Budgetary pressures notwithstanding, spending on cyber-security should be a priority for Australian businesses looking to rebuild in the wake of the COVID crisis
New Year’s is done and dusted, albeit without the customary fanfare and fireworks in some capital cities, and Australian enterprises are back at work.
All signs suggest 2021 will deliver them challenges aplenty. Although a COVID vaccination program is in the offing, uncertain economic and political conditions, at home and abroad, have business leaders casting a weather eye over balance sheets and seeking out savings wherever they can be found.
They’re prudent to do so but one place where it won’t pay to cut costs indiscriminately is in the cyber-security sphere.
Rather, the start of a new year is a good time for your business to review its cyber-security posture, to determine whether it’s adequately prepared for the heightened threat landscape the pandemic has ushered in.
Understanding the risks
That starts with developing an understanding of the ICT risk profile for your industry in general, and your business in particular. It’s impossible to achieve the latter without an enterprise-wide audit of infrastructure, systems and data. Knowing what’s being stored, and where, should help you gauge the likely impact of a significant cyber-attack or data breach.
As part of this process, you should identify the potential cost of overcoming operational disruption and mitigating an incident satisfactorily. For many enterprises, that turns out to be an eye-watering sum – some $7 million in the case of listed property valuation firm Acumentis (formerly Landmark White) which experienced two highly publicised data breaches back in 2019.
The putative size of the damages bill should inform your proposed security spend, as should your industry’s norm – likely to come in at somewhere between six and 14 per cent of the total ICT budget, according to 2019 US research by Deloitte.
The COVID loading
Adding a ‘COVID loading’ may be a prudent move, for some Australian enterprises. It’s no secret that the pandemic has seen threat levels rise, with business coming under sustained fire from hackers and cyber-criminals.
Back in March 2020, the Australian Cyber Security Centre warned of a surge of COVID-19 themed malicious activity targeting both individuals and organisations. Three months later, Prime Minister Scott Morrison made the extraordinary announcement that Australian organisations across multiple sectors, including health, education and utilities, were being targeted by a sophisticated, state-based cyber actor. The government subsequently increased the federal cyber-security spend to $1.664 billion for the upcoming decade and pledged greater assistance for small and medium sized businesses looking to strengthen their high tech defences.
Addressing new vulnerabilities
As a matter of priority, resources should be dedicated to addressing new and emerging threats, as well as the perennials like ransomware that don’t ever go away.
In 2021, spearphishing and credential theft will top the threat list for businesses, as hackers and cyber-criminals continue their quest to log in, rather than break in.
Digital identity solutions, such as sophisticated Multi Factor Authentication, can stop them in their tracks and limit their ability to move around the network, should they happen upon an ‘in’.
Last year’s mass move to remote working also opened up a host of vulnerabilities, for organisations unused to the practice. After shutdowns were announced in March to slow the spread of the virus, many were forced to send employees home on a wing and a prayer, to use inadequately secured mobile devices and home networks to keep operations ticking over.
If this sounds familiar and you’re continuing to pursue a remote or hybrid working model, ramping up your investment in endpoint and user-based defences may serve your enterprise well.
Rebounding and rebuilding – securely
After the devastating impact of the COVID crisis, 2021 should be a year for Australian businesses to rebound and rebuild. A cyber-attack or data breach could set your recovery back significantly and taking steps to ensure you don’t fall victim should be an imperative. When it comes to cyber security spending, it’s no time to scrimp.
