Cyber security can feel like a big-company problem, but small businesses hold customer data, process payments and rely on email just as much. The Australian Cyber Security Centre (ACSC) publishes the Essential Eight, a set of baseline strategies designed to make it much harder for attackers to compromise your systems. Here is what each one means in plain English.
The eight strategies
- Patch applications. Keep browsers, Office, PDF readers and business software up to date, and remove software you no longer use.
- Patch operating systems. Install Windows, macOS, iOS and Android updates promptly and replace devices that no longer receive updates.
- Multi-factor authentication (MFA). Require a second factor for email, remote access, banking and cloud apps.
- Restrict administrative privileges. Give admin access only to the people who need it, and use separate admin accounts for admin tasks.
- Application control. Allow only approved programs to run on business computers.
- Restrict Microsoft Office macros. Block macros from the internet and only allow trusted, signed macros.
- User application hardening. Configure browsers and apps to block risky content such as unnecessary plugins and ads.
- Regular backups. Back up important data, keep a copy offline or immutable, and test that you can restore it.
Maturity levels
The ACSC describes maturity levels for implementing the Essential Eight. You do not need to do everything at once. Most small businesses get the biggest early gains from MFA, patching and backups.
Five things to do this month
- Turn on MFA for email, accounting and banking accounts.
- Switch on automatic updates for computers, phones and key software.
- List who has admin access and remove anything unnecessary.
- Check your backups exist, run automatically and can actually be restored.
- Make sure staff know how to report a suspicious email or text.
Where to learn more
The ACSC publishes free guidance for small businesses at cyber.gov.au, including the full Essential Eight documentation and a way to report cyber incidents.
How Hyperion Tech can help
We help businesses secure their websites, set up MFA and backups, and keep systems updated. Get in touch if you would like a hand reviewing where you stand.