ADITS Managed IT ADITS Managed IT
Call Us 1300 361 984

Category: Cyber Security

7 Tips to Choose the Best Password Manager

Posted on by Wayne Darrell

Remembering unique and complex passwords for countless online accounts can feel like an impossible task. Many users try to avoid that by simply using the same password for everything. However, this is a security risk that can lead to a data breach or a cyberattack.

To avert those, password managers are proven as an effective solution. But with different options on the market, what should you consider when choosing a password manager?

1. Make Unmatched Security Your First Priority

Security must always be paramount. Your password safety solution should be a digital fortress, where all your organisation’s credentials are well protected. These specific features can help you sleep soundly at night:

  • Encryption: Industry-standard encryption is a must. For instance, the AES-256-bit encryption is military-grade technology that scrambles your data into an unreadable format. That makes it virtually impossible for unauthorised persons to access, even if they breach the system.
  • Zero-knowledge architecture: This ensures that only you have access to your passwords. Not even the password manager or your IT manager can see or access your master password or the data stored within your vault.
  • Multi-factor authentication (MFA): MFA adds an extra layer of security by requiring a second verification step beyond just your password, such as a code sent to your phone.

2. Simplicity can Give the Best User-Friendly Experience

Complexity often becomes a barrier for most users, so choose a password manager with a user-friendly interface. This will allow everyone in your organisation to easily create, store, and manage their passwords. Look for features like:

  • Intuitive interface: A clean, well-designed interface can provide clear navigation and better functionality.
  • Cross-platform compatibility: Ensure the password manager works flawlessly across all your team’s devices, from desktops and laptops to mobile phones and tablets.
  • Autofill functionality: Automatic login form filling saves time and is more accurate, reducing typographical errors.

3. Powerful Features can Enhance Password Management

Beyond basic password storage, consider additional features that streamline your organisation’s password management. These may include:

  • Secure password sharing: Allow authorised staff to securely share access to specific accounts without compromising the master password.
  • Password strength reporting: This helps to identify weak passwords within your organisation and encourages strong password creation.
  • Data breach monitoring: You can be alerted if any of your organisation’s login details appear on the dark web, which is a red flag for a data breach.

4. Cost-Effectiveness: Balance Security with Your Budget

Password managers offer a range of pricing options. While free versions exist, they often come with limitations in features and user capacity. When choosing a subscription plan, consider these:

  • Number of users: Choose a plan that accommodates your current and projected team size.
  • Features required: Align your budget with the features you need for optimal password management.
  • Scalability: If your organisation is growing, ensure the password manager offers flexible plans to adjust as your needs evolve.

5. Look for Industry Recognition and Customer Trust

Reputation matters. Opt for a password manager with a proven track record of password safety and reliability. Research awards and endorsements from reputable organisations.

Also read customer reviews and testimonials to gain insights into real-world experiences. This can help you decide on a password management app that aligns with your organisation’s needs.

6. Aim for Ease of Deployment and Ongoing Support

Implementing a new system can pose challenges. Choose a password manager with straightforward deployment procedures and readily available support resources. Ask about:

  • Clear documentation and training materials: User guides and training resources ensure a smooth transition for your team.
  • Dedicated customer support: Access to timely assistance when needed can be invaluable.

7. Test Drive with a Free Trial Before You Commit

Take advantage of free trials to see how the software integrates with your existing workflows and user experience. A hands-on experience can help you determine if the password manager can hack your requirements.

By considering the above tips, you will find the perfect password manager for your business. At ADITS we partner with Keeper, a trusted password management app that ticks all the boxes.

A Better Password Management Experience

Investing in a reliable password manager can greatly reduce the risk of data breaches by protecting your organisation’s sensitive information. It can also bring:

  • Increased efficiency, because automating password management saves time and improves productivity
  • Improved user experience, as employees appreciate the convenience of a smooth and speedy login process
  • Compliance with industry regulations that require sound password management practices, which a password manager can provide
  • Cost reduction, by saving on IT costs from reduced password-related support calls and less potential security incidents

Of course, a password manager is not a magic bullet – but it can mean one less thing to worry about for your digital security. A comprehensive cyber security strategy will also include Managed IT, security controls and IT governance.

To safeguard all your organisation’s digital assets in Brisbane, Townsville, and across Queensland, explore our CyberShield and CyberShield+ solutions for comprehensive cyber security protection.

Explore CyberShield Discover CyberShield +

What Is a Password Manager and Is It Really Safe?

Posted on by Wayne Darrell

How many accounts do you have require using a password?

Think of your email (sometimes multiple addresses), social media (too many channels), productivity platform at work, banking and finance, shopping, streaming, entertainment, gaming, education – the list goes on.

Estimates say that the average person could have dozens to hundreds of accounts. No wonder many people simply use the same password for all of them. That’s a risky practice leaving them vulnerable to cyberattacks, data breaches, and identity theft. However, it’s so much easier than having to remember one password for each of your accounts, right?

There is a safer way: Password managers.

What is a Password Manager?

A password manager is like a personal digital vault. It’s an application that stores your usernames, passwords and sometimes two-factor codes for every account in an encrypted format. It requires a user to remember just one master password to access their vault – you no longer need to recall countless login details for various websites and apps.

Why Use a Password Manager?

Password managers are very convenient and save users a lot of time. As they streamline the login process, the stress and frustration that comes from trying to remember login credentials are removed.

You can also enjoy these benefits from using a password manager:

  • Stronger Passwords: Password manager apps help to generate strong, unique passwords for every account. This reduces the risk of brute-force attacks – a trial-and-error method of trying all possible passwords until the correct one is found.
  • Improved Security: Because password managers do not reuse passwords, you become less vulnerable to data breaches and identity theft. Also, secure password management solutions are aligned with the principles of cyber security services and frameworks.
  • Secure Password Sharing: Some password managers allow users to securely share login credentials with their team, which is safer than sharing plain text passwords.
  • Cross-Platform Compatibility: Most password managers work across different devices, ensuring your login information is always accessible.

How Does a Password Manager Work?

Here’s a simplified breakdown:

  1. Installation: You download and install a password manager app on your computer or mobile device.
  2. Creating an Account: You create an account with the password manager, using a strong and unique master password.
  3. Adding Login Credentials: For each website or application you use, simply add the login details (username and password) to your password manager. For new credentials, the password generator feature available in many password managers comes in handy.
  4. Automatic Login: When you visit a website or app, the password manager can automatically fill in your login credentials, saving you time and effort.
  5. Secure Storage: Your credentials are stored in an encrypted format within the password manager’s vault. This makes it extremely difficult for unauthorised individuals to access your data, even if they were to gain access to your device.

 

Are Password Managers Really Safe to Use?

You may have heard of the LastPass security breaches and wonder ‘Are password managers really secure’? While risk zero doesn’t exist, it is important to note that there was no flaw in the password manager itself. The attackers instead exploited a vulnerability in third-party software and bypassed existing controls.

This should remind us of the importance of strong security measures. Making sure you enforce strict protocols with your vendors and suppliers is as important as password management.

Our CyberShield and CyberShield+ packages have been designed with this approach in mind. Not only they include an enterprise-grade solution that allows seamless integration and management of passwords across the organisation, but they’re also built around managed IT, security controls and governance.

However, it is fair to question that if a breach happened to LastPass, it could happen to any password manager app, so let’s address that by debunking some common misconceptions:

Myth 1: Password managers are not secure.

Reputable password managers are designed to be secure. Advanced encryption technologies make it virtually impossible for hackers to access your data. Many password managers also utilise multi-factor authentication (MFA) for extra security.

Myth 2: If I lose my master password, I lose everything.

Forgetting your master password is inconvenient, but most password managers offer recovery options. It’s essential to follow the provider’s guidelines for setting up recovery methods to avoid losing access to your passwords.

Myth 3: Storing all passwords in one place is risky.

Keys are often placed together in a keyring or a key safe so they’re not scattered around loosely. In a similar way, storing all your passwords in a secure online password manager is safer than managing them manually. Just make sure your password manager enforces strong password generation and prevents password reuse, so that the risk of a data breach impacting multiple accounts is significantly reduced.

Of course, as previously mentioned, there is no risk-free password manager app. The trick is to find the most secure one that adheres to strict security measures and is perfect for your needs. Here are 7 Tips to Choose the Best Password Manager.

Myth 4: Password managers are too complicated to use.

Modern password managers are user-friendly. Many of them offer intuitive interfaces and features that simplify the password management process. For example, Keeper offers a seamless user experience with its autofill browser extension, allowing you to quickly and securely log in to your favourite websites with a single click.

Myth 5: I can remember all my passwords – so I don’t need a password manager.

We can barely remember to bring milk home on our way back from work, so how are we supposed to remember complex, unique passwords for dozens of online accounts? Relying on memory increases the likelihood of using weak or reused passwords, which can be a recipe for disaster.

 

Take Control of Your Digital Security

The importance of password safety is easy to underestimate or overlook. But data breaches are wake-up calls that highlight the need for a reliable password management solution.

With a secure password manager, you can enhance your online security posture and reduce the risk of cyberattacks.

At ADITS, we believe that in Brisbane, Townsville, and beyond, a secure password management solution is non-negotiable to create a robust defence against increasingly sophisticated threats in today’s ever-changing landscape.

FIND OUT MORE

Why the SMB1001 Cyber Security Framework is Making Waves

Posted on by Wayne Darrell

The digital revolution has brought not only fantastic opportunities but also increased the attack surface when it comes to threats. Nearly half of Australian SMBs have already been targeted by cyberattacks with the cost of cybercrime averaging between $46,000 to $97,000 for small and medium sized businesses.

These statistics should serve as a wake-up call, highlighting the urgent need for robust cyber protection!

That’s when cyber security frameworks come in. They provide a structured approach to managing cyber risks, ensuring compliance with industry regulations, and incorporating best practices for IT security.

With the many frameworks available these days, this article will delve into the SMB1001 and look at why it is a game changer for smaller organisations.

 

An Overview of Cyber Security Frameworks

First, it is important to understand that cyber security frameworks provide a common language and methodology for discussing and managing risks. They aim to safeguard your data, systems, and ultimately, your business’ reputation.

Some of the top cyber security frameworks in Australia are ISO 27001, NIST, CIS Controls and the Essential Eight (E8).

The E8 are supported by the Australian Government who developed it through the ACSC back in 2017 to help businesses mitigate cyber threats. While it is not mandatory for private businesses, it is strongly recommended.

After 7 years, we’re able to look back and realise that these traditional frameworks present challenges for smaller organisations that are looking for something less complex, not resource-intensive to implement, and more flexible to suit their needs.

SMB1001: A Clear Path to Cyber Maturity

Dynamic Standards International (DSI) developed SMB1001 to fill the gap in cyber security certification for SMBs.

It addresses the unique challenges faced by SMBs in implementing effective cyber security measures without the complexity and high costs associated with larger, more comprehensive frameworks.

It covers essential security practices across various areas such as incident response, risk management, and employee training, which are often overlooked by simpler frameworks like the Essential Eight.

So, what makes SMB1001 work?

The framework’s certification process is straightforward, practical, and built around five areas of focus:

  • Technology Management – This pillar focuses on managing and securing the technology infrastructure, including hardware, software, and networks. It involves implementing security controls such as firewalls, antivirus software, and intrusion detection systems to protect against cyber threats. Regular updates and patch management are also essential to ensure that all systems are protected against known vulnerabilities.
  • Access Management – This involves controlling and monitoring access to information systems and data. It includes implementing strong authentication mechanisms, such as multi-factor authentication, to ensure that only authorised individuals have access to sensitive information. Access controls should be regularly reviewed and updated to reflect changes in personnel and roles within the organisation.
  • Backup & Recovery – Regular data backups and having a robust recovery plan in place is important. It ensures that data can be restored in the event of a cyber incident, such as a ransomware attack. A well-defined recovery plan helps minimise downtime and ensures business continuity by outlining the steps to be taken to restore systems and data.
  • Policies, Plans, & Procedures – this involves developing and implementing comprehensive cybersecurity policies, plans, and procedures. These documents provide guidelines for the organisation’s security practices and response to cyber threats. They should cover areas such as incident response, data protection, and employee responsibilities. Regular reviews and updates are necessary to ensure that the policies remain effective and relevant.
  • Education & Training – The SMB1001 framework is designed to be clear, concise, and accessible even for those without a deep technical background. This approach can empower your non-technical staff to take ownership of your cyber security posture. Everybody, at all levels, gets the chance to contribute to keeping the organisation protected. The responsibility of cyber security involves the entire organisation:
    • Employees, by following best practices like not opening suspicious emails, using strong passwords, and regularly updating their software.
    • Managers, by allocating resources for cyber security training and tools.
    • Executives, by prioritising cyber security at a strategic level.

SMB1001 vs. The Essential Eight

Both frameworks have the same goal which is to enhance cyber resilience, but SMB1001 provides a more accessible entry point for businesses of all sizes. It also covers more of the key practice areas that support a robust security program.

In the contrary, the E8 requirements are more technical and complex to comprehend, often leaving small business owners confused and not confident enough to continue building out their security posture.

Take Action with a Reliable Partner

ADITS’ cyber security solution, CyberShield, is built around essential security controls outlined by the SMB1001 :23 Silver Tier 2. Take control of your cyber security today – with expert guidance. ADITS can help your business through comprehensive cyber security services in Brisbane and Townsville.

CyberShield Brochure

With data becoming an invaluable asset and stricter rules regarding its protection, we have enhanced our offerings with CyberShield +, an advanced cyber security solution for businesses. It includes everything from CyberShield, plus a cyber security awareness program through uSecure and compliance to the mandatory Privacy Act.

CyberShield+ Brochure

Strategies for Cyber Security, Continuity and Emergency Response in Queensland Critical Infrastructure

Posted on by Wayne Darrell

Every Australian relies every day on energy, food, water, transport, communications, health, and banking and finance services. These essentials support our way of life and underpin our economy, security, and sovereignty. Therefore, disruptions to those critical infrastructures can cause significant, if not disastrous, impacts.

 

Rising Risks to Our Critical Infrastructures

Cyber actors have been targeting critical infrastructures in recent years, like Medibank, Optus, and Latitude. More recently, an unauthorised network access occurred at DP World Australia, compromising employee data. It forced the business to go offline, disrupting their Brisbane, Sydney, Townsville, Melbourne, and Fremantle operations; goods were stranded in ports for around 10 days.

For the FY 2022-23, the Australian Signals Directorate (ASD) noted 143 reports of cyber incidents against critical infrastructure. These were primarily due to compromised accounts/credentials, compromised assets/network/infrastructure, and denial of service (DoS). Meanwhile, the global trend points to an estimated hundredfold increase in attacks on critical infrastructure by 2027.

 

Wanted: A Strong Response Strategy

A response strategy is critical to ensure that your organisation is prepared to deal with cyber incidents effectively. It can help minimise the impact of an attack.

Critical infrastructures are also required to have a formal incident response plan in place as per the regulations they need to comply with such as the Security of Critical Infrastructure Act 2018 (SOCI). This law details the legal obligations for owners and operators of critical infrastructure assets, including notification duties and government support in case of incidents. The Act applies to these sectors.

Queensland for instance has outlined a Cyber Security Hazard Plan to mitigate cyber incidents with state-wide or national impacts, that can lead to a response strategy tailored for your organisation:

  1. Prevention: Understanding and minimising the cyber risks that could impact an organisation, the state, or the nation
  2. Preparedness: Reducing the consequences of an incident and ensuring effective response and recovery
  3. Response: Delivery of appropriate measures to respond to a cyber incident
  4. Recovery: Implementing post-incident strategies for recovering systems and restoring services

The strategy emphasies the need for the collective effort of individuals, community groups and organiations, local governments, businesses, the tertiary sector, the Queensland Government, and the Australian Government. This can be done through the Joint Cyber Security Centres (JCSC), a network to exchange information, collaborate, and share resources.

The ASD, via its Cyber Security Partnership Program, also works closely with businesses and individuals to provide advice and information about the most effective ways to protect their systems and data.

 

Best Practices for Securing Critical Infrastructure

How can you defend your organisation against cyber threats? Here are some best practices for the critical infrastructure sector.

Prevention: Your First Line of Defence
Find a Guiding Framework A robust cyber security framework can help you plot a roadmap for enhancing your protection. At ADITS we follow the SMB1001. It has a clear, step-by-step path and a tiered approach, from essential hygiene practices to a more comprehensive security strategy.
Educate Your Team Empower your staff to be your first line of defence. Train them regularly to equip them for identifying suspicious emails, recognising phishing attempts, and reporting potential threats.
Secure Your Systems Properly set up your digital shield, with firewalls, anti-virus software, data encryption, and strong passwords, which are essential for keeping unwanted visitors out.
Preparedness: Be Ready for Anything
Plan for the Unthinkable Develop a comprehensive cyber incident response plan (CIRP). Outline the roles, responsibilities, and communication protocols in case of an attack. Conduct regular tabletop exercises to test your CIRP. Ensure everyone knows their part.
Stay Informed Stay current on the latest and evolving threats and mitigation strategies. Subscribe to alerts from reputable sources like the ACSC. Knowledge is power – use it to stay ahead of the curve.
Collaboration is Key Build strong relationships with industry peers and government agencies. Sharing information and best practices fosters a collective resilience against cyber threats.
Response: Act Swiftly and Decisively
Early Detection Invest in security monitoring tools to detect suspicious activity promptly. The faster you identify an intrusion, the quicker you can contain the damage and minimise disruption.
Follow Your CIRP Be ready. When an attack hits, follow your CIRP. Ensure everyone communicates clearly while carrying out their well-defined roles. A well-coordinated response will help you mitigate the impact and get your systems back online quickly.
Seek Expert Help Don’t underestimate the value of professional assistance. When faced with a major attack, consider engaging a cyber security services expert to guide your response and recovery efforts.
Recovery: Bounce Back Stronger
Restore Normal Operations Get your critical systems back online as swiftly as possible. Prioritise essential services and have backup and recovery plans in place to ensure minimal disruption.
Learn from the Experience Every incident is a learning opportunity. Conduct a thorough post-incident review to identify weaknesses and improve your defences.
Keep Improving Use lessons learned to continuously ensure your critical infrastructure remains resilient. Consider new technologies and enhance your training and awareness programs.

 

Elevating Security with AI and Advanced Technologies

Artificial intelligence (AI) is now a cornerstone in fortifying cyber security for critical infrastructure. It can swiftly process vast datasets, identify subtle patterns, and adapt to novel threats, providing unparalleled efficiency and continuous learning.

But AI isn’t the only advanced technology enhancing cyber security. Here are a few more:

  • Cloud Encryption, which can ensure data security in cloud-based platforms
  • Extended Detection and Response (XDR), with improved threat detection and incident response capabilities
  • Blockchain technology’s secure data storage capabilities can be leveraged for data integrity and authentication
  • Generative AI (GenAI), which can detect and respond to cyber threats in new ways

 

Your Next Step: Assess Your Risk Factors

With employees being your first line of defence, ensuring continuity and proper emergency response begins with identifying your human risks. ADITS’ free Human Risk Report (HRR) will help you identify domain impersonation threats and released credentials. You will receive a comprehensive report with some actionable tips as well as a free phishing campaign to test your employees’ awareness.

Cyber Security in Education: Protecting Student Data in Australian’s Schools

Posted on by Wayne Darrell

Cyber security for educational institutions is more crucial than ever with the ASD Cyber Threat Report 2022-2023 highlighting the education sector has being one of the prime targets for cyber crimes. Schools must therefore strengthen their security and compliance measures.

The Rising Threat Landscape in Education

In recent years, the education sector has become increasingly susceptible to cyber threats. Australia saw a 51% increase in cyber incidents reported by critical infrastructure organisations, including educational institutions. A Check Point Research study showed a weekly global average of 1,739 attacks per education or research organisation.

With 90% of data breaches due to phishing attacks worldwide, students, teachers, and staff are also often targeted through deceptive messages.

Cyber-attacks on the sector are not random. They are targeted and strategic, driven by the potential rewards and the relatively lower security defences compared to other sectors.

Reason #1: Valuable Data

Educational institutions hold a wealth of sensitive data, including personal information of students, staff, and parents, as well as financial records and intellectual property. This data can be highly valuable for cybercriminals seeking to sell it on the dark web or use it for identity theft.

Reason #2: Diverse User Base

Schools and universities have diverse populations of students, teachers, and staff with varying levels of IT expertise. Some are tech-savvy digital natives while others are still mastering computer basics. Everyone needs training and support to ensure each can confidently and securely collaborate better.

Reason #3: Limited IT Resources

Smaller schools often face resource constraints. Staff must juggle multiple responsibilities, including network maintenance, user support, and security. Tight budgets limit cyber security investment. Some could have aging hardware and limited bandwidth. Schools must therefore explore cost-effective cyber security solutions.

Reason #4: BYOD Risks

Bring your own device (BYOD) allows students and staff to use personal devices for learning, but also present security risks:

  • Personal devices may lack proper security measures.
  • Sensitive information can leak if devices are compromised.
  • Infected devices can spread malware within the school network.

Schools can manage BYOD risks by:

  1. Establishing clear policies and guidelines for acceptable device usage
  2. Implementing network segmentation, isolating BYOD devices from critical systems
  3. Adopting mobile device management (MDM) solutions to enforce security policies
  4. Enforcing regular audits to assess compliance and address vulnerabilities

Impact on the Sector

Successful attacks disrupt operations and put student data, including personal and academic records, at risk. This undermines privacy and trust, leading to potential identity theft, financial fraud, and emotional distress.

Technological Innovation in Education

The rapid shift to digital learning environments, especially during the COVID-19 pandemic, has increased the attack surface for cybercriminals. With more devices connected to school networks and the use of various online platforms, there are more opportunities for vulnerabilities making cyber security solutions an all-time priority.

Remote Learning Platforms

Online learning platforms have bridged geographical and time boundaries. Students in any location now have access to the same kind of education. There are live online sessions, shared cloud resources, and virtual interaction. Platforms like Microsoft Teams for Education are boosting collaboration and engagement.

Digital Learning Tools

The sector has also benefitted from the proliferation of digital tools. Interactive whiteboards are replacing traditional chalkboards, allowing dynamic lessons and easier understanding of complex concepts.

Adaptive learning software enable personalised learning pathways. They can analyse student performance and adjust content accordingly. Virtual reality (VR) and augmented reality (AR) are also transporting students beyond textbooks.

Increased Reliance on Technology

Technology has become integral to the educational journey. Laptops, tablets, and Wi-Fi are now lifelines for learning. Teachers are harnessing digital tools to create more engaging content and enhance teaching methodologies.

Educators have shifted from traditional lectures to student-centred learning – facilitating discussions, encouraging critical thinking, and guiding students. Students are empowered by technology to collaborate, create, and explore.

Australian Laws and Regulations

As schools chart a course toward safer digital horizons, they must also comply with relevant regulations.

The Privacy Act 1988

The Privacy Act covers private schools, except those that fall within the small business exemption or do not provide health services (e.g., physical education classes, nursing services). The Australian Privacy Principles (APPs) prescribe how schools must:

  • Have data privacy procedures, practices, and systems to ensure compliance
  • Handle personal data transparently, ensuring consent, accuracy, and security
  • Demonstrate accountability by promptly addressing queries and complaints

Apart from the Australian Capital Territory (ACT), government schools are not directly covered by the Privacy Act. They fall under state or territory privacy legislation or schemes. In Queensland, for example, the transfer of personal information between schools without consent is allowed before enrolment in a new school.

The Australian Education Act 2013

The Australian Education Act governs Commonwealth funding to both government and non-government schools. It specifies specific requirements to receive Australian Government funding for school education, covering student data protection, educational reforms, and financial accountability. Schools are required to manage student data prudently and proactively while fulfilling their educational mission.

Best Practices for Cyber Security in Schools

Safeguarding digital learning environments is highly important today. Educators are responsible for protecting their students, staff, and sensitive data from cyber threats. Below are some best practices:

Password Hygiene

Educate students, teachers, and administrators – everyone in your school community — to create strong, unique passwords.

  • Combine uppercase and lowercase letters, numbers, and special characters
  • Never reveal a password to anybody
  • Encourage regular password updates or implement a password expiration policy

Data Encryption

All sensitive information (e.g., student records, financial data, and research findings), must be encrypted. Encryption ensures that even if data falls into the wrong hands, it remains unreadable. Consult with your IT provider about the different industry-standard encryption methods such as Transport Layer Security (TLS), Full Disk Encryption (FDE) and File-Level Encryption.

Incident Response Plan

Swift action is crucial when a breach occurs. Handling security incidents starts with preparing a well-defined incident response plan, which should include:

  • Designated Incident Response Team: Identify key personnel responsible for handling incidents.
  • Communication Protocol: Establish clear lines of communication during an incident.
  • Containment and Recovery Steps: Consult with your IT support team to outline the steps to isolate the breach and restore normal operations in your school.
  • Legal and Reporting Obligations: Understand our legal responsibilities and reporting requirements.

These best practices can help schools in Brisbane, Townsville, and across Queensland become more cyber resilient. Remember, it’s not just about implementing the right technology but also about fostering a culture of vigilance and shared responsibility among staff and students.

Cyber Security Training for Education Sector Leaders

If you’re not sure where to start with fostering a cyber aware culture in your school or university, ADITS conducts tailored cyber security training sessions for boards and school executives. Kindly fill up the form below:

The ROI of Managed Security Services: How Investing in Cyber Security Pays Off

Posted on by Wayne Darrell

You are aware of the risks posed by cyber threats to your business. You know the potential devastation a cyber attack can cause. You’re convinced that cyber security measures can protect you against cyber threats. But how do you know it’s working?  

Let’s delve into the tangible benefits of managed security services (MSS), demystify the return on investment (ROI) calculation, and guide you toward making informed choices for your cyber security strategy.  

Ready? Click any topic below or simply read on: 

Understanding the Cost of Cyber Attacks

Before we explore the ROI, let’s tackle the cost of cyber-attacks. Beyond the immediate financial hit, cyber incidents disrupt operations, erode customer trust, and tarnish reputations.  

From legal fees and regulatory fines to lost productivity and brand damage, the impact is far-reaching. But what if there were a way to mitigate these risks and turn the tide in your favour? 

Calculating the ROI

ROI is the litmus test for any business investment. The simple financial equation is: 

ROI = (Gain from investment – Cost of investment) / Cost of investment 

Gains from investment includes cost savings from avoided breaches, reduced downtime, and streamlined operations, while Cost of Investment is the price of your MSS solution.  

Your Gains from Investment: The Hidden Savings

When evaluating your ROI, you need to consider the following scenarios. 

Avoided Breaches 

Every thwarted cyber-attack translates to saved dollars. In Australia the cost of a data breach has significantly grown since 2018, now reaching AUD $4.03 million according to IBM’s report. 

MSS providers fortify your defences, minimising the chances of a breach. Imagine the financial relief when you sidestep a costly incident. 

Reduced Downtime 

Downtime is the nemesis of productivity. With MSS, rapid incident response and proactive threat hunting keep your systems running. The longer your business stays operational, the greater the ROI. 

Staffing Cost Savings 

Outsourcing security tasks to a third-party provider trims your payroll. Instead of maintaining an in-house security team, you can redirect those funds to growth initiatives. 

Enhanced Productivity and Business Continuity 

Your staff can channel their energy into strategic endeavours rather than firefighting and monitoring. The ripple effect? Enhanced productivity and a smoother operational flow. 

A Managed Security Provider can also help to ensure your business stays compliant with laws and regulations. Reducing your risks of attacks and hefty fines. 

Peace of Mind 

It could prove difficult to pin a price on this one. When your systems are secure, your team can focus on what matters — innovation, client service, and growth. Imagine the peace of mind knowing that your data is shielded, your operations are resilient, and your reputation remains intact. 

Quantifiable Metrics for ROI Evaluation

How do you measure the success of your investment? To gauge the effectiveness of your MSS investment, you can track the key metrics below. 

Incident Response Time 

How swiftly does your provider react to threats? A rapid response is critical to minimising the impact of security incidents. The shorter the response time, the faster threats can be contained and mitigated. 

Metrics to track: 

  • Time to Detection: How quickly the MSS detects an incident after it occurs. 
  • Time to Notification: The time taken to notify your organisation about the incident. 
  • Time to Containment: The duration from detection to isolating or stopping the threat. 

You could compare your provider’s response time against industry standards or best practices. 

Dwell Time 

How long do threats linger undetected? Longer dwell times increase the risk of data breaches and allow attackers to move laterally within your network. 

Metrics to monitor: 

  • Average Dwell Time: Calculate the average time threats persist before detection. 
  • Maximum Dwell Time: Identify the longest duration a threat remained undetected. 

You can implement proactive monitoring and threat hunting to reduce dwell time. 

Mean Time to Recovery (MTTR) 

How quickly can you bounce back from a cyber incident? Reducing MTTR minimises business disruption and financial losses. 

Recovery components: 

  • Detection to Recovery: The time from identifying an incident to restoring normal operations. 
  • Investigation and Remediation: The duration spent investigating, analysing, and applying fixes. 

You can benchmark your MTTR against industry averages or your own historical data. 

The above metrics provide a tangible yardstick for evaluating ROI. Remember, it’s not just about dollars saved; it’s about resilience gained. 

Selecting Your MSS Provider

Selecting the right MSS partner is critical, whether you’re in Queensland or elsewhere in Australia. Overall, you must look for: 

  • Local Expertise: Cyber security services in Brisbane and Townsville should understand the unique challenges faced by Queensland organisations.
  • Custom Solutions: One size doesn’t fit all. Seek providers who tailor their offerings to your specific needs and industry.
  • Proven Track Record: Investigate their success stories. Have they safeguarded businesses like yours?

Managed Security Services: An Investment, Not an Expense

When you consider cyber security solutions, keep in mind that MSS isn’t an expense but an investment. For every investment, boards and business officials need to consider a variety of factors. This is what we go through during our half-day training session. 

Board members and executives can feel empower to protect their organisation effectively with this tailored training program aiming at: 

  • Understanding the gap between current efforts and where your organisation needs to be 
  • Discharging your responsibility 
  • Knowing how to grow a cyber skilled workforce 
  • Meeting current and future regulation and legislation 

Register today for our Board & Executive level Cyber Security training. Let’s turn the tables on cyber threats and build a resilient future together!

Book Your Seat Now

Cyber Security Compliance Feeling Overwhelming? A Straight-Up Guide for Australian SMBs in 2026

Posted on by Wayne Darrell

It’s Friday afternoon, and as you’re nearing the door an email lands from the enterprise client you have been chasing for three months. They want confirmation your business is cyber security compliant before they sign.  

You open a new tab. Type “cyber security compliance Australia” and somewhere between the fourth link and the time you sat back down at your desk, you realise you’re not getting a straight answer tonight. 

Monday is going to be interesting. 

The rules for Australian businesses have changed a lot in the past two years. The Privacy Act has been amended, the SMB1001 updated, and new obligations have arrived with very little fanfare or explanation. 

This article will not bury you in legislation. What it will do is tell you what actually applies to your business in 2026, where most Queensland SMBs are falling short, and the people fixing it every day want you to know. 

What Are the Key Cyber Security Laws and Standards Australian Businesses Must Know in 2026?

The Privacy Act, the SMB1001, and, depending on your industry, a handful of sector-specific frameworks. The honest answer is that the rules have shifted since most existing guides were written. Several obligations that were once optional are now either mandatory or expected by regulators and clients.

The 2024-2026 Privacy Act amendments increased maximum penalties for serious breaches to $50 million. SMB1001 emerged as the practical entry point, bridging SMBs into cyber maturity.

“A lot of clients assume that because they have an IT provider, their current costs cover everything. Compliance is a separate conversation — and most businesses don’t realise that until we bring it up.”

Belinda Miller: Senior Account Manager

For most Queensland SMBs, the starting point is working out which obligations are universal and which are sector-specific. The table below covers both. Our cyber security services team can help you work out exactly which rows apply to your business.

What Cross-Sector Security Regulations Apply to Every Australian Business?

Find your industry, read the laws, and understand your compliance obligations.

  • Applies to Healthcare

    My Health Records Act 2012
    If your practice connects to MHR, you have strict obligations around who can access records and what you must report if something goes wrong.

    Health Services Act 1991 (Qld)
    Queensland-specific legislation covering health information handling. Applies to private practices, allied health, and any provider collecting patient data in Queensland.

    Australian Digital Health Agency Guidelines (2026)
    Practical guidance on secure digital health practices. Covers data storage, telehealth security, and system integration standards your IT environment needs to meet.

  • Applies to Not For Profit

    ACNC Regulations
    Charities registered with the ACNC must meet governance standards that include responsible handling of data and IT systems.

    Privacy Act obligations for charities
    Many NFPs assume the Privacy Act does not apply to them. It does — if your annual turnover exceeds $3 million, or if you handle health information or provide services under a Commonwealth contract.

  • Applies to Professional Services

    Corporations Act 2001
    Directors have a duty to protect company information and assets. If a cyber incident results from inadequate controls, directors can face personal liability. Compliance is not just an IT issue — it is a governance one.

    APRA CPS 234
    If you supply services to financial institutions, your clients will look closely at your cyber security setup under their own APRA obligations.

    APRA CPG 234 Guidelines (2023)
    Defines what adequate information security looks like for financial sector supply chains. Relevant if you are in IT, legal, accounting, or consulting and serving financial clients.

  • Applies to Education

    Australian Education Act 2013
    Covers data responsibilities of schools and education providers receiving Commonwealth funding. Includes obligations around student records and reporting requirements.

    Student privacy obligations (2026)
    Schools and education providers have obligations under both the Privacy Act and state-level legislation to protect student records, restrict access, and report breaches.

  • Applies to All Businesses

    Privacy Act 1988 (amended 2024–2026)
    If you collect, store, or use personal information — names, emails, payment details — you must handle it securely, keep it accurate, and tell people how you use it. A breach now carries penalties up to $50 million for serious or repeated violations.

    SMB1001 Cyber Security Standard
    A practical, tiered cybersecurity framework designed specifically for small and medium businesses. It provides a clear pathway from foundational controls to advanced resilience, with Bronze as a starting point and higher tiers demonstrating increasing maturity and external assurance. Think of it as a scalable roadmap for building and proving your cyber security posture.

    Australian Cyber Security Strategy 2023–2030
    The federal government’s long-term plan for national cyber resilience. It signals where regulation is heading and shapes the frameworks your business will need to meet over the next several years.

    ISO/IEC 27001:2022
    The international standard for information security management. Not legally required, but increasingly expected by enterprise clients, insurers, and government suppliers.

    Surveillance Legislation Amendment Act 2021
    Governs how your business can monitor networks and devices, including your own employees. Doing it without proper authority can expose you to legal risk.

Is My 2024 Cyber Security Compliance Review Still Current?

Probably not. The Privacy Act amendments and the SMB1001 both changed what adequate looks like, and most reviews completed before mid-2024 do not account for either. 

If you completed a compliance review before mid-2024, here is what to check first. 

The Privacy Act penalty increase means your data breach response plan needs reviewing. The maximum penalty for serious or repeated breaches is now $50 million. If your current plan was written before the 2024 amendments, it was written for a different risk environment. 

SMB1001 has rapidly evolved, with updated tiers and clearer expectations around what “good” looks like at each level. Some businesses that previously considered themselves covered at a foundational level may now have gaps without realising it. If your last assessment was pre‑2024, it is worth revisiting your position and confirming where you sit today. Compliance is not a certificate you hang on the wall.  

It has an expiry date. 

“The biggest practical impact is that you can’t get away with being informal anymore. You can’t just say ‘We take cyber security seriously’ unless you have the evidence to show for it.”

Grant Sheridan: Sales Manager

What Are The Most Common Cyber Security Compliance Mistakes Australian SMBs Make? 

The pattern is rarely negligence. It is reactive compliance. Businesses that respond to an audit, a client request, or a near miss, rather than building it into how they operate day to day. Here are the five mistakes that cost Queensland SMBs the most. 

Treating Compliance as a One-off Project. It is not. Regulations change, your business changes, and your setup needs to keep up. Set a review date. Annually at a minimum. 

Assuming the Privacy Act Does Not Apply to You. If you collect names, emails, or payment details, it applies to you. The small business exemption has been significantly narrowed under the 2024 amendments. 

Confusing Compliance with Cyber Security. Ticking the compliance boxes means you have met the legal minimum. It does not mean your business is secure. The lock on your front door meets building code, but that does not mean it will stop someone who really wants in. 

Keeping Poor Records. If you cannot show your compliance, you cannot prove it. Documentation is your evidence trail for regulators, clients and insurers. 

No Incident Response Plan. When something goes wrong, and statistically something will, the first ten minutes matter. Not knowing who to call or where your data lives is a compliance failure as much as a security one. 

“The most common gap we see is that what’s implemented isn’t checked and is half done. MFA is enabled, but frontline workers don’t have it. Cyber security training exists, but it’s ad hoc. ‘Set and forget’ does not exist.”

Grant Sheridan: Sales Manager

Am I Treating Compliance and Cyber Security as the Same Thing? 

Yes. And it’s an easy trap to fall into. Compliance tells you what the foundation is. Cyber security is what you build above it. 

Meeting your obligations under the Privacy Act and the SMB1001 gives you a solid foundation. But compliance frameworks are written to be achievable across many different types of businesses. They cannot anticipate every threat specific to your industry, your systems or your team. A business that is fully compliant on paper but has not trained its staff to spot a phishing email is still one click away from a serious incident. 

Compliance is the building inspection. Cyber security is everything you do to make sure the building stays standing after you move in. 

What Happens If I Ignore Cyber Security Compliance in 2026? 

The consequences are real, and regulators are paying attention. Penalties under the Privacy Act now reach $50 million for serious or repeated breaches. The OAIC has been investigating more complaints year on year. 

On the commercial side, more enterprise clients and government agencies now ask suppliers to show they take cyber security seriously before signing contracts. If your clients are asking questions you cannot answer, that is a business problem as much as a compliance one. 

And then there is the reputational damage. That one takes longer to show up and longer to fix than any fine. 

What Is Your Step-by-Step Roadmap to Cyber Security Compliance in 2026? 

It’s Monday already, and that email is still sitting in your inbox. The good news is you don’t need to solve all of it today, but you need to know where to start.  

Most Queensland SMBs do not need a 12-month project. They need a starting point and a process that does not fall apart when someone is on leave. Here is a three-step roadmap that works for businesses without a dedicated compliance team. 

Step 1: How Do I Assess My Cyber Security Risks? 

“The first thing I look at is what cyber security training is being provided to all employees and how often. It is rare to find a business that provides mandatory, consistent training and that is deeply concerning. Your business is only as strong as its weakest link, and most of the time that entry point is your people.”

Belinda Miller: Senior Account Manager

Before you can comply with anything, you need to know what data you hold, where it lives, who can access it, and what happens to your business if it disappears. That is your risk assessment. It does not need to take a month. 

Start with four questions: 

Step 1: How Do I Assess My Cyber Security Risks? 

  • What customer data do we collect and store? 
  • Who has access to our systems, and does everyone who has access actually need it? 
  • What would happen to the business if we lost access to our data for 48hours? 
  • Have we had any incidents, phishing attempts, unusual logins, suspicious emails, in the past six months? 

The answers tell you where the gaps are. The SMB1001 Cybersecurity Standard is a useful reference for benchmarking where you sit right now. 

Step 2: How Do I Build a Compliance Plan That Actually Gets Used? 

Build a plan that is actually executable. Not a 40-page policy document that lives in a folder no one opens. It should cover which regulations apply, what controls you need to put in place, who owns each one, and when you will need to review them. And actually put a date on the review. 

Step 3: What Do I Do When Something Goes Wrong? 

Having a plan before something happens is the difference between a contained incident and a costly one. When an attack or breach occurs, the first ten minutes matter more than most business owners realise. 

Make sure your team knows what to do. Cyber security awareness training should be a part of onboarding and repeated annually. Document everything as you go. Not because auditors love paperwork, but because documentation is how you prove compliance, recover faster, and learn from what went wrong. 

When an incident does occur, your first call is to the ACSC ReportCyber platform or their hotline 1300 CYBER1. If personal data has been compromised, you must also notify the Office of the Australian Information Commissioner and the affected individual. In Queensland, report to the Office of the Information Commissioner as well. 

Review what happened, document it, and use it to update your compliance plan. Every incident is information. The businesses that handle breaches best are the ones that treated the plan as a living document rather than a one-off exercise. 

Quick Compliance AuditAnswer These Before You Do Anything Else

If you answer no to more than two questions, it is time for a review.

  • Do you know what personal data your business collects and where it is stored?
  • Have you reviewed your Privacy Act Obligations since the 2024 amendments?
  • Does your team know what to do if they receive a suspicious email?
  • Do you have a documented incident response plan?
  • Do you know who has access to your systems right now?
  • Do you have records that show your compliance over time?

The ADITS CyberShield Guide is a good place to start if you have just exposed your gap.

Where Do You Start?

“Doing everything at once can be quite overwhelming. Implementing quick wins will reduce the immediate risk and build a plan to go deeper. You’re not alone — and coming forward is always the right first step.”

Grant Sheridan: Sales Manager

That Friday afternoon email was doing you a favour. Most businesses don’t look at this until something forces them to. But you just got a head start. A window into what the people fixing it every day actually see. 

Cyber security compliance in 2026 is not simple, but it is manageable. The businesses that struggle most are the ones that try to fix everything all at once. The ones that make real progress pick the most urgent gap and start there. 

If you are not sure where your business sits, the ADITS CyberShield Guide is a practical starting point. Or if you would rather talk it through with someone who knows the Queensland market, our cyber security team is here. 

The Human Element of Cyber Security: How Critical is Cyber Awareness Training?

Posted on by Wayne Darrell

Technology is now woven into our lives and our work. We are connected from the moment we wake up and check our smartphones, to the late-night emails we send.  

But the cyber landscape is full of both opportunities and risks, with human error being the Achilles’ heel that often exposes us to threats. 

 

The First Line of Defence is You 

Picture this: A well-intentioned employee at a regional health clinic receives an email. A simple invoice reminder from what she thinks is a trusted supplier, nothing alarming. But the email contains a link that says “Click to review your invoice”. Little does she know that the link is in fact malicious and that she’s about to open the gate to cyber criminals. Patient records are now held hostage, and chaos ensues. 

This is a typical scenario. The chilling reality is that it can happen to you or any of your employees. Human errors in cyber security are the leading cause of data breaches. In fact, a staggering 

96% of data breaches were caused by or involved human error. 

 

How Cyber Defences Fail Through Human Error 

Whether it’s a weak password or a momentary lapse in judgment, our actions can shape the destiny of our digital infrastructure. How can human error open the gates to cyber threats? 

Passivity: In the most successful attacks, threat actors take advantage of people’s tendency to become complacent or careless, particularly when performing routine tasks. Attackers are always just waiting to jump at the slightest opportunity. In the infamous Equifax data breach, despite receiving a notice about a vulnerability, Equifax’s IT security team failed to patch it promptly. An expired digital certificate further compounded the issue, granting attackers access to sensitive information. 

Poor Password Hygiene: Passwords are our first line of defence, but they can also become our weakest link. Employees who use the same weak password across all of their different apps and platforms will increase the business’ vulnerability to breaches. Once attackers gain access to one of your accounts, nothing is stopping them to access sensitive information.  

Misconfigured Systems: Just like any other business function, IT is an expertise. Don’t let misconfigured systems be exploited by threat actors. You can run regular security assessments and configuration audits to identify your risks.  

Social Engineering: Cybercriminals prey on our trust and curiosity. Your employees could get manipulated into divulging sensitive information outside of the office.   

As we navigate the state of cyber security nowadays, we all have these real-world examples of data breaches in mind such as Latitude, Medibank, Nissan and many more. Australian businesses must fortify their defences and this will be made possible by the empowerment of their employees – and it’s not as difficult as some think. 

 

How Cyber Security Training Can Strengthen Your Defences 

Cyber security awareness training plays a pivotal role in safeguarding businesses against the ever-evolving landscape of cyber threats. Let’s delve into the significance of such training, explore its key components, and highlight real-world examples of businesses that have successfully fortified their defences through employee education. 

The Importance of Cyber Awareness Training 

Cyber security awareness training equips employees with the knowledge and skills needed to recognise threats, mitigate risks, and protect sensitive data. Why does it matter? 

  • Human-Centric Approach: By educating employees, we transform them into a human firewall, strengthening the organisation’s security posture.
  • Cost-Effective: Effective training reduces the security cost per employee by 52%. Investing in awareness programs not only strengthens security but also saves resources.
  • Compliance and Reputation: Demonstrating commitment to cyber security education builds trust among stakeholders, customers, and employees. It also ensures compliance with regulatory requirements. 

Key Components of Cyber Security Training 

What should your training program cover? 

  • Phishing Awareness 
  • Password Hygiene 
  • Safe Browsing and Social Engineering 
  • Mobile Device Security 
  • Data Protection and Privacy 

three-employees-doing-training-2026

 

Creating an Effective Cyber Security Training Program 

Here are some tips about how you can make your training more effective.

1. Assess Your Needs

The best training for your organisation is the one that’s tailored to your needs and the specific risks you face. How do you assess your cyber awareness training needs? 

  • Access Rights: Identify employees’ roles and responsibilities. Tailor your training based on their access levels (i.e., privileged vs. nonprivileged accounts).
  • Legal Obligations: Educate your staff about handling sensitive information and data privacy best practices.
  • Threat Landscape: Understand potential threats specific to your industry and organisation. Address these risks in the training content.
  • Response Preparedness: Train employees on the appropriate actions to take during a cyber security incident. Define incident response procedures clearly.

2. Engage Your Leadership Team

Obtain buy-in from top management. Clearly articulate the impact of cyber security on business continuity, reputation, and financial stability. Demonstrate the return on investment (ROI) from reduced security incidents and improved compliance. Present concise, data-driven briefings to top management. 

The support of your leadership team encourages employee participation. When leaders actively participate and lead the training efforts, employees will follow. Leaders should therefore always grab the chance to emphasise the significance of security awareness. Make sure you provide necessary resources for effective training implementation to support your words with action.

3. Make Learning Interactive

When it comes to cyber awareness training, interactive learning is a game-changer. It can transform passive listeners into active defenders. How can you do that in practical terms? 

Customisable Content 

Offer training that caters to various skill levels. Not everyone starts at the same point. Then, customise content based on roles and responsibilities within the organisation. 

Short, Engaging Formats 

Regular quizzes keep employees on their toes. Questions related to phishing, password security, and safe browsing reinforce learning. Also, use short videos with relatable scenarios. For example, a simulated phishing email and how to spot red flags. Visual storytelling is highly effective in capturing attention as well. Animated characters facing cyber threats resonate better than plain text. 

Real-World Scenarios 

Context always matters. Relate training to everyday situations. Use relevant case studies from other companies when available and share real incidents where employees’ actions impacted security. Learning from others’ mistakes is powerful. 

Feedback and Ratings 

After quizzes or simulations, provide instant feedback. Reinforce correct behaviours. Also, let employees rate the training. Their input can help improve future sessions. 

4. Provide Regular Updates

Cyber threats keep evolving, and so should your training. Keep your content current and relevant. 

Regularly share cyber security tips, recent threats, and success stories via newsletters or similar form of communications. Display posters and visual reminders in common areas. Maintain an accessible online repository of training materials.

5. Opt for Ongoing Training

Regular cyber security training is essential for maintaining a vigilant and security-conscious workforce. Instead of running one annual workshop for half a day, that everyone will forget about really quickly, implement 10-minute monthly programs that employees can do whenever it is convenient to them.  

Make cyber awareness training an ongoing journey. 

There are ways you can make your training fun and engaging in order to break the monotony as we highlight it in one of our previous articles. 

 

Cyber Awareness Training: Guiding Employees Through to Resilience 

Cyber security training is not a luxury; it’s a necessity. By investing in employee education, businesses can build resilient defences, protect sensitive data, and stay ahead of the curve. Remember, a well-informed workforce is your strongest line of defence. 

Training should integrate with your overall cyber security strategy and we can help you with that. You can review our CyberShield approach, a comprehensive cyber security solution for Brisbane and Townsville businesses.  

Together with managed IT, essential security controls, compliance measures, and cyber security services in Townsville, Brisbane, or surrounding areas, we can converge to form your impenetrable shield.  

Top Cyber Threats in 2025 and How to Defend Your Business

Posted on by Wayne Darrell

Cyber threats in 2025 are more advanced, more frequent, and increasingly powered by artificial intelligence. From ransomware double extortion attacks to AI-generated phishing scams, businesses now face a threat landscape that evolves as fast as technology itself. No organisation—regardless of size or industry—is immune.

Key risks include ransomware that both encrypts and steals data, vulnerable Internet of Things (IoT) devices, supply chain attacks targeting vendors, state-sponsored campaigns fuelled by geopolitical tensions, AI-powered phishing and deepfakes, and the growing influence of quantum computing.

The good news? Businesses can stay ahead with the right strategy. This means investing in proactive cyber security measures such as staff training, multi-factor authentication, zero-trust frameworks, and quantum-resistant encryption planning. By working with a trusted cyber security partner, organisations can detect threats early, minimise downtime, and defend their most valuable assets.

 

laptop-ransomware

1. Ransomware Double Extortion

Ransomware is a form of malware that infects your IT systems and encrypts your data. You will only get your access back once you pay a ransom. After you do so, the cyber criminal should release your data, but there is no guarantee that things will go back to business as usual.  

Ransomware are not new. The double extortion steps are. The attackers will not only encrypt the victim’s data, but they will also steal it and threaten to release it publicly unless you pay another ransom.  

On the 2nd of January 2024, the Court Services Victoria (CSV) reported that Victoria’s court system had been hit by ransomware. The attack affected recordings of hearings in County Court cases, the Supreme Court, and the Magistrates Court. “It’s a double extortion approach. They take the data out and then encrypt it. If you don’t pay, they leak your data, and you will never access it,” noted Robert Potter of Internet 2.0.  

How to defend against ransomware in 2025:

  • Have a strong backup and disaster recovery plan in place so you can restore your data without paying the ransom.  
  • Keep your computer updated with the latest security patches 
  • Use strong passwords (via a password manager or passkeys) and multi-factor authentication.
  • Master email security by avoiding clicking on suspicious links or downloading attachments from unknown sources  
  • In case you’re a victim of a ransomware attack, immediately isolate the affected systems and power them down to prevent further damage. Then, get help from a cyber security solutions provider to chase the bad actors out of your systems and try to recover as much of your data as possible. But remember IT specialists are not magicians; without strong recovery measures in place, there isn’t much they can do about that!  

 

network-icon

2. Internet of Things (IoT) Devices

The Internet of Things (IoT) is the network of devices that can communicate and exchange data online. IoT devices can include smart appliances, sensors, cameras, wearable technology, and more. 

Because IoT devices can help with efficiency, productivity, and customer satisfaction, they will become even more prevalent this year. The Australian government estimates 21 billion IoT devices by 2030. However, these can pose a threat to businesses. IoT devices are often not very secure and can be easily hacked, so attackers can use them to gain access to the target’s network.  

The most recent available data from Check Point Research showed an average of nearly 60 IoT attacks per week per organisation. The most affected region was Europe, followed by APAC. One of the most affected sectors is Education & Research. 

To defend against IoT attacks, organisations should follow these best practices: 

  • Purchase IoT devices from brands that prioritise security. 
  • Secure your IoT devices with complex passwords, multi-factor authentication (MFA), encryption, and firewalls. 
  • Update your IoT devices regularly with the latest software and firmware patches. 
  • Use separate networks for IT and for IoT. 
  • Monitor your IoT devices for any suspicious or abnormal activity. 
  • Educate your staff and customers about the risks and responsibilities of using IoT devices. 
  • Implement a comprehensive IoT security strategy for your business and a zero-trust policy for connected devices.

 

3-boxes

3. Supply Chain Attacks

In 2025, attackers know businesses are only as strong as their weakest vendor. A supply chain attack targets the software, hardware, or services used by an organisation or its suppliers. Attackers will often target the weakest link in the supply chain, which can be a third-party vendor. After gaining access through the supply chain, the attackers will then move laterally to the target’s network.  

A memorable supply chain attack happened back in 2021 when cybercrime group, Revil, targeted businesses by exploiting a vulnerability in their Kaseya software platform. The attackers demanded ransoms of up to $7 million. Such attacks will increase this year due to the complexity of global supply chains, the reliance on third-party suppliers and the sophistication of cyber attackers with the widespread use of generative AI tools. 

Your business can reinforce its defences against supply chain attacks via these measures: 

  • Conduct regular risk assessments and audits of your suppliers and partners, verifying their security practices and compliance standards 
  • Implement robust security controls and policies for your systems and networks, ensuring they are updated and patched regularly* 
  • Train your staff and stakeholders on how to recognise and report suspicious or malicious activities or communications 
  • Establish clear communication channels and protocols with your suppliers and partners, so you can verify their identity and authenticity before transacting or sharing any sensitive information 
  • Develop contingency plans and backup strategies for your supply chain operations, testing them periodically 

*Ask your cyber security services Brisbane consultant or cyber security solutions Townsville provider for guidance.

 

government-office

4. State-Sponsored Attacks (SSA)

State-sponsored attacks are not just a big-business or government problem anymore. In 2025, geopolitical tensions have supercharged these attacks, targeting businesses in critical industries like healthcare, energy, and finance.

State-sponsored hackers use deepfake audio, video, and emails to impersonate executives, employees, or government officials, tricking victims into handing over sensitive information or system access.

Government entities and critical infrastructures must take proactive steps for protection against SSA, such as: 

  • Implement a robust and tailored cyber security strategy that covers all specific aspects of your network, systems, data, and people 
  • Monitor your network for any signs of intrusion or compromise, and respond quickly to any incidents 
  • Collaborate with industry associations and other government agencies to share information and best practices on SSA prevention and mitigation

 

5. AI-Generated Phishing & Deepfakes

This is the newest threat in 2025, and it’s spreading fast. Attackers now use AI to create emails, voice calls, and even live video feeds that look and sound real.

Imagine receiving a video call from your “CEO” instructing you to wire funds, but it’s actually a deepfake attack. Or getting a phishing email that perfectly mimics your supplier’s style and tone.

How to defend against AI phishing:

  • Educate staff about AI scams and deepfake red flags.
  • Implement MFA beyond SMS (use authenticator apps or hardware keys).
  • Introduce internal verification processes for financial or sensitive requests.
  • Use AI-driven security tools that can detect anomalies.

 

quantum-computing

6. Quantum Computing

While practical quantum computing could still be a few years away, significant developments are happening. As quantum computers are able to perform tasks much faster than classical computers, it can be both good and bad for cyber security.  

Quantum computing could improve cryptography and create more secure communication channels. But quantum computers can also pose a serious threat to cyber security solutions: They can break some of the current encryption methods that protect data and communications. 

Further developments in quantum computing in 2025 could include the following: 

  • Cyber actors are collecting encrypted data now (so they can crack it open when quantum computing allows them to do so) 
  • Continued investment and research in developing quantum computers by both governments and private companies 
  • Increased interest in using quantum computers for artificial intelligence, machine learning, optimisation and simulation, cryptography, chemistry, physics, biology, medicine, and finance 

To prepare for quantum computing, monitor its developments and trends, and start exploring quantum-resistant encryption methods that would be hard for both classical and quantum computers to solve.  

You’re Only As Strong As Your Weakest Link

Considering human error is the leading cause of cyber security incidents, you can start preparing for all these cyber threats by understanding your human risk areas. 

ADITS offer a free Human Risk Report to all businesses in Brisbane, Townsville and surrounding areas.

This solution will: 

  • Scan your domain and employees’ email addresses on the dark web 
  • Test your staff against a phishing attack 
  • Give you a security score and the timeframe of your future data breach 
  • Provide actionable steps you should take to reinforce your infrastructure from the bottom up

FAQs

Q1: What is the biggest cyber threat for businesses in 2025?
While all threats are significant, ransomware with double extortion remains one of the most damaging. Attackers not only encrypt critical data but also steal it, threatening to leak sensitive information unless an additional ransom is paid.

Q2: How does AI make cyber attacks more dangerous?
 AI allows attackers to create highly realistic phishing emails, voice calls, and even deepfake video conferences that are nearly impossible to distinguish from legitimate communication. This makes traditional defences less effective and increases the importance of verification processes and advanced detection tools.

Q3: Are small and medium-sized businesses (SMBs) really at risk?
 Yes. SMBs are often prime targets because they may lack dedicated cyber security teams or advanced defences. Attackers know smaller businesses can provide an entry point into larger supply chains, making them a valuable target.

Q4: How can my business prepare for quantum computing threats?
 While quantum computing isn’t an immediate danger, businesses should monitor developments and begin exploring quantum-resistant encryption methods. Early adoption will ensure long-term data security once quantum computers become more powerful.

Q5: What’s the first step to protect against these 2025 threats?
 Start by assessing your human risk factors—since most breaches begin with human error. Conduct phishing simulations, test staff awareness, and work with a cyber security provider to strengthen your systems, processes, and defences from the ground up.

Get your free report now: 

Navigating Cyber Security Compliance and Regulations: Essential 8 vs. Privacy Act

Posted on by Wayne Darrell

The ASD Cyber Threat Report 2022-2023 released mid-November 2023 highlights alarming results. It reveals that:

  • The number of cybercrime reports has increased by 23%
  • The average cybercrime cost per report is up 14%

Cybercriminals were described as adversaries who show “persistence and tenacity” and “constantly test vulnerabilities in Australia’s cyber ecosystem and employ a range of techniques to evade Australia’s cyber defences.”

As an authorised Australian Government framework, the Essential Eight were of course among the measures suggested in the report to be implemented. We’ll start off by reviewing the Essential Eight and then delve into a framework that is less talked about but is actually mandatory for most Australian organisations – the Privacy Act.

 

The Essential 8 is a Good Foundation (But Not the Finish Line)

The Essential Eight is a set of controls prescribed by the Australian Cyber Security Centre (ACSC) to protect organisations from cyber threats and attempts to compromise the personal information of their customers and stakeholders.

The eight strategies are:

  • Application control – restricting the use of unapproved software
  • Patching applications – updating software to fix vulnerabilities
  • Configuring Microsoft Office macro settings – disabling/limiting macros from running malicious code
  • User application hardening – disabling exploitable features (e.g., web browser plug-ins)
  • Restricting administrative privileges – limiting the number of users who can perform high-risk actions
  • Patching operating systems – updating the system software to fix security vulnerabilities
  • Multi-factor authentication – requiring an additional security layer to verify a user’s identity
  • Daily backups – creating copies of important data and storing them securely

The ACSC has developed a security model from 0 to 3 for each of these strategies. An organisation with a maturity level 0 has not achieved any of the requirements. A level 3 means the organisation has achieved a high level of maturity. A common misconception is that organisations must achieve level 3 to be compliant. On the contrary, organisations can adopt the maturity level they need, depending on their vulnerabilities to cyber threats.

The Essential Eight cyber security risk mitigation are baseline strategies, and implementing them is the minimum expected from organisations. They are foundational and highly recommended, but your cyber security efforts should not stop there.

 

The Privacy Act: Mandatory for Data Protection

In its latest report, the Australian Signals Directorate (ASD) urges businesses to ensure resistance to cyber threats and go beyond the Essential Eight.

Say hello to the Privacy Act 1988.

Whilst the Essential Eight is one of the most well-known frameworks in Australia, its strategies are actually not mandatory. In contrary, the Privacy Act is less mentioned but most Australian organisations handling personal information must comply with it.

The organisations covered by the Privacy Act have an annual turnover greater than $3 million* OR are:

  • An Australian Government agency;
  • Private sector health service providers including private hospitals, therapists, gyms and child care centres;
  • Not-for-profit organisations;
  • Businesses that sell or purchase personal information;
  • A credit reporting body;
  • A contracted service provider for an Australian Government contract;
  • A business that holds accreditation under the Consumer Data Right System; and
  • A business that is related to a business that is covered by the Privacy Act.

*Note: Following the Privacy Act review in September 2023, one of the ‘Agreed in Principle’ proposals was the abolishment of the small business ($3m) exemption. Find out more.

 

The Privacy Principles

The Privacy Act includes 13 Australian Privacy Principles (APPs) that organisations must comply with, so you should be careful of the financial risks if you were to be assessed by the government. Meanwhile, whilst the Essential Eight are not mandatory, being non-compliant with some of those steps could lead to legal actions under the Privacy Act.

In short, the Essential Eight and the Privacy Act are both vital to IT security and data protection – but let’s look at the Privacy Act in more detail. The law regulates how personal information is handled by organisations and agencies. Below is an overview of the APPs which set the standards, rights, and obligations for collecting, using, disclosing, storing, securing, and accessing personal information.

Principle Title Summary
APP 1 Open & Transparent Management of Personal Information APP entities must have a privacy policy and handle personal information lawfully and fairly.
APP 2 Anonymity & Pseudonymity Individuals must have the option to not identify themselves or use a pseudonym when dealing with APP entities, unless impracticable or unlawful.
APP 3 Collection of Solicited Personal Information APP entities must only collect personal information that is reasonably necessary or directly related to their functions or activities and do so by lawful and fair means.
APP 4 Dealing With Unsolicited Personal Information APP entities must determine whether they could have collected the personal information under APP 3 and, if not, destroy or de-identify it as soon as practicable.
APP 5 Notification of the Collection of Personal Information An APP entity that collects personal information must tell an individual about certain matters under certain circumstances.
APP 6 Use or Disclosure of Personal Information APP entities must only use or disclose personal information for the purpose for which it was collected unless the individual consents or an exception applies.
APP 7 Direct Marketing An organisation may only use or disclose personal information for direct marketing purposes if certain conditions are met.
APP 8 Cross-Border Disclosure of Personal Information Outlines what an APP entity must do to protect personal information before it is disclosed overseas.
APP 9 Adoption, Use or Disclosure of Government Related Identifiers APP entities must not adopt, use or disclose a government-related identifier of an individual, unless the identifier is prescribed by law, or an exception applies.
APP 10 Quality of Personal Information An APP entity must take reasonable steps to ensure that the personal information they collect, use, or disclose is accurate, up-to-date, complete, and relevant.
APP 11 Security of Personal Information APP entities must take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification or disclosure, and to destroy or de-identify personal information when it is no longer needed.
APP 12 Access to Personal Information An APP entity must give individuals access to their personal information on request, unless an exception applies, such as when giving access would pose a serious threat to someone’s life or health.
APP 13 Correction of Personal Information Outlines the reasonable steps an APP entity must follow to correct personal information that is inaccurate, out-of-date, incomplete, irrelevant or misleading, either on their own initiative or at the request of the individual.

Over the last few years, we’ve seen an influx of cybercrime which prompted a lengthy review of the Privacy Act. In September 2023, a report was released over 100 new principles and while some were agreed in full, there were many only “agreed in principle”. One in particular was the proposal to remove the exemption for small businesses.

 

Discover How This Impacts Your Organisation

How the Privacy Act Review Affects Non-Profits

How the Privacy Act Review Affects the Medical Industry

How the Privacy Act Review Affects the Education Sector

See Privacy Act Report

 

The Essential 8 and The Privacy Act: Parallel Paths to Protection

The frameworks of the Essential Eight and The Privacy Act both aim to enhance the cyber resilience and privacy protection of Australian entities. Here’s how they compare:

The Essential 8 The Privacy Act
What is it? A recommended set of eight strategies to mitigate cyber security threats and incidents. A comprehensive law that regulates the handling of personal information.
What’s the purpose? To help organisations prevent or minimise the damage caused by cyberattacks. To help organisations comply with their legal obligations and ethical responsibilities when handling personal information.
How do organisations benefit from it? Reduction of cyber-attack risk and protection of sensitive data. Prevention of data breaches and improvement in customer trust.
What are the consequences of non-compliance? No penalties but can increase the risk of threats and compromise sensitive data. Companies:

1. AU$50 million, or;

2. Three times the value of benefits obtained or attributable to the breach (if quantifiable) or;

3. 30% of the corporation’s ‘adjusted turnover’ during the ‘breach turnover period’ (if the court cannot determine the value of the benefit obtained)

Individuals:

Was $440,000 but was increased to $2.5 million on December 13th 2022.
What’s involved? Assessing an organisation’s current level of compliance, based on a four-tier maturity model, then implementing the strategies and moving toward optimal protection at maturity level 3. Understanding an organisation’s obligations under the APPs, then implementing privacy policies and practices, guided by resources and tools from the OAIC.
Who’s covered? Recommended for all organisations, but not mandatory for Australian businesses. Mandatory for organisations with an annual turnover of more than $3 million*. Some small businesses are also covered if they store person identifiable information and meet other criteria.

*This is expected to change following the Privacy Act Review.
Is it mandatory? Not mandatory for Australian businesses, but highly recommended.

 

 Mandatory for Australian businesses that meet the criteria of APP entities.

 

 

What Your Cyber Security Strategy Should Look Like

In the end, your organisation should aim for the level of cyber protection that is best suited and ensure full compliance with laws and regulations. You can approach it with a combination of the 8 mitigation strategies and the 13 principles.

ADITS CyberShield solution takes cyber protection to a whole new level where security is at the core of everything we do. Our offering includes managed services and compliance & governance measures as well as security measures and monitoring to ensure your business is industry compliant. Whether you’re based in Brisbane, Townsville, or elsewhere, ADITS has you covered with tailored solutions to safeguard your organisation.

 

Your Cyber Security Journey

Compliance does not automatically translate to strong cyber security. Likewise, cyber security is not “set and forget”. It is a continuing process that needs your attention and effort if you want to ensure that your systems and data are always protected.

Understanding the Essential Eight and the Privacy Act is important. Since cyber security is complex and ever-evolving, it’s also vital to keep up-to-date with cyber security solutions, trends, and best practices. Though cyber security may seem mostly technical, it is in fact a business matter.

Executives and board members are personally liable in the event of a breach so instilling a cyber security culture throughout the organisation should be a priority.

With this in mind, ADITS is launching a half-day certified C-Suite training workshop where we’ll go through:

  • Data security and privacy compliance
  • Potential risks to your business and how to address them
  • Personal liabilities
  • Reporting
  • Crisis management recommendations
  • Best practices for policies and procedures

Register Your Interest For Our C-Suite & Board Training