Login
The 4 non-negotiables of a resilient, responsible firm in digital Australia
As the nation becomes increasingly digitised, there are fundamental steps that professional services businesses must take to protect the personal information of both themselves and their clients, write Hana Lee and Nick D’Orazio.
Hana Lee and Nick D’Orazio
Not if, when.
Here are four non-negotiables that we think every Australian business should incorporate to protect their – and their client’s – personal information, to become resilient, responsible businesses in digital Australia.
- Enable multifactor authentication (MFA)
Though it’s undoubtedly an industry standard, MFA is still not absolutely required by every user of every platform. Notwithstanding, Australian businesses can no longer rely on the notion that MFA is annoying and unnecessary given that enabling it reduces the likelihood of being hacked by 99 per cent!
More importantly, companies are at risk of being found legally negligent for failing to employ MFA, given how effective it is for such little additional effort.
The reality is, threat actors have developed countless methods to harvest massive quantities of passwords, from dark web auctions to complicated phishing schemes. By enabling MFA, you can make cyber threat actors’ lives much more difficult, and your data that much more secure.
- Delete data you don’t strictly need
Looking at the 2022 Optus data breach, we can see the dangers that come with holding excessive and unnecessary data. Prior to the data breach, Optus retained the name, bank details, address, driver’s licences, passport numbers, and Medicare numbers of its customers for as long as six years after the customer had left Optus. Optus argued that it had a legal obligation to keep these details so that it could chase debts and assist law enforcement agencies. This was found ultimately to not be true because, for example, why would it need Medicare numbers to send an invoice?
By routinely holding onto so much extra information without a valid purpose, Optus put all of its customers at risk. In short, don’t hold onto what you don’t need.
- Educate your team
In terms of how best to prepare, experts at the summit agreed that the first step is to assign roles and establish responsibility. Specifically, these roles should assign responsibility for reporting obligations, managing the technical response, and communicating with executives throughout the incident. By establishing responsibility prior to an incident, you forego having to allocate roles in the middle of a crisis.
The second step is to conduct regular (twice annually is recommended) walkthroughs, known as “table-top” exercises, where you and your team take the time to walk through each stage of a data incident as if it was occurring in real time. During these walkthroughs, team members are given the opportunity to experience the flow of a data incident response, become familiar with their roles, and gain the knowledge and confidence to act efficiently when an incident occurs. Regular table-top exercises are recommended due to the ever-changing landscape of data incidents, and so that your staff are familiar with variations to the response plan as and when they are made. Every minute you spend training data incident response will save you hours (and $$$) during a real incident
- As an executive, buy into cyber security!
The worst possible outcome to a data incident response meeting, and one that is all too common, is for the CEO or chairman to declare that they are completely unaware of any data incident response or business continuity plan. As mentioned above, prior preparation is imperative to a resilient, responsible business, and it all starts at the top with executives taking a proactive approach to data security. Without buy-in from each and every executive in a business, the important and necessary changes to workflows, policy, and training cannot take place.
Hana Lee is an associate and start-up and capital team leader, and Nick D’Orazio is a commercial paralegal at Burch & Co.
