More than two in five cyber crimes in Australia target small business. But most small business owners never give their cyber security any thought. We explore a new initiative to prevent them being easy targets.
Cosmic Cocktails boss Clint Gurney remembers all too well the panic he felt when he realised his business website had disappeared from the internet. "I put in cosmiccocktails.com.au and I went, 'Holy crap, where are we?'," he says. "That's just a feeling that you do not want to have. It's like someone just kicked you in the guts."
In a haze of disbelief, Gurney kept searching frantically. But the site wasn't there. It had been taken down by hackers almost six months earlier. The hack devastated the business. "We had nothing in our diary for the next 12 months, which was just unheard of," Gurney says. "We closed the business for two months. I had to put off all my staff, and just figure out what the hell we were going to do."
Being attacked by cyber criminals wasn't on Gurney's radar – and he's not alone. Small businesses are the target of 43 per cent of all cyber crimes in Australia, but most businesses are ill-equipped for an attack. "They don't know what they don't know," says WA AustCyber Innovation Hub at ECU director Dr Ian Martinus. "From my experience, dealing with small business in this state, particularly over the last 20 years, [they're] not very prepared at all."
ECU Security Research Institute (ECUSRI) director Professor Craig Valli agrees. "They're one of the most attacked places, but of course they don’t have the expertise or knowledge to actually help protect themselves," he says. Valli adds many small business owners also assume they won't be targeted, without realising cyber criminals could be after money or trade secrets, or use their business as a stepping stone to get to their larger customers.
Martinus, who recently returned from running cyber security workshops with Valli in Karratha, Western Australia, says lax cyber security practices can also hurt small businesses in the form of lost clients. "Oil and gas and resources companies in this state are starting to look at their supply chain," Martinus says. "If you're not compliant, and you don't have strong and rigorous cyber security practice and policy and technology, they won't deal with you. Businesses have to be mindful of that – and a lot of them are only at stage one of that understanding."
If all this has you worried, a new initiative known as Cyber Check.Me is arming small businesses with the tools they need to defend themselves. Described by Valli as a "helping hand" for small and medium-sized enterprises (SMEs), Cyber Check.Me raises awareness of cyber security and enables small businesses to reduce their risk with simple techniques.
Initially conceived by Valli and Martinus in 2012, Cyber Check.Me relaunched this year as a partnership between ECU, the City of Wanneroo, the City of Joondalup, AustCyber and North Metropolitan TAFE. The initiative targets SMEs through a series of pop-ups at local business events, forums and even coffee shops in local business districts.
The pop-ups are crewed by ECU and TAFE cyber security students, and offer hints and tips, brochures and general cyber knowledge for small business. Business owners are also encouraged to book in for a free, one-hour, one-on-one consultation with a cyber expert – ECU's second and third-year cyber security students.
City of Wanneroo economic development officer Shannon Crowe says Cyber Check.Me was a "no brainer" as a way of supporting local business. "Cyber crime is something that's out there that a lot of businesses don't know about," she says. "The stats are pretty alarming. And we know through our business association that a number of their members have been hacked in different ways."
Crowe says some local businesses had lost thousands of dollars to cyber crime. "Providing that service to business, where they can have the free checks and they can talk to somebody about it… it makes a lot of sense for us," she says.
ECUSRI project coordinator Jayne Stanley says most small business owners don't think about their cyber security until they hear the real-life stories of people losing everything to cyber crime. "That's what makes them take note," she says. "Until they see the reality of it, they don't think it's going to happen to them." Valli says Cyber Check.Me is about making small business more resilient. "Even though they're in the great state of Western Australia and the most isolated capital city in the world, they're not the most isolated capital city in the world with respect to cyber," he says. There's potentially 3.5 billion people [on the internet] who might try to steal stuff from them."
Valli wants to enable SMEs to help themselves. He says small countermeasures – such as patches, firewalls, encryption and anti-virus software – can have a big impact on a business’s resilience. "Everything we do is low impact," Valli says. "Often the only cost is their own time to do it."
Cyber Check.Me is also a great opportunity for ECU students. Valli says the students, who are paid to work on Cyber Check.Me, must learn to take their knowledge and explain it in a way that is simple enough for business owners. "We teach them, largely, the ones and zeros; the technical aspects," Valli says. "This is extending their skill set so that they can actually talk to people without using a lot of three‑letter acronyms." Some students, Valli adds, may even choose to start their own businesses supporting SMEs in the future.
North Metropolitan TAFE cyber security lecturer Stephen Oakley says his students, too, will benefit from skills working with potential clients and presenting at a professional level. "It's really great exposure for the students," he says.
Oakley jumped at the chance to be part of Cyber Check.Me when approached by ECU. "I saw it as a really great opportunity," he says. "One, to give the students a feather in their cap; something they can put in their resumes. Secondly, for those students who are looking to continue in their studies, a number of them are looking at ECU."
Project coordinator Stanley says Cyber Check.Me is taking off. "We're now looking at other councils, south of the river, that are wanting to get involved," she says. "They're hoping to potentially roll out the same model early next year. Word's getting out there. We're getting a lot of enthusiasm."
Cosmic Cocktails' Gurney is slowly fighting back. His customers are starting to return, but he still hasn't paid himself a wage for more than a year. He hopes sharing his experience will help other businesses avoid his own business's fate. "It not only affected me, it affected my staff, it affected my customers… it was just knock-on after knock-on," he says. "My blood, sweat and tears had all gone into it and it was literally, overnight, gone."
For more information visit www.cybercheck.me
Please leave a comment about your rating so we can better understand how we might improve the page.