How to protect your business from data breaches

This blog post relates to Rockend, one of our previous brands. For more information please read the press release.

Hacking, data breaches, insider threats – all of these are problems today’s businesses face.   Having your business’ data land in the wrong hands can have significant legal and reputational damage that can cost you your customers’ trust and affect your business’ value.

In a globally connected world the threat of being hacked or having your data breached is increasing daily.  To help lessen your business’ exposure to risks,  we list down ways to protect against hacks and data breaches as well as responsibilities companies should be aware of should they fall prey to such cyber crime.

The Essential Eight in protecting against hacks and data breaches

Many cyber-attacks can be thwarted by carrying out some simple technology hygiene.

The Australian Signals Directorate, the government agency charged with protecting Australia’s information assets, has published some guidelines that all businesses can follow.  Its ‘Essential Eight’ are relatively easy to do, but are also highly powerful protective techniques businesses can use:

1. Application whitelisting – Only allowing approved, know-to-be- safe applications to run.
2. Patching applications – Ensuring your applications have received the latest software updates to ensure any known security issues are fixed.
3. Configure MS Office  macro settings to ensure untrusted macros from the internet don’t run from Office documents.
4. Application hardening ensures that you have configured application settings to minimise the risks of incorrect settings being exploited.
5. Restrict administrative privileges so that only those that need administrative access to systems have those rights.
6. Patch operating systems to ensure your systems are running the most up-to-date software available.
7. Multi-factor authentication will protect systems so that a compromised password can’t be used to infiltrate your systems.
8. Daily back-ups can protect you if the worst does happen. If your systems are compromised and data is lost or altered, you can go back to a previously known, safe state.

What to do if you are hacked?

If you are hacked or think you’ve been breached it’s important to not panic. It’s possible to make matters worse by reacting quickly rather than taking a few moments to take a breath and properly assess the situation.

1. Reset administrative passwords
   Many breaches involve compromised user credentials, so changing passwords is a good place to start to stop many attacks from progressing.
2. Isolate affected machines
   If possible, isolate affected machines by disconnecting them from the network. For a workstation, on a desk, this can be as simple as pulling the network cable out of the computer. This is important as some attacks, such as recent types of ransomware, can move from machine to another across the network
3. Hire a third party contractor
   If you don’t have the internal expertise to manage a breach or asttack, ensure you have a third party contractor you can trust to support you. That means planning that a breach will occur and establishing processes for contacting and engaging that expert.
4. Notify affected customers and business partners
   This can be a tough pill to swallow, but it’s part of your obligation under the Australian Privacy Principles. While there are penalties for breaches of the disclosure rules for data breaches, these only apply if you try to hide the breach and don’t report it.
5. In some cases, you may need to report to the Australian Stock Exchange
   Any hack affecting a publicly traded company that may result in a change in the business’ value needs to be reported to the Australian Stock Exchange under ASX Listing Rule 3.1.

By taking these preventive measures to minimise risks for data beach and having a sound plan in handling an incident, you can save your business from the crippling effects of cyber attacks.