
A Cyber Summit wasn’t on the top of my list for continuing education this year but its surprising what you can learn from expanding your horizons.
First up if you find the subject of cyber security or AI stressful perhaps have a look at my other blogs instead. Just take away this one useful nugget – 90% of problems can be prevented by ensuring you keep your software updated, use multi factor authentication and start using pass phrases for passwords, ideally with at least four random words.
With the evolving awareness of AI risks it may also be worthwhile adding another layer of security. Stop and Check! What does this mean? Basically if you are contacted by someone offering helpful information (unexpectedly because lets be honest how many times does your bank or social media company pick up a phone) then hang up and ring back on the number listed on the website. Often these calls are designed to get you to read out a code from your supplier to enable them to take over your account.
One of the key risks for businesses is having data hacked and being ransomed. Fortunately Australia didn’t go down the path of banning ransom payments from a legislative perspective and has adopted a more collaborative approach, where you can report what happened and get assistance. This information is not passed on to other agencies and is provided by Australian Signals Directorate (ASD) through the Cyber Security hotline, which has a reporting service with 24/7 access.
A few of the panellists who shared advice about dealing with these types of attacks highlighted common themes. A big element of risk is the human element – one transport business had its system attacked as an engineer’s login credentials were released on the dark web. The business saw 50-100 servers being activated out of hours and realised that there was an attack in progress and made the decision to shut the system and its operations down for a few days.
Staff can be an effective human shield for a business and its critical that they understand the risks involved and how to mitigate them effectively. For small businesses ideally get all your staff to complete the Cyber Warden training available which has three short modules to upskill your staff. These modules cover cybersecurity, safe use of AI and supply chain risks.
The other critical component of reporting is the communication with your clients and key stakeholders. Ensuring that they received timely advice can make the difference for them of being exposed themselves and incurring significant financial damage.
The ASD also shared these thoughts on the four areas of risk that Boards need to be considering, which I found useful as both a small business owner and as a Director of COSBOA.
- Legacy Systems and Segregation- ensure that the legacy systems don’t create weak spots for access and that when you upgrade these systems are decommissioned.
- Logins – monitor for access at odd times or where the activity levels are unusual.
- Quantum – get ready for the post quantum security challenges as this level of encryption will be broken in the new few years. To sound knowledgeable on this point simply refer to it as “Q Day”.
- Supply Chain – make sure you don’t create any weaknesses that a bad actor can use and also that there is compulsory reporting of incidents.
No review of a Cyber Summit would be complete anymore without a discussion about AI ! This was certainly a fascinating panel as Fortesuce shared that they are working on 30 different projects incroporating AI into the business to drive operating efficiencies. Major banks like Commonwelath Bank are investing heavily in AI to improve their own security and to assist with scam detection. These include a project where they have created an AI bot which chats to scammers and is attempting to disrupt their model and make the activity unprofitable. Apparently they had the bot “talking” to one scammer for 48 minutes. Whatever your views are it is clear that businesses that don’t start looking at what tools can be integrated risk being left behind particularly when it comes to improving productivity.
A couple of areas were flagged as being of concern with the rollout of AI, including the ability to perpetrate even better scams, particularly with romance scams now creating effective videos as well. Other concerns noted were the vast amounts of energy required to fuel these searches and the potential to introduce vulnerability into your other systems.
So do I feel more knowledgeable about cyber post this event ? It certainly made me realise how many systems I use everyday in my own business and determined to be more diligent on my security (in fact just ran all my updates on my phone and Mac this morning). I have also taken away a great report from the Organising Sponsor, Cyber CX with curly questions to ask at my next Board meeting and a determination to ensure that as many small businesses as possible utilise the free Cyber Wardens training to upskill on security, AI and supply chains. Have I convinced you?










