Securing Australia's SME cyber security infrastructure - the problems and proposed solutions - enabling SMEs self-resilience measures

The SME sector is the engine room of the Australian economy. Around 50% of employees work for a business with less than 100 employees, and there are 215,000 businesses with 5-19 employees and 68,000 with between 20-199.

Despite the large size in aggregate and the collective importance to the economy, the SME sector struggles with implementing basic cyber resilience practices. A combination of tight finances and lack of cyber security expertise has meant that many SMEs struggle to achieve Level 1 of the ACSC Essential 8 Framework.

The current risks for SMEs will be discussed and the low-cost risk mitigations for each of the risks will be demonstrated.

Risk mitigations such as effective patching will be discussed and how to check if this is happening.

The fundamentals of backup technologies will be discussed and how to structure the correct backup routine for their business.

According to the ACSC and what we see and respond to, the number 1 threat for an SME is email fraud. We will cover the best practice (and free) measures that every SME should take to manage the risk of fraudulent payments, based on the incidents that we respond too.

The role of AI will be explored, and how SMEs are starting to use tools like ChatGPT to improve their cyber resilience and to enable them to have a more meaningful conversation with either their internal IT department or their IT provider.

A checklist of simple implementations will be provided for SMEs to easily apply practical measures to improve their cyber resilience. A blank cyber risk template will be provided to enable a business to conduct their own risk assessment and understand how the ASCS Essential 8 applies to their businesses.

This presentation goes beyond the Essential 8 - providing advice based our experience of responding to SME cyber incidents over the last 10 years and seeing what practices can work in SMEs that are restricted on budget and cyber skills.

This is a part of our goal of improving the cyber resilience of all Australian businesses.