Data security is becoming a pressing concern for businesses of all sizes. With the recent wave of large companies experiencing significant data security breaches, it's time to examine how prepared your business is to prevent and respond to such incidents. Small and medium businesses often lack the resources to tackle such situations, making prevention and vigilance essential.

What are the biggest data security threats for small and medium business?

1. Malware: a type of malicious software that can infect your computer or device, steal sensitive data, and damage your system. It can be delivered through email attachments, infected websites, or infected software downloads.
2. Phishing: a type of cyber attack where an attacker sends a fake email or message that appears to be from a legitimate source, such as a bank or online retailer. The goal of the attack is to trick the recipient into revealing sensitive information, such as login credentials or financial information.
3. Ransomware: a type of malware that encrypts your files and demands payment in exchange for the decryption key. Ransomware attacks can be devastating for businesses, as they can lead to data loss and operational disruptions.
4. Insider threats: refer to attacks that are carried out by individuals within an organistion. These individuals may have access to sensitive data and can use their access to steal or damage the data.
5. Distributed denial-of-service (DDoS) attacks: a type of cyber attack where an attacker overwhelms a website or network with traffic, causing it to crash. These attacks can disrupt business operations and lead to data loss.
6. Social engineering: a type of cyber attack where an attacker uses psychological manipulation to trick individuals into revealing sensitive information or performing an action that is not in their best interest. This can include tactics such as pretexting, baiting.

One of the biggest threats to data security is the unauthorised access of sensitive data. Hackers and cybercriminals can gain access to your data by exploiting vulnerabilities in your system or tricking you into divulging sensitive information.

For example, we’re aware of a situation in recent weeks where hackers gained access to an ATO account and lodged a tax return in an attempt to direct the tax refund to their bank account. It was fortunate, in a sense, that the hackers were not very good at accounting and instead left a tax debt which triggered those involved to something odd having happened. However, the ATO now has to place stringent measures on the account to prevent any further breaches which adds a layer of complexity and administration for the person involved.

There are also countless stories of invoices being intercepted and bank account details changed. Your clients, or your business, are then at risk of paying some clever hacker the intended funds rather than you or your suppliers. If in doubt, always confirm bank account details by phone using a phone number obtained through another avenue and not from an email signature or potentially intercepted invoice.

While most of these risks are external to your business, figures suggest that 33 percent of data breaches resulted from human error within the organisation. Most of these incidents are situations where personal information was emailed to the wrong recipient, followed by the unintended release or publication of information. This highlights the importance of ensuring that your business is compliant with the Privacy Legislation Amendment (Enforcement and Other Measures) Bill passed in November 2022.

This bill increases the maximum penalties for serious or repeated privacy breaches, from the previous $2.2 million penalty to whichever is the greatest of:

• $50 million;
• three times the value of any benefit obtained through the misuse of information;
• 30 percent of a company’s adjusted turnover in the relevant period.

As well as providing greater powers for the Australian Information Commission to resolve privacy breaches.

What can you do to protect your client information, and ultimately your business?

• Implement strong password policies and two-factor authentication for all accounts.
• Keep your software and operating systems up-to-date with the latest security patches and updates.
• Regular backups can help to ensure that you have a copy of your data in case of a breach or system failure.
• Educate yourself and your employees on best practices for data security. This includes avoiding suspicious emails and attachments, using secure networks and devices, and being cautious when sharing personal information online.
• Work with a trusted IT professional or cybersecurity expert to assess and address any vulnerabilities in your systems.
• Use passphrases instead of passwords, they are hard for cybercriminals to crack but easy for you to remember. For instance, crystal onion clay pretzel.
• Stay aware of what the latest trends in cybercrime, as cybercriminals use an agile business model!

As your partner for success beyond the numbers, Power Tynan can help your business address data security concerns and stay compliant with your obligations. Contact your Business Advisor today.