Not all data and organisational security is created equal
Australia has become a prime target for cybercriminals. In 2024 alone, we recorded 47 million data breaches, according to the Australian Cyber Network’s (ACN) State of the Industry 2024 report, and now rank 4th globally as one of the most targeted nations for cyber threats against critical infrastructure. Phishing attacks are on the rise, with 8.9 million recorded incidents globally, and hackers can escalate their attacks in just 48 minutes (or even faster!).
The evidence is clear – protecting Australia’s critical infrastructure has never been more important.
But there’s a twist. Not all data and organisational security strategies are built the same. If your organisation isn’t prioritising key data or regularly reviewing security policies, you could be taking a big risk with breaches that might seriously disrupt operations.
Are you confident your current setup is ready to handle today’s threats?
Cyber threats are becoming more sophisticated
When you think of a hacker, you might picture someone in a dark hoodie working tirelessly on malware code or sending out phishing emails. But today’s reality is far more complicated.
Enter access brokers – cyber mercenaries who specialise in breaking into organisations. According to a CrowdStrike report, their activity jumped by 50% in 2024. Once they’ve gained access to a network, they sell it off to other cybercriminals, like ransomware groups, essentially turning your compromised system into a ‘cyber open house.’
Adding fuel to the fire is the adoption of AI by cybercriminals. They’re using generative AI to create phishing attacks that are almost impossible to spot and spread highly convincing disinformation. Much like a double-edged sword, while AI is helping businesses grow, it’s also giving hackers incredibly powerful tools that didn’t exist just a few years ago.
If that’s not unsettling enough, 79% of detections in 2024 were ‘malware-free’. This makes traditional anti-virus solutions blunt tools in a razor-sharp arena. Most attacks now rely on social engineering and identity-based compromises instead of relying on traditional malware.
Protect what really counts
Many organisations stumble by relying on security strategies that treat all data as being equal. Instead, the value of data varies between industries. For example:
- Critical infrastructure sectors—like electricity, healthcare, food supply—carry highly sensitive data whose breach could create nationwide ripple effects.
- Retail and financial services deal with volumes of personal identifiable information (PII) that could cause harm if it gets leaked.
Aside from industry factors, data silos can impact value. For instance, customer payment details and intellectual property usually need stronger protections compared to public-facing operational data.
If your security framework doesn’t account for these differences, you could end up over- or under-investing in critical areas.
Attackers prey on the unsuspecting
Today’s phishing attempts aren’t just about dodgy emails packed with malware—they’re all about catching you off guard in a split second. Business email compromise (BEC) scams go one step beyond, targeting human instincts and those brief moments of poor judgment.
Here’s a statistic likely to give you pause: The fastest recorded ‘breakout time’ for lateral movement in a target system was just 51 seconds.
Unfortunately, once hackers have cracked one layer of your security, their partners-in-crime won’t be far behind.
Take steps to strengthen your security framework
If adopting wholesale security strategies gives you a false sense of calm, here are actionable steps to bolster your approach:
- Step 1. Prioritise data by sensitivity
Start by mapping out and categorising your most sensitive data. Then set up detailed access control policies that match the sensitivity of the data. Frameworks like the NIST Cybersecurity Framework and ASD’s Essential Eight Maturity Model are great starting points. - Step 2. Put least-privilege policies in place
By adopting least-privilege principles, everyone in your organisation—whether inside or outside the company—only gets the access they need and gets verified every time they access your system. - Step 3. Regularly check access privileges
Do you know who accessed what—and why? Regular audits should check on access privileges, especially for sensitive systems or user accounts, like admin profiles. - Step 4. Train and empower your team
Since phishing and BEC attacks often rely on human mistakes, cybersecurity awareness shouldn’t be just an IT-related activity. Run simulated phishing tests to keep everyone sharp and on their toes. - Step 5. Partner up where necessary
When resources like people, money, or time are tight, managed services focused on governance, risk and compliance can take the pressure off. If an access broker sells sensitive credentials, responding quickly can mean the difference between staying out of the news or making headlines. - Step 6. Conform to standards like ASD’s Essential 8 or NIST
Following cybersecurity frameworks like NIST 2.0 or ASD’s Essential Eight helps you build a strong, layered defence system.- ASD’s Essential Eight recommends using multi-factor authentication, application whitelisting, and regular data backups, amongst other best practices.
- The NIST framework—which now also includes governance—helps organisations map out their current and future security measures, making it easier to improve over time.
Act now before threats outpace defences
Recent legislative changes in Australia, like the 2022 Critical Infrastructure Act, aim to close the floodgates. But with the expanded scope, more businesses(and even their supply chains) now have to step up and meet stricter cybersecurity requirements.
Remember, hackers don’t always directly target infrastructure. Instead, they breach remote vendors and service providers to worm their way in from the side. By taking proactive steps and building a strong security strategy, you can elevate ‘good’ organisational security to ‘impenetrable’.
