On Friday morning, Prime Minister Scott Morrison announced that Australian governments and businesses are being targeted by a major cyber attack, urging Aussie organisations to take steps to protect their own networks.
“This activity is targeting Australian organisations across a range of sectors, including all levels of government, industry, political organisations, education, health, essential service providers and operators of other critical infrastructure,” PM Morrison said.
“We know it’s a sophisticated state-based cyber actor because of the scale and nature of the targeting and the tradecraft used.”
Underlining that “this activity” is now new, the PM, however, encouraged organisations — particularly those in the health, critical infrastructure and essential services — to take expert advice and implement technical defences.
“We raised this issue today not to raise concerns in the public’s mind, but to raise awareness in the public’s mind. This is the world that we live in. These are the threats that we have to deal with,” the PM said.
Issue for businesses of all sizes
Commenting on the PM’s unprecedented address, the co-founder of Cynch Security, Susie Jones, stressed that cyber security is an issue for businesses of all sizes.
“It is unprecedented for the PM to openly warn Australians of an active attack as he did today… We see day in and day out the growing prevalence of cyber attacks and we know that cyber criminals do not discriminate based on business size — this is an issue for businesses of all sizes,” Ms Jones said.
She explained that the quickest and easiest way for small-business owners to protect themselves today is to install all of the updates waiting on their computers and phones.
“Enable two-factor authentication wherever you can,” she said.
“The systems that are most vulnerable are any internet-facing systems, so prioritise these systems first, i.e. cloud accounting software, email platforms, collaboration tools and online storage platforms.
“Also be aware of an increase in phishing attacks and look out for more dodgy emails, and never click a link in an email unless it’s from a known sender and/or you know exactly where it’s taking you.”
Also urging vigilance, the founder of cyber security company InfoTrust, Dane Meah, stressed that companies need to take heed of the PM’s announcement.
“Our advice to businesses would be to complete a review of the controls, policies and procedures they currently have in place. Are your security controls set to best practice? Do you have an incident response plan in place, and have you tested it recently? Are your staff aware of the types of attacks they should be looking out for?” Mr Meah said.
Businesses that feel they have been compromised are being advised not to wait to be sure, but to immediately speak to their IT support person or visit the government’s website, cyber.gov.au.
The Australian Cyber Security Centre and the Department of Home Affairs have also published a detailed technical advisory, outlining the necessary steps that organisations could take to detect and mitigate the threat.
The advisory can be found here.
