Client PortalCyber Security Basics
Five things every Australian business should have in place
You do not need to be a security expert to close most of the gaps attackers actually exploit. Five practical basics, passphrases, MFA, updates, backups, and spotting scams, in plain English, for business owners and their teams.
Why this matters
Most attacks succeed by exploiting basics, not by being sophisticated
The picture of a hacker breaking through advanced defences is a movie scene, not the typical attack on an Australian small or medium business. The real attacks are dull and effective: a guessed password, an unpatched system, a phishing email someone clicked, a backup that was never tested. Closing these five basics removes the most common attack paths and dramatically reduces the chance of a damaging incident.
The five basics on this page are the same foundation recommended by the Australian Cyber Security Centre. We have rewritten the guidance for business owners in plain English, with the practical implications a business needs to act on.
The five
The cyber security basics, in order
Each of these is meaningful on its own. Together they close most of the common attack paths.
Use passphrases, not passwords
A passphrase is four or more random words strung together, for example, cricket bridge yellow taxi. It is longer than a complex password, far harder for software to crack, and far easier to remember than a string of symbols.
The business action:
- Require passphrases of at least 14 characters on staff accounts
- Never reuse passphrases across business and personal services
- Use a password manager so people do not have to remember dozens of them
Turn on multi-factor authentication (MFA)
MFA asks for a second proof of identity when you log in, usually a code from an authenticator app or a tap on your phone. It defeats most common attacks even if your password is stolen. It is the single highest-impact security control most businesses have not yet enabled everywhere.
The business action:
- Enable MFA on email, Microsoft 365 / Google Workspace, banking, payroll
- Use an authenticator app (Microsoft Authenticator, Google Authenticator) over SMS where possible
- Make it a requirement for every staff account, not an opt-in
Keep everything updated
Most successful attacks exploit known vulnerabilities that already have a patch available. The window between a vulnerability being publicly known and being weaponised is often days, sometimes hours. Updates close the door before attackers walk through it.
The business action:
- Turn on automatic updates for operating systems and applications
- Apply critical patches to internet-facing systems within 48 hours
- Replace devices and software that are no longer receiving security updates
Back up regularly, and test the restore
A backup you have never restored from is a hope, not a backup. When ransomware or hardware failure hits, the difference between a few hours of disruption and a multi-day business-stopping incident is the quality of your backups and whether you can actually recover from them.
The business action:
- Back up everything important at least daily
- Follow the 3-2-1 rule: three copies, two different media, one offsite or offline
- Test a restore quarterly. If you have never done one, do one now.
Recognise scams and phishing
Phishing emails, fake invoices, business-email-compromise calls and SMS scams are still the easiest way attackers get in. The technical controls help, but a team that recognises a suspicious message and knows what to do is the difference between a click that costs nothing and a click that costs a six-figure incident.
The business action:
- Brief the team on red flags: urgency, unexpected payment requests, sender addresses that look slightly off
- Verify any payment-detail change request by phone, on a known number, never by reply
- Make it safe to report a suspicious message without blame
When the basics are not enough
The five above are foundational. For a business with employees, client data, regulatory obligations or cyber-insurance requirements, you also need a defined policy, technical controls implemented and maintained, and alignment to a framework. That is where ASD Essential Eight and SMB1001 come in.
How Agile IT helps
The basics, deployed and maintained, not just listed
Reading a list of cyber security basics is one thing. Having all five reliably in place across every staff member, every device, every system the business depends on, week after week, is a different exercise.
Within every AgileSECURE engagement, we deploy and manage the technical side of these basics, MFA enforcement, patching, backups, email filtering, and provide the policy and team training that makes the human side stick. The basics get put in once and stay in place, even as your team grows and the threat landscape changes.
The basics are not "set and forget". They are "set, maintained, and measured", that is the difference between knowing what good looks like and actually having it.
Questions