• Implementation: Enable MFA for all critical accounts. Use SMS, authenticator apps, or hardware tokens.
• Benefit: Adds an extra layer of security, making it harder for cybercriminals to access accounts.
• Learn More: Multi-Factor Authentication

• Implementation: Use a password manager to create and store unique passwords. For frequently used accounts, use passphrases (e.g., four random words).
• Benefit: Protects accounts from being easily compromised.
• Learn More: Passphrases and Password Managers

• Implementation: Restrict access to files, accounts, and systems based on role necessity. Regularly review and update access permissions.
• Benefit: Limits the impact of potential breaches.
• Learn More: Access Controls

• Implementation: Enable automatic updates for all devices, apps, and software. Regularly check and update systems that do not support automatic updates.
• Benefit: Fixes security vulnerabilities and reduces the risk of exploitation.
• Learn More: Software Updates

• Implementation: Schedule regular backups of critical data. Use both on-site and cloud storage solutions.
• Benefit: Ensures data recovery in case of loss or cyberattack.
• Learn More: Data Backups

• Implementation: Install and maintain antivirus, anti-malware, and ransomware protection software. Use built-in security features like Windows Security.
• Benefit: Detects and removes malicious software, protecting devices from threats.
• Learn More: Security Software

• Implementation: Secure routers with strong passwords, enable encryption, and use guest Wi-Fi networks for visitors. Regularly update network hardware.
• Benefit: Prevents unauthorised access and secures communication channels.
• Learn More: Network Security

• Implementation: Lock devices with PINs, passwords, or biometrics. Ensure automatic locking after periods of inactivity. Secure physical access to devices.
• Benefit: Protects devices from unauthorised use and potential data theft.
• Learn More: How to secure your device

• Implementation: Conduct regular cybersecurity training for all staff. Include training as part of the onboarding process for new employees.
• Benefit: Equips staff with the knowledge to recognise and respond to cyber threats.
• Learn More: Staff Training and Awareness and Sandpit Cybersecurity Training environment; or  Cyber security training and support from AHDA

• Implementation: Develop and practice a cyber incident response plan. Identify critical assets, key contacts, and response procedures. Report incidents to relevant authorities.
• Benefit: Ensures a swift and effective response to minimise the impact of cyber incidents.
• Learn More: Incident Response Plan, Containing the damage after a cyberattack and QLD Incident management guideline

Scams are a common way that cybercriminals target small businesses. Their goal is to scam you or your staff into sending money, clicking on malicious links, or giving away sensitive information.

• Mitigation: If a message is from a known entity and seems suspicious, contact the person or business separately to verify its legitimacy. Use contact details from a legitimate source, not those in the suspicious message.
• Learn More: Scams

These scams often contain a link to a fake website where you are encouraged to log in to an account or enter confidential details. Phishing attacks typically compromise your account passwords.

• Mitigation: Contact the person or business separately to check if the message is legitimate using contact details from a legitimate source.
• Learn More: Recognise and report scams, Learn how to spot phishing scams and Detecting Socially Engineered Messages

Business email compromise (BEC) involves criminals impersonating business representatives to scam victims into sending funds to a scammer’s bank account.

• Mitigation: Train employees to be cautious of emails requesting payments, changing bank details, or using unfamiliar email addresses. Introduce a formal process for verifying payment requests and bank detail changes.
• Learn More: Business email compromise, Protect your business from email fraud and compromise and Recovering a compromised email account

Malware is malicious software designed to cause harm, such as ransomware, viruses, spyware, and trojans.

• Mitigation: Be vigilant with emails, websites, and file downloads. Regularly update devices and use security software.
• Learn More: Malware and Protect Yourself Against Malware

Ransomware locks or encrypts your files, demanding a ransom to restore access.

• Mitigation: Use security software, regularly update devices, and be vigilant with emails, websites, and file downloads.
• Learn More: Ransomware, Protect yourself against ransomware attacks and Report and recover from ransomware