Whether it be an external attack or internal vulnerabilities, any business that interacts over the internet or electronic networks, or is reliant on the supply of third party technology, is exposed to risk in this digital era.
Prevention is the best form of cyber security. However, it is not possible to protect against all cyber risks. So what should you do in the event that you detect a cyber-intrusion?
Planning your response to a cyber-attack is key to a smooth recovery. Make a response plan and ensure that it is well-documented, communicated to relevant internal and external stakeholders, and tested and updated regularly. Recovery plans should contain proactive policies that are frequently reviewed and updated in order to assist you in managing recovery from a cyber-attack. Policies may include methods for formal communication to manage internal and external communication during and after a recovery process, and formal review procedures to learn lessons from any cyber-attacks that do occur.
Report any actual or attempted cyber-attacks. Listed companies may be required to disclose a cyber-attack as market-sensitive information, and any risks in relation to cyber security may need to be revealed in product disclosure statements. Cyber-attacks may be breaches of Australian law and should be reported to the relevant authority. Small-to-medium-sized business can securely report attacks through the Australian Cybercrime Online Reporting Network. Large businesses should report occurrences to the Australian Cyber Security Centre by contacting CERT Australia.
Individuals such as employees, customers and clients must be advised if there has been a breach of any personal data. Notifying the relevant stakeholders can strengthen, or at least seek to maintain, investor and financial consumer trust and confidence. The Office of the Australian Information Commissioner provides assistance regarding the implementation and preparation of a data breach policy and response plan.
Cyber-attacks and internal data breaches can lead to financial loss, digital disruption and destabilisation and reputational harm for a business. Businesses subject to a cyber-attack or internal data breach may also be in default of their obligations under Australia’s privacy laws.
If you think your business may be at risk, or are seeking more information on how to manage cyber-attacks and internal data breaches, please contact us.