Small Business Founder Shares Insights on the Need for Cybersecurity

The costs of cyberattacks on small businesses in Australia are gradually rising. According to the Australian Signals Directorate’s (ASD) latest Cyber Threat Report, the average cost of cybercrime per incident is costing Aussie small businesses $49,600.  

In this article, we take a look at some of the common cyberthreats SMEs need to be aware of and how to protect against them. We also speak to an Aussie small business owner about the very real need for cybersecurity and why she’s chosen to invest in Cyber Liability insurance. 

Why are Aussie small businesses at risk of a cyberattack? 

Justine Alter is the co-founder of Transitioning Well, a national company of registered psychologists that help to build healthy workplaces across Australia. She believes that implementing the right kind of defences against cyberattacks is extremely important in protecting client data as well as a business’s reputation. 

“I think a lot of small businesses don’t realise how valuable the data is that they’re holding,” Alter says. “Being registered psychologists, we’re having private and sensitive conversations with our clients. It’s really important that they have faith that our systems are secure and their information is safe.” 

As Alter says, personally identifiable information (PII) is extremely valuable to cybercriminals. This includes everything from names and birthdates to addresses and financial information. It represents a lucrative target because it can be used to commit identity fraud and social engineering scams, or it can simply be ransomed or sold on the dark web.  

The newest cyber threats to small businesses in Australia 

As technology evolves, so too do the malicious tactics of cybercriminals. Small businesses in Australia face an ongoing challenge as cybercriminals continue to develop new and sophisticated cyber threats to exploit vulnerabilities.  

Below are some of the emerging threats small business owners should be aware of. 

AI-enhanced phishing scams

According to the ASD, cybercriminals are increasingly using AI to launch cyberattacks, including advanced phishing scams. In some cases, cybercriminals are using AI to create highly convincing phishing emails that mimic legitimate organisations, using personal details to trick recipients into revealing sensitive information.  

Phishing scams are a type of social engineering cyberattack. Phishing scams rely on user errors and a lack of cybersecurity awareness. Comprehensive employee training and education can help staff recognise and respond to phishing scams and keep data and systems safe. 

Advanced ransomware attacks

Ransomware attacks are becoming more targeted and sophisticated. Cybercriminals often research their intended victims beforehand, which can help to increase the likelihood of payment. Once inside a system, a cybercriminal can completely cripple a business by encrypting critical data and rendering systems useless until the ransom is paid.  

In some cases, attackers use “double extortion,” where they not only demand payment for decryption but also threaten to leak sensitive data publicly. 

Regularly backing up data and implementing strong endpoint protection are two simple ways you can mitigate the risks of a successful ransomware attack.

Deepfake scams

Deepfake technology is being used to impersonate people that the targeted victim recognises and trusts, such as colleagues, employees or executives within a business. These deepfakes often take the form of a voice call or a video, requesting to authorise the release of sensitive information or authorise fraudulent transactions. Deepfakes are another kind of social engineering cyberattack.  

Businesses can implement strict verification procedures and protocols for high-value transactions, as well as educate staff members on these emerging threats so they can be on the lookout for suspicious calls or videos. 

Supply chain attacks

A supply chain cyberattack is when a cybercriminal attacks a third-party vendor in order to access your systems. Cybercriminals will target a vulnerable, less secure supplier and then gain access to separate organisations.   

You can’t do much about your suppliers’ cybersecurity measures. However, you can take steps to ensure that the suppliers you work with already have strong cybersecurity measures in place and limit third-party access to your systems to help protect data.  

The real-world business impacts of cyberattacks 

Alter feels there are unique risks that small businesses face compared to larger organisations when it comes to cyberattacks. 

She says, “Particularly being a small business, we know that [a cyberattack] is one of the greatest risks our business faces. If we were to have a cybersecurity breach, it would really impact us.” 

This is why Alter believes it’s so important for smaller businesses to take proactive steps towards cybersecurity before a data breach can ever occur, as the real-world fallout can be very serious. The most obvious impact is financial losses, but there are many other implications, too.  

Financial and operational costs 

A cyberattack can seriously strain a business’s finances. Not only can a successful attack grind your day-to-day operations to a complete halt, resulting in lost productivity, but there are also other costs to consider. This may include: 

• Extortion 
• Data recovery 
• System repairs 
• Forensic investigation into the data breach 
• Legal fees, fines and penalties.  

These losses can add up quickly, which can spell financial disaster for small businesses operating within tight margins.  

Reputational damage 

A serious breach of sensitive customer data can lead to a loss of trust with your customers. In some cases, this can be extremely difficult to rebuild and you may lose long-time customers who feel you can no longer adequately safeguard their information.  

Negative publicity from a data breach can also tarnish your reputation, which could impact your business’s ability to attract new customers.  

Legal and regulatory consequences 

Recent changes to Australia’s Privacy Act mean that certain small businesses in Australia could be subject to new laws and regulations when it comes to protecting their customers’ privacy. Failure to meet compliance requirements not only results in financial penalties but can also prompt audits, adding yet another layer of problems. 

The new privacy laws also introduced what is known as a “statutory tort”, which allows individuals to take legal action against entities that are responsible for breaching the individual’s privacy rights. 

To learn more about these changes, make sure you read our blog on what Aussie SMEs need to know about the new privacy laws. 

Protecting your data and client PII 

You can help to protect your business by investing in cybersecurity tools, training and educating employees, implementing security steps like multi-factor authentication and conducting regular backups. Many business owners also choose to take out Cyber Liability insurance to help them mitigate the costs associated with data breaches.  

Cyber Liability insurance covers losses from claims arising from data breaches, business interruption and remediation costs following an actual or threatened data breach. This can help to keep your reputation intact and also limit the financial damage of a successful data breach.  

“Our people uphold the confidentiality of our clients, and that’s really important,” says Alter. “So it was a no brainer for us to invest in Cyber Liability insurance to further support that confidentiality.” 

To get quick and easy online business insurance quotes, visit BizCover today. For on the go cover, go BizCover!