Technology

With recent high profile cyber crimes being committed it is no wonder that this is now a priority for both businesses and consumers. Recently the ACSC Annual Cyber Threat Report (July 2021 to June 2022) was released to provide advice for businesses and consumers to protect themselves. An article by Accountants Daily highlighted some of the key aspects of this report.

Since the beginning of the pandemic in 2020, cyber threats have grown excessively. In particular, phishing spam calls, spam text messages, video conference attacks and insider threats.

Russia’s invasion of Ukraine has contributed to the destructive malware and sophisticated cyber-attacks on European Networks.

Advanced cyber threats have drastically increased at a larger scale, due to extortion, espionage and fraud. The Australian Cyber Security (ACSC) have calculated a 13% increase in the last financial year with an approximate of over 76,000 cybercrimes having been reported.

The top security trends for ACSC are:

1. Cyber space has become a battleground
2. Australia’s prosperity is attractive to cyber criminals
3. The most destructive cyber crime remains ransomware
4. Worldwide, critical infrastructure networks are increasingly targeted
5. The rapid exploitation of critical public vulnerabilities became the norm

The following are crucial lessons from the latest cyber crime data.

1. Frequency of cybercrime reports

All businesses should be weary of the increase in cybercrime and cyber security incident. As an increase in cybercrime will require an increase in cyber defence and protection.

The rate at which a cybercrime has been reported was one every seven minutes, however the reporting rate for the previous year was one every eight minutes.

The states reporting the most cybercrimes were Queensland (29%) and Victoria (27%).  However, the Northern Territory reported the highest average of losses resulting over $40,000 and Western Australia resulting exceeding $29,000.

2. Trending cyber crimes

The three most frequently reported is online fraud (27%), online shopping (14%) and online banking (13%).

Fraud is the most prevalent, however ransomware is classified as the most destructive cybercrime, due its long-lasting impact, especially on data. Furthermore, organisations are also prone to fall victim to the indirect consequences of ransomware. This includes reputational damage and information being leaked and/or sold on the dark web.

The top-tier cybercrime syndicates target Australia’s big names, hence heightening the importance of large enterprises becoming more aware to this severe threat. LockBit was the top-rated weapon of choice against ransomware for 2022.

3. Top industries targeted

The highest number of cyber security reports were within the healthcare and social assistance sector with a total 10%. The next leading cases were information media and telecommunications with 8% and education and training at 7%.

4. Business Email Compromise

Business Email Compromise (BEC) is referred to as the scam that targets companies who have suppliers abroad and also conduct wire transfers. Cyber criminals are known to use BEC on the larger enterprises as they can hijack large sums without having to access the malicious payload URL.

Successful BEC attacks have risen significantly with the average loss to have increased over $64,000. According to ACSC Queensland was the most vulnerable with a total of 389 reports and a total of BEC attacks rising to 1,514.

5. Cyber defence for organisations and individuals

Clare O’Neil, the Cyber Security Minister, had stated that due to Australia’s unique geostrategic position and information-rich environment we must build our cyber defences to ensure we have the tools necessary to protect ourselves against the impacts of cyber-attacks.

ACSC recommend following the essential eight maturity model which includes:

1. Restricting administrative privileges
2. Patching or updating operating systems
3. Implementing multi-factor authentication
4. Conducting regular back-ups
5. Configuring your email security settings
6. Initiating application controls on workstations and servers
7. Denying corporate computers direct internet connectivity

It is encouraged to secure all devices and accounts, this means:

• Turning on automatic updates to update applications, programs and smart devices
• Activating multi-factor authentication across all of your accounts including emails, banking and social media.
• Backing up your devices every three to six months.
• Creating strong unique passwords for every account

First Line of Defence

To limit the risk of fraud and payment error, all accounts payable (AP) managers should conduct call-back controls to ensure the payee pays the correct invoices.

Some common challenges associated with AP teams conducting call-backs:

• They don’t independently source supplier contact details
• They rely on the return messages and incoming information
• They don’t ask the correct questions
• The people conducting them aren’t trained to detect fraud

Every time you onboard a new supplier or update your existing supplier, call-back controls are an essential. It is a simple, yet effective solution for your first line of defence.

The Bottom Line

As previously mentioned, cyber crime is an on-going issue and there are no signs of it slowing down in 2022. Therefore, being aware and understanding of how these threats are created, can minimise the chances of being at risk. For more information about this measure click here.