The ACSC small business guide, as one account

A small business does not need a security operations centre to stop the attacks that actually arrive. It needs a clear picture of how those attacks work, a short list of controls that break them, and enough detail that both a shop owner and a specialist can see why each step exists.

The Australian Cyber Security Centre’s Small Business Cyber Security Guide, last updated in June 2023, was written for that gap. Even a modest incident can halt invoicing, empty an account, or encrypt years of files. The guide’s opening trio is multi-factor authentication, current software, and backups you can restore. After those are in place, the same document points firms toward Maturity Level One of the Essential Eight. What follows is that guidance rewritten as a single account: what each threat and control is, how it works in practice, why it matters, and where in the business it belongs.

Overview: the problem in one pass

Most small firms are not breached by novel exploits. They are breached by a convincing message, a reused password, an unpatched laptop, or a backup disk that was still plugged in when ransomware ran. The attacker’s goal is usually money: a payment sent to the wrong account, gift cards that cannot be traced, or a ransom after files are locked. Sometimes the prize is the mailbox itself, because a stolen inbox is a machine for sending the next invoice fraud.

Three families of attack cover almost all of that activity. Scam and phishing messages trick someone into handing over money or credentials. Business email compromise uses a lookalike or stolen mailbox to change bank details or rush a payment. Malware, especially ransomware, locks or steals files and then spreads to whatever storage the infected machine can reach.

The defences line up against those paths. Accounts need a second factor and unique secrets so a leaked password is not enough. Devices need patches and scanning so known holes are closed. Data needs a copy that the live network cannot overwrite. The network needs fewer doors facing the internet. Staff need a rule for payments and a paper plan for the first hour of an incident. None of this is exotic. Each item has a place: the inbox, the finance process, the NAS, the website admin panel, the router, the drawer with the printed phone list.

A specialist will recognise the same ideas under other names: phishing-resistant authentication, least privilege, an offline or immutable recovery point, attack-surface reduction, supply-chain risk. The plain version is the same work. Do not pay from an email alone. Do not leave the only backup mounted. Do not run last decade’s operating system. The three cases below are the ACSC’s own illustrations of what happens when those habits are missing.

How the attacks land

Messages that look like work

A scam is a message that pretends to come from a person or firm you already trust. It arrives by email, text, phone or social media. The ask is concrete: send money, buy gift cards, click a link, type a password. Phishing is the subset that points at a fake website built to harvest a login. Once the password is in the attacker’s hands, the next move is often a takeover of email or the business social account, which can then be held or used for further fraud.

The mechanism is social, not technical. Display names are easy to forge. A lookalike domain is cheap. The page only has to be close enough that someone in a hurry types the usual secret. That is why the check that works is boring: if a message from a known entity feels off, contact that person or firm through details you already hold or that you found on their official site. Do not use the number or the link inside the suspicious mail.

This belongs everywhere staff read messages on behalf of the business: the shared inbox, personal phones used for work, and public social accounts. Reporting a suspected scam is part of the same habit. The ACSC points to its own material on recognising scams, spotting phishing, and detecting socially engineered messages.

Case study: six gift cards and a forged executive

An employee at a courier company received mail that appeared to come from an executive. The instruction was confidential. Buy six $500 MasterCard prepaid cards as staff gifts, photograph both sides, and send the photos as proof. She paid with her own card at a post office and emailed the images. When she handed the physical cards to the real executive, he had never asked for them. Every message had come from an unrelated address.

There was no malware on her PC. This was CEO fraud, a form of business email compromise that uses urgency and hierarchy. The missing control sat in the payment process, not in an appliance: call the named executive on a number the firm already trusts, and treat photographs of card numbers as a warning, not a workflow.

The invoice that quietly changes destination

Email attacks go further than a one-off phish. Business email compromise is the pattern in which criminals impersonate a supplier or a colleague, either from a mailbox they have already stolen or from a domain that looks almost like the real one. The usual payload is new bank details, or an overdue invoice that must be paid today. The aim is a transfer into an account the thief controls.

The best cheap defence is training plus a formal check. Staff should treat payment requests and bank-detail changes as high risk when they are urgent, when the domain is slightly wrong, or when the only evidence is the email itself. The effective action is to call the sender on a number from existing records or the official website. Building that call into the process costs almost nothing and would have saved the firm in the next case.

Case study: more than $150,000 to a supplier who never changed banks

A small construction business received mail from a supplier saying the firm had changed banks and attaching new account details. The message looked like the rest of their correspondence, so nobody called. They paid an invoice of more than $70,000. The next day another employee paid the same invoice again. When they asked the supplier to refund the duplicate, the supplier said those details were wrong. One of the supplier’s mailboxes had been taken over and used to send the instruction. No funds were recovered.

A specialist reads two failures. On the supplier side, a mailbox without a second factor is a single stolen password away from becoming a fraud engine. On the buyer side, there was no dual control and no out-of-band confirmation. SPF, DKIM and DMARC would have made raw spoofing harder. They would not have stopped a thief already sitting in a valid mailbox.

Software that locks the shop

Malware is the blanket term for software written to harm: ransomware, stealers, spyware, trojans. It can encrypt files, lift card numbers and passwords, or give someone else a view of the machine. Infection still arrives in the old ways: a site that has been compromised, a downloaded installer, an email attachment. Once inside, it can spread to other devices on the same network.

Ransomware is the type small firms meet most often. It encrypts files so the business cannot open them, then demands payment, usually in cryptocurrency. Some operators also threaten to publish or sell the stolen data. Security software helps. No product is complete. Staff still have to treat odd attachments and unknown download buttons as hostile, and devices still have to be patched.

The fatal extra, in the case below, was a backup that lived on the same computer the encryptor had just taken.

Case study: the backup that encrypted itself

Staff at an auto parts store arrived to find the server would not boot. The IT provider found a window demanding bitcoin to unlock the files. A backup drive was plugged into the same machine and had been encrypted with everything else. They connected more backup disks. Those files were encrypted within seconds. The firm had not removed the ransomware before trying to recover, and they lost every copy they had. The remaining option was a factory reset and a new system. Years of data went with the old one.

That is why “we have a backup” is not the same statement as “we can restore.” If the copy is mounted and writable by the operating system that just got ransomware, it is another disk for the encryptor. The design that survives is a copy the live machine cannot reach: a disk you unplug after the job, or a cloud store the ordinary user cannot delete or alter. Test a restore on a quiet day. An untested backup is a hope.

Accounts: the first place attackers spend stolen secrets

Multi-factor authentication is a second proof after the password. The usual combination is something you know, such as a password or PIN, plus something you have, such as an authenticator app or a hardware key. Sometimes a biometric is added. A thief who has the password still needs the second factor. That is why the ACSC treats MFA as one of the most effective account controls and tells firms to switch it on wherever the service allows, starting with the accounts that matter most.

In practice that means email first, then banking, then any cloud console that can reset other users. SMS codes are better than a password alone and weaker than an app-generated code or a FIDO2-style key, because a text message can be redirected. Use what the service offers, then move toward the stronger methods when they exist.

Passwords fail in small firms for a predictable reason. People reuse them. One leaked secret then opens mail, the website admin panel and the accounting login. A password manager is a vault that creates and stores a unique secret for each account so nobody has to memorise thirty strings. You protect the vault with a strong master secret and MFA. For the few logins you still type by hand, a passphrase of four or more random words, unique to that account, is easier to remember than a short tangle of symbols and harder to guess than it looks. The example in the guide is the point: random words, not a pet’s name with a year on the end.

Shared accounts are a separate problem. There are moments when a small team thinks it needs one login. The cost is that you cannot tell who did what, and a person who has left can still get in until someone changes the secret. Limit them. Where they cannot be avoided, lock them and write down who is allowed to use them.

Access control is the same idea applied to files and systems. Most staff do not need every folder and every admin switch. Give each person only what the role requires. If ransomware later runs under that account, it can encrypt only what that account can write. In a specialist’s language this is least privilege. In a shop it is the difference between one infected PC and a whole file server.

Devices and data: keep the machine current, keep a copy that survives

Updates close holes the vendor already knows about. Attackers scan for those holes because the exploit is public. Automatic updates on operating systems and applications remove the need to remember Patch Tuesday. When a manufacturer has stopped shipping fixes, as with Windows 7 or an old phone, the device is a standing invitation. Replace it rather than hoping nobody notices. The same rule applies to NAS firmware, router firmware, and the plugins on a website.

Backups are the recovery plan when updates and MFA were not enough. A backup is a copy of the information the business cannot afford to lose: customer records, invoices, accounts, site content, and often the configuration that makes the systems boot. The plan should answer three questions in writing. What is copied. When the copy runs. Where it is stored. The best product varies. The requirement that does not vary is that at least one copy must sit out of reach of the live machine. Disconnect the disk. Use a service that prevents an ordinary account from wiping the history. Then restore one file on purpose so you know the copy is real. Speak to an IT professional if the estate is messy. Guessing is how the auto parts store lost the second and third disks as well as the first.

Security software is the daily scan. Antivirus can quarantine known malicious files. On current Windows machines, Windows Security is already there and includes ransomware-protection features that are worth switching on. Set it to scan on a schedule. Treat an alert as real until you have a reason not to. It will not catch everything. It will catch a share of the commodity tools that still arrive by attachment.

The network is where those devices meet the outside world. A NAS or small office server is a common target because it holds the files and often ships with a default admin login. Patch it. Put a strong secret and MFA on the administrative account. Then look at what faces the internet. Remote Desktop, file shares, webmail and remote admin tools are doors. If you do not need them open, close them. If you cannot staff that work, moving mail and site hosting to a cloud service that already does the hardening is a rational trade.

The router needs the same attention in miniature: change the default password, use current Wi-Fi encryption, and put customers or visitors on a guest network so they do not sit on the same segment as the till and the file share. Firms that outsource IT take on the provider’s security as their own. That is supply-chain risk. Ask how the provider authenticates, patches, and isolates your tenancy. The ACSC publishes separate supply-chain guidance for that conversation.

Websites are another public door. A neglected content management system and a stack of plugins are an attack surface. Secure the admin login with MFA or at least a unique strong secret, keep the platform and plugins current, and keep a backup you can restore after a defacement. TLS, the protocol behind HTTPS, should be the default. The ACSC has shorter notes on certificates, DNS security and denial-of-service response for anyone who runs their own domain.

Two physical habits close the loop. Factory-reset a laptop, phone or drive before it is sold, traded or thrown away, or the next owner can recover mail and files. Lock screens with a PIN, passphrase or biometric and set a short idle timeout, and do not leave business machines where the public can pick them up.

Data protection starts with knowing what you hold and where it lives. Scattered copies across phones, USBs and old PCs multiply the systems you must patch and back up. Centralising helps only if that central store is configured tightly and access is limited. A bigger pile in one place is a bigger breach if it is wide open. Some firms also have legal duties for personal information. The Office of the Australian Information Commissioner publishes small-business guidance. When the duty is unclear, ask a lawyer rather than inventing a retention rule.

People: the control that sits in the payment process

Employees who can see a fake invoice and know the internal rule are the first line, because the three cases above all began with a person doing something that looked like work.

Education should cover the threats in this piece, the protective habits (unique secrets, MFA, updates), how to check a message, the firm’s own process for reporting odd mail and for confirming invoices before money moves, and what to do when systems fail. The ACSC site has material for most of those topics. A formal course is optional. A single induction slide is not enough. Refresh the teaching on a cycle, and again when a new scam is circulating.

An emergency plan is the script for the first hour. Every minute spent deciding who to call is a minute the attacker still has. The plan should say how staff report a suspected incident, whom to ring (the IT contact, the bank, the insurer, the ACSC on 1300 CYBER1), how you tell staff and customers, and how you keep taking orders if email or the file server is down. Keep a paper copy. Systems are often the thing that just died. Make sure people know their part before they need it.

Staying current is the last staff habit. Criminals use new holes quickly. The ACSC Partnership Programme sends monthly notices and alerts when a threat is identified. Register the business and put those mails in a box someone actually reads.

What comes after the basics

Secure by Design is the ACSC’s name for products and cloud services that treat security as a requirement of the design, not a later add-on. When you next buy laptops, a mail platform or a till system, prefer vendors who ship MFA, sensible defaults and a supported patch cycle. The Centre’s small-business cloud guides walk through examples such as Microsoft 365 and ChromeOS.

Once the measures in this guide exist in the firm, the next formal target the ACSC recommends is Essential Eight Maturity Level One. That set is application control, patching of applications and the operating system, configuration of Microsoft Office macros, hardening of user applications, restricted administrative rights, multi-factor authentication, and regular backups. It is the Australian government’s short list of controls that most reliably reduce the impact of the intrusion paths described above.

The work for the coming week

• Turn on MFA on email and banking.
• Turn on automatic updates.
• Confirm there is a backup that is offline or immutable, and restore one file from it so the copy is not a rumour.
• Write the two-person rule for any change of bank details.
• Print the incident phone list and put it where the server cannot take it with it.

Sources

• Australian Cyber Security Centre, Small Business Cyber Security Guide (June 2023). The three cases and the control sequence in this article are taken from that official guide.
• Essential Eight, Australian Signals Directorate.
• OAIC small-business privacy guidance.
• ReportCyber and 1300 CYBER1 for reporting.

Related: Business pathway · Ransomware response · Get incident help · Ransomware in the first hour.