Cyber security can feel like a topic for big companies with big budgets. Recent news suggests otherwise. A parliamentary inquiry into cyber security for small and medium-sized businesses is hearing evidence, and one of the largest cryptocurrency thefts on record reportedly began with a single compromised laptop. The lesson for a small business is practical: most of the risk sits in everyday basics, and those basics are within your reach.
Why the way we talk about cyber security matters
At the inquiry hearing reported by Information Age, ACS representative Jakub Zverina argued that the term itself puts businesses off, saying: "The best thing we can do to improve cybersecurity is to stop calling it cybersecurity." His point was that this is really safety work: protecting your people, your systems and your data. Another witness told the inquiry that small businesses are already overwhelmed by information and need practical tools rather than more of it.
That framing is useful. You wouldn't ask whether a workshop can afford safety procedures. You would ask which hazards are most likely to hurt someone, and fix those first. The same approach works for technology.
Where attacks often start: the everyday device
Binance reported that the attacker in its recent theft first compromised a DevOps engineer's laptop, then used that access to reach a service container and submit unauthorised withdrawals. The scale of that incident is far beyond a typical small business, but the pattern is familiar. Attackers frequently begin with one ordinary device or account and work outward from there.
For a smaller organisation, that means the laptop used by your bookkeeper, the shared mailbox, or the admin account your last IT contractor set up deserve as much attention as your servers.
Start with these basics
- Turn on multi-factor authentication for email, Microsoft 365, banking, accounting software and remote access.
- Keep devices and software updated, and retire machines that can no longer receive updates.
- Give people the access they need for their role, and no more. Remove access promptly when someone leaves.
- Use a password manager so staff aren't reusing passwords across systems.
- Keep backups separate from your main network, and test that you can actually restore from them.
- Make sure someone owns the list of devices, accounts and suppliers, so nothing is forgotten.
None of these is glamorous. Together, they close off many of the easiest routes into a business. The Australian Cyber Security Centre publishes free guidance for small businesses at cyber.gov.au, which is a sound place to check your priorities against.
Separate what must stay running
If you run a factory, workshop or site with production equipment, consider how that equipment connects to your office network. Production systems often run for years on older software that can't be patched easily. Keeping them on a separate network segment from email and web browsing limits how far a problem in the office can spread. This is a design question best settled when a network is planned or upgraded, rather than after an incident.
Plan for the day something goes wrong
Even well-run businesses have incidents. A short written plan makes a large difference to how the day unfolds. It should cover:
- Who makes decisions, and who to call first, including your IT provider, your insurer and your bank.
- How to isolate an affected device or account quickly.
- Where your backups are and who can restore them.
- How and when you will talk to staff and customers.
- What your obligations may be if personal information is involved.
On that last point, privacy and breach-notification obligations depend on your circumstances. The Office of the Australian Information Commissioner (oaic.gov.au) provides guidance, and it is sensible to take professional legal advice if you are unsure what applies to you.
Choosing an IT provider when there is no common yardstick
Australian Computer Society CEO Dr Prins Ralston told the inquiry that small businesses lack a consistent way to assess cyber security providers, and the ACS is calling for a common standard rather than a new licensing requirement. Until something like that exists, the responsibility to ask good questions sits with you. Useful ones include:
- What will you do in the first 90 days to improve our security, and how will you report on it?
- How do you manage administrator access to our systems, and who else has it?
- How often do you test our backups, and can you show us the results?
- What happens, step by step, if we suspect an incident at 7pm on a Friday?
- Which parts of our environment are you responsible for, and which are not?
- Can we see the documentation if we ever change providers?
Clear, specific answers are a good sign. Vague reassurance is not. Whoever you choose, make sure responsibilities are written down so that nothing falls between your team, your provider and your software suppliers.
Make it part of how the business runs
Security that depends on one enthusiastic person tends to fade. Build it into routines: a short review of accounts and devices each quarter, a few minutes at induction for new staff, and a standing item in management meetings. Staff are far more likely to follow good habits when they understand the reason for them and when the secure way of working is also the easy way.
Technology change brings its own risks, too. When you introduce new tools, including AI tools, check what data they can see and who can use them before they spread through the business.
A simple way to begin this month
- List your most important systems and the people who can administer them.
- Confirm multi-factor authentication is on for each one.
- Check when your last successful backup restore test took place.
- Write down who you would call first in an incident.
- Book a conversation with your IT provider about the gaps you found.
Perfect security isn't the goal. The goal is to make your business a harder, less rewarding target, and to recover quickly when something does go wrong. If you'd like help working out where to start, a managed IT partner or an independent technology adviser can review your current setup and help you set priorities that fit your size and budget.