Cyber crime: a driver of sleepless nights?

Advice businesses across Australia are all faced with the increased threat of cyber incidents.

Many hold data that is very sensitive about a client’s situation – whether it be health, tax or banking. Despite the increase in automation, there are still emails and files that can compromise a business. Sometimes these can be initiated from a client or a centre of influence and left in the inbox without being archived to a more secure environment.  

We have been conditioned to be more comfortable with limited human interaction in the process and to rely on digital interactions or communications. Working out where and when we maintain identity security, either face-to-face contact or verbal confirmation will become even more important. 

Licensees frequently raise these concerns within practices so that they understand the basic protective measures that can be put in place. Checklists highlighting particular at-risk elements like personal information changes or withdrawal of funds, for example. Or dual-factor authorisations, which are now the norm rather than the exception.

For a number of these, though, common sense and staff diligence remains the best defense. 

Scammers are becoming more sophisticated, and while specialty insurance is available, the significant increase in incidents will likely drive these costs up. 

Better licensees have engaged ongoing training for their teams by external companies in this area and staff are regularly put through fake scenarios to see how many get caught.  A reasonable proportion still get caught by phishing events.

While I am certainly no expert is this space, I have seen situations where businesses have been exposed by an event. When it happens, it can require the complete focus of the practice and this can go on for an extended period – weeks if not months. Cyber insurance providers often engage forensic experts to understand the extent of the intrusion and risk; this is expertise that does not exist within many practices.

A couple of key questions to consider:

• What protections do you have in place both in terms of policy but also in terms of infrastructure and operational practice?
  
  
• With changes in more digital exchange of information, what additional measures have you put in place?
  
  
• With more staff working remotely, what changes have been put in place?
  
  
• With many back offices being very busy, are processes still followed?
  
  
• If you operate under a licensee, have you fully adopted their policies and practices in this area?
  
  
• If you operate your own license, what policies and practices have you put in place?
  
  
• To what extent have you had this externally reviewed and how often do you get this done?
  
  
• To what extent do you have regular training in this area for your staff, both onshore and offshore, if these services are used?
  
  
• What is your archiving policy when it comes to your email system or network? Could this be done more regularly?

Being cyber-alert is the responsibility of everyone in your business: the board, the leadership team and every team member.  A spotlight on all business operations with this lens is so important. This is an area where you should engage your licensee if you have not already done so. 

If someone is impacted, there is also a reluctance to report and share for a range of reasons. In some cases, there is no choice dependent on the breach of information or incident.

There are three things that I think will start to emerge in this area that you should keep in mind: 

1. Greater sharing of incidents from insurers to lift awareness.
2. Mandatory adoption of cyber insurance for every practice, either by regulators or by licensees
3. Increases in premiums for this cover as well as adoption and validation of IT environments to qualify to participate, which will also lead to increased costs for practices.

If this is not on your radar for 2024, it should be.  

It's also not an area where you can take some initial steps and then decide the work is done. Cybersecurity evolves very quickly and requires constant review.