimated reading time
7 min
Key points
- Security software, such as Norton and McAfee, is designed to help protect your systems, servers, devices, and networks from cybercriminals and defend data, device users, and your business from cyber security risks.
- Developing risk assessment plans, training your staff on cyber security, and creating strong passwords are some steps you can take to bolster your business's cyber security.
- If you receive an alert on your anti-virus software, notice files have changed, or have slower-than-usual internet speed, take these signs seriously – a cybercriminal might have breached your system.
Technology plays an essential role in many businesses today - from communicating with customers to managing payments, data, and day to day operations. As businesses increasingly rely on digital systems, cyber security becomes an important consideration.
Business cyber security is about understanding potential cyber risks and taking practical steps to help protect business information and operations. This guide outlines key considerations and simple actions businesses can take to better manage cyber risk.
Why is cyber security important for your business?
Cyber incidents can disrupt business operations, affect customer confidence, and take time and money to resolve.
Cyber security helps reduce the risk of these incidents by supporting the protection of business systems and information. While no single measure can prevent every issue, using secure systems, security software, and good everyday practices together can help reduce risk.
Many cyber incidents begin with simple mistakes, such as clicking on a convincing email or responding to a request that appears legitimate. That’s why awareness and consistent habits across the business are just as important as having the right technology in place.
3 common business cyber threats
1. Business email compromise (BEC)
Business email compromise occurs when a criminal gains access to a business email account or system. Once inside, they may impersonate a trusted contact, such as a manager or supplier, to trick employees into sharing sensitive information or making payments.
Criminals may also intercept emails, such as invoices, and change payment details before forwarding them on. Because these messages often appear genuine, BEC can be difficult to detect and may result in financial loss if not identified quickly.
2. Phishing emails and messages
Phishing involves emails or messages that contain malicious links designed to trick recipients into sharing login details, banking information, or other sensitive details. These links often lead to fake websites that closely resemble legitimate services, such as banks or government agencies.
Phishing messages can be sent by email, text message, or other digital channels and may appear to come from a trusted organisation or colleague. If successful, phishing can lead to unauthorised account access, business fraud, or further cyber incidents.
3. Malware
Malware is malicious software that can damage business systems or networks. It may be installed by opening a compromised email attachment, clicking a malicious link, or downloading an infected file.
Common types of malware include ransomware, which locks access to files, spyware, which collects information without your knowledge, and Trojans, which are hidden within seemingly legitimate files. Malware can disrupt operations and may expose customer or payment information if systems are compromised.
How can you tell your business’ cyber security has been breached?
- Files and administration permissions have changed unexpectedly. For example, a document has been renamed or deleted, or an unknown user has been added as an administrator on a work device.
- There are issues logging into your accounts or devices, which means they might be compromised by a cybercriminal.
- Your network is running slower than usual, possibly indicating malware operating in the background.
- New software is installed unexpectedly, and no one knows where it originated.
- There’s an alert on your anti-virus software about potential threats on your devices – take these notifications seriously.
- An employee mentions an interaction with you that never happened, such as an email exchange about a payment transfer. This may indicate that an email impersonation scam has occurred.
- Unexpected changes to account settings or passwords for a device or account can indicate that a cybercriminal has accessed and compromised the account.
- It’s difficult to assess your own systems and data, which can indicate that someone has made changes to the device without your knowledge or that malware has been installed.
- You notice unauthorised transactions in your business bank account. This can be a sign that someone has your business banking details. Contact your bank immediately.
Tips to protect your business from cybercrime
- Keep systems and devices up to date. Regular updates help ensure your business devices and software have the latest security protections. Turning on automatic updates can make this easier to manage.
- Use strong, unique passwords or passphrases. Strong, unique passwords or passphrases for business accounts can help reduce the risk of unauthorised access. Password managers can help staff manage passwords more securely.
- Enable extra security where available. Using additional protections, such as multi factor authentication, can add an extra layer of security to business accounts, including email and online services.
- Back up important business information. Regularly backing up key business data can help limit disruption if systems are affected by a cyber incident or data is lost.
- Help staff stay cyber aware. Many cyber incidents start with simple mistakes. Supporting staff to recognise common scams and understand how to respond to unexpected requests or suspicious activity can help reduce cyber risk.
- Have incident response plans in place. It can be helpful to have a clear approach for responding to cyber incidents, such as knowing who to contact, what systems may need attention, and how to limit further impact.
What can you do if you think your business has experienced a breach or been scammed?
- If you’ve shared financial information or transferred money, contact your bank immediately. If you’re an ANZ business customer, contact us immediately to report the fraud.
- If you have shared business credit card details, ‘block’ or cancel those cards immediately. If your cards are with ANZ, you can report the stolen card through the ANZ app or by calling us.
- If you think your business has had a data breach, please follow the Australian Signals Directorate’s guidance.
Who can you contact if you’ve been scammed?
- Contact the Australian Cyber Security hotline, 24 hours a day, seven days a week on 1300 CYBER1 (or 1300 292 371).
- Report the scam to the Australian Signals Directorate’s ReportCyber portal. This resource is there for reports of scams where money or personal information has been lost.
- Help others by reporting to Scamwatch to help them prevent future losses, monitor trends and educate the population about emerging threats.
- You can also contact IDCare, a not-for-profit organisation providing support to those experiencing identity and cyber security concerns.
- Contact your bank immediately if you share personal or financial information.
- If you’re an ANZ customer, you can report fraud or suspicious activity in multiple ways, such as through the ANZ app or by calling us
