Businesses and government organisations today face increasingly sophisticated and damaging cyberthreats, including state-sponsored critical infrastructure attacks, new versions of ransomware and phishing messages nearly indistinguishable from legitimate communications.
The Australian Cyber Security Centre (ACSC) Essential Eight strategies provide a baseline from which businesses and organisations can mitigate the potential financial, reputational and operational risks posed by these threats.
From this baseline, businesses and organisations can implement additional measures as required to deliver the required level of protection.
Growing threat levels increase risk to government and businesses
A range of government and vendor reports showcase the damage cyberthreats and data breaches are causing to businesses and organisations today.
For example, the Office of the Australian Information Commissioner (OAIC) reported that incidents involving malicious or criminal attacks at organisations covered under the Notifiable Data Breaches scheme rose by a full 41% in July-December 2022.
In addition, the ACSC’s Annual Cyber Threat Report 2022 revealed the average cost per cybercrime report had risen by an average of 14% to over $39,000 for small businesses, $88,000 for medium businesses and over $62,000 for large businesses.
Severe breaches of business or government environments can take months to uncover, prompt regulatory action including heavy fines, and cause severe reputational loss.
These consequences amplify near-term damage such as loss of intellectual property, disruption to operations and financial theft.
The impact of a major breach can extend well beyond a business or organisation to its customers, partners, suppliers and the broader community.
Some of the largest and most publicised recent local data breaches include the exposure of data of current and former customers at Australia’s second-largest telecommunications operator, Optus, and the theft of personal information of Australian and New Zealand customers of financial services provider Latitude.
Internationally, telecommunications provider Verizon’s 2023 Data Breach Investigations Report revealed that costs to businesses of ransomware attacks had soared, with the number of attacks also surging.
In addition, the human element was a factor in 74% of breaches, “even as enterprises continue to safeguard critical infrastructure and increase training on cybersecurity protocols,” Verizon said.
Embracing cybersecurity strategies essential to mitigate risk
In this environment, implementing effective strategies to protect systems, data and people is essential.
The ACSC recommends businesses and organisations implement the Essential Eight risk mitigation strategies as a baseline to make it harder for adversaries to compromise their systems.
Essential Eight strategies are designed primarily to protect Microsoft Windows-based, internet-connected networks. Implementation of the Essential Eight is supported by the Essential Eight Maturity Model., which is based on the ACSC’s experience in addressing cyber security threats.
This model defines four maturity levels that businesses and organisations can achieve to help mitigate attackers’ tradecraft and targeting.
By implementing the Essential Eight to a targeted level of maturity, businesses and organisations can:
- proactively improve their security using fewer resources and less expenditure than would be needed to respond to a large-scale cyber security incident
- gain a high-level indication of their cybersecurity maturity
- adopt strategies and maturity models that are regularly updated by the ACSC to remain contemporary, contestable and actionable against constantly-evolving adversaries, and
- comply with regulatory requirements (for example, the federal government is mandating Essential Eight compliance for all 98 non-corporate Commonwealth entities)
However, implementing and maintaining Essential Eight risk mitigation to a required maturity level can be a complex exercise that diverts technology teams and expertise from core business enablement tasks.
Working with security specialist ESET Australia, businesses and organisations can effectively deploy and run solutions that help implement the Essential Eight.
They can also take advantage of cyber risk audit capabilities that enable them to review and assess their IT infrastructure for potential weaknesses. These audits should be undertaken regularly to account for evolving threats and relevant geopolitical events; for example, according to the ESET SMB Digital Security Sentiment Report, 73% of small to medium businesses admitted the pandemic and conflict in Ukraine had motivated them to increase their cybersecurity investments.
Click here For more information about ESET Australia’s Essential Eight and cyber risk audit offerings.
-1.jpg&w=100&c=1&s=0)
.png&w=100&c=1&s=0)
