<img height="1" width="1" style="display:none" src="https://www.facebook.com/tr?id=1741336722824154&amp;ev=PageView&amp;noscript=1">
Partner Portal
KYOCERA Document Solutions
EN
    Contact Us
    Article Menu

    Introduction

    Your business is a potential target for cybercriminals.

    Like other organisations, you have probably reaped numerous benefits from digital technologies – from reaching global markets and reducing costs to streamlining operations and creating a more productive workplace.

    But as your business becomes more mobile and connected, you expose your systems, networks and data to more significant business cybersecurity risks.

    According to the Australian Signals Directorate, the cost of cybercrime increased by 14% in 2022-23, with the average cost per incident coming in at $46,000 for small businesses, $97,200 for medium businesses, and $71,600 for large businesses.

    A woman compares paper documents with data on a computer screen.

    And it’s not just the financial consequences that you need to be concerned about. A data breach can severely impact your business, leading to operational downtime, loss of customers, brand reputation damage, leakage of company secrets, identity theft, and compliance and legal issues.

    Effective data security is more critical than ever – especially in the era of hybrid work. Criminals, hackers and scammers are becoming smarter, and their methods and technologies are getting more and more sophisticated. Threat actors are increasingly able to circumvent security measures and access your most valuable asset: your business data.

    In fact, the same Australian Signals Directorate report found that 20% of critical vulnerabilities were exploited within 48 hours, despite patching or mitigation advice being available.

    It’s clear that to protect your business, you must stay one step ahead of cybercriminals. This guide will help you through the process of reviewing and improving your security strategies to protect your systems, networks and data. You will learn:

    • The top 5 cybersecurity threats facing Australian businesses
    • How these threats can compromise your data and what impact they could have on your business cybersecurity
    • How to improve your data security strategies and implement measures to keep your valuable business information safe and secure in the new era of work

    Chapter 1

    Phishing

    What is phishing?

    Phishing is a type of cyber attack that uses deceptive emails, phone calls, text messages and websites. The goal is to trick recipients into providing personally identifiable information (PII), such as contact details, bank account and credit card numbers, or usernames and passwords. Phishing can also entice people to click a link to a fake website or download an attachment with malicious software or malware.

    Phishing poses a significant threat to your business. It can lead to massive data breaches, compromised systems and financial losses.

    A woman looks at her phone while holding a credit card. Phishing scams can entice people to provide personally identifiable information.

    How to recognise phishing emails

    Fraudulent emails often use the same branding and logo as a popular brand, e.g., a bank, credit card company, telephone company, courier service, social media site, or payment provider, while text messages will appear to come from a known company. The email or text message will ask you to verify your personal details, confirm a package delivery, claim a prize, or complete a survey. It may also ask you to click a link to a fake website, reply to the message, or call a number.

    The hacker may even pretend to be from a software company, internet service provider or security firm informing you of ‘suspicious activity’ on your account.

    If you provide your information, these details can be used to steal your money or identity, gain access to business networks, or sold to other criminals.

    Phishing emails also frequently tempt victims to open an attachment. The downloaded file can contain a virus, ransomware or any type of malware that will compromise your system, server or network. However, as people have become more aware of the dangers of opening unsolicited attachments, some scammers now invite targets to google the name of a company and use SEO tactics to drive people to a corrupted website. 

    A group of businessmen and women discussing cybersecurity around a desk.

    3 ways to protect your business from phishing

    With phishing scams on the rise in Australia, it is crucial that you take the necessary steps to protect your staff members and business. You should:

    1. Install protection software

    Start by installing the latest firewall, spam filter, anti-virus, and anti-spyware software on all your computers, devices, and servers. This process is often overlooked and forgotten, but it’s essential to keep your protection technologies up-to-date so spam and phishing emails can be filtered out before they reach your employees.

    2. Monitor website, email and network activities

    Invest in technology that provides complete control and visibility across your business information environment, including print and document services. Automated monitoring solutions can track website traffic, email communications and other activities, alerting you to hacking attempts or malware infiltration.

    3. Educate your staff

    This is the most important step you can take to protect your business from phishing attacks, particularly those that come via SMS. Train your employees to be alert to the dangers of opening suspicious emails or clicking unverified website links in messages they receive. Remind them to only give out personal or sensitive information via email or text after confirming the validity of the source. You should also create clear policies and procedures for responding to and reporting a suspected phishing attack or data security issue.

    Working from home

    With increased connectivity and changing expectations in the workforce, working from home is easier and in higher demand than ever. While employers may have traditionally assumed that workers are less productive at home, the pandemic has proven that employees can be up to 48% more productive in their own homes. Allowing employees the flexibility to work from home not only improves workplace productivity but also cultivates staff loyalty and reduces sick days and absenteeism. The key is to employ technologies that enable staff to work productively from anywhere. Content Services solutions allow employees to create, edit and share documents efficiently and securely, ensuring they always have access to the right information to do their jobs well. Enabling remote collaboration also encourages more diverse, strategic and innovative thinking as opposed to working in siloed, isolated teams. Plus, it gives employers critical visibility over every single process, and it’s easier for businesses to assess how they can improve operational efficiency.

    Chapter 2

    Ransomware

    What is ransomware?

    According to a 2022 survey of IT specialists, 41% of Aussie businesses have been affected by a ransomware attack.

    Ransomware is a type of malware that restricts access to important files stored on a computer or server. It is one of the world’s fastest-growing and most damaging business cyber threats.

    A ransomware attack can lead to a massive data breach, exposing confidential materials, sensitive company information, employee details and customer data.

    It can significantly impact your business, including:

    • Loss of access to essential or highly classified business data
    • Significant operational downtime or disruption
    • Compliance and legal issues related to lost or affected data
    • Brand damage and loss of customers
    • Financial losses due to replacement or repair of compromised machines and devices

    How does ransomware work?

    Ransomware starts by infecting an unprotected computer, device or network with a virus typically attached to a phishing email or downloaded from a fake website.

    The virus encrypts your business data, making it inaccessible to the user. Sometimes, it can lock you out of your computer or stop your machine from working altogether.

    Once the system is infected, the hackers will threaten to release the information publicly or destroy the data unless you meet their demands (usually payment). Paying the ransom, however, does not guarantee the return of the data.

    A pensive woman sitting at a desk at a computer screen.

    3 ways to protect your business from ransomware

    Ransomware is designed to restrict your access to valuable business information. To protect your business and keep your data safe and secure, you should:

    1. Keep your operating systems and protection software up-to-date

    In January 2021, the Tasmanian Ambulance Service experienced a major data breach. The hackers were able to access and expose patients’ data because the organisation hadn’t upgraded their outdated radio communications technology.

    While not a ransomware attack, this example demonstrates how essential it is to reassess your technology and regularly update your machines and devices with the latest operating systems, security releases and patches. This should include protection and detection software like firewalls, anti-virus, anti-spyware and antimalware programs.

    2. Back-up files regularly

    Ransomware locks you out of your data and computer, so having a current backup could be one of your best defences. In the event of a ransomware attack, you can continue operating by restoring the backup files on another machine – thereby deterring the hackers. We recommend storing your backup data in several secure locations, such as on an external drive and in the cloud.

    3. Create a culture of security

    Like phishing emails, ransomware depends on people opening an email, clicking a link or downloading an attachment, so employee education and business cybersecurity training are critical to preventing an attack. This means creating a culture of security across all levels and departments of your organisation so everyone is aware, informed and prepared.

    Chapter 3

    Social Media Hacking

    What is social media hacking?

    Social media is now an important part of doing business. It lets you reach and engage with your customers on a deeper and more personal level that goes beyond the traditional website and direct selling.

    However, social media also opens the door to business cybersecurity risk. Targeted scams and other fraudulent activities can focus on gaining access to a company’s or high-profile business leader’s social media accounts. If your accounts are hacked, it can lead to numerous problems, such as damaging status updates, fraudulent links, and lost followers and customers, as well as significant reputational and brand damage.

    For example, hackers accessed 130 brand and celebrity Twitter accounts in 2020, posting tweets asking for Bitcoin. In just three hours, USD $118,000 was transferred to the cybercriminals by users falling victim to the scam. While the hack resulted from a Twitter vulnerability rather than stealing individuals’ passwords, it shows how much damage can occur when threat actors get access to your accounts.

    A man, sitting at a table with his laptop, looks at his phone. Social media hacking can open the door to cybersecurity risk.

    How social media hacking works

    Criminals, hackers and scammers usually start by researching your company on social media. They study your posts, frequency of updates and messages and gather any relevant information like company management and staff. Then they begin targeting your employees, devices and accounts by:

    • Sending targeted phishing emails to trick recipients into providing sensitive details like usernames and passwords.
    • Stealing your phone, tablet or computer that is automatically logged into your social accounts.
    • Gaining access to accounts while using social media across a public Wi-Fi network.
    A businessman in a light brown jacket looks at his phone.

    A hacked account can have a devastating impact on the business. One Australian small business owner lost 43,000 Instagram followers overnight when hackers blocked access to her account. In many cases, business owners are forced to start over with a new account, their months or years of hard work going down the drain.

    Working from home

    With increased connectivity and changing expectations in the workforce, working from home is easier and in higher demand than ever. While employers may have traditionally assumed that workers are less productive at home, the pandemic has proven that employees can be up to 48% more productive in their own homes. Allowing employees the flexibility to work from home not only improves workplace productivity but also cultivates staff loyalty and reduces sick days and absenteeism. The key is to employ technologies that enable staff to work productively from anywhere. Content Services solutions allow employees to create, edit and share documents efficiently and securely, ensuring they always have access to the right information to do their jobs well. Enabling remote collaboration also encourages more diverse, strategic and innovative thinking as opposed to working in siloed, isolated teams. Plus, it gives employers critical visibility over every single process, and it’s easier for businesses to assess how they can improve operational efficiency.

    3 ways to protect your business from social media hacking

    These are some easy-to-implement, practical ways to protect your business from social media hacking.

    1. Create a social media policy

    We cannot stress the importance of staff education enough when it comes to improving your data security.

    In particular, a social media policy can guide all employees on how to manage their personal and company accounts, including responsibilities, standards and expectations when using social media. The policy can also help your staff be more aware of data security risks, be alert to potential dangers and know how to respond to an attack.

    2. Implement strong passwords

    Your social media policy should make it mandatory for all accounts to have strong, unique passwords using a combination of upper and lower-case letters, numbers and symbols. Additionally, you should activate two-factor authentication, so your account remains secure even if your password is compromised.

    Tip: Strong passwords aren’t just for social media. Every password you create should be unique and complex enough that opportunistic hackers can’t guess it. Consider investing in a trusted password manager (i.e. not the Google default) for your business. 
    Close-up of a woman's hands typing at a laptop. Glasses and a mobile are in the foreground.

    3. Control access to social accounts

    The fewer people who can access your company’s social media accounts, the less risk you take on. Your social media policy should outline which employees require access and at what level. Make sure to update this regularly, especially when employees move on to other jobs. Regularly monitoring usage levels is also a good idea. This way, you can note any suspicious activity – and quickly act to shut down access.

    Chapter 4

    Malicious Insiders

    What is the risk with malicious insiders?

    Disgruntled current and former employees, contractors or other business associates can pose a significant risk to your business if they have access to your company’s network, social media channels, third-party platforms and, most significantly, data. Whether it’s for revenge, coercion, ideology, ego or financial gain, these threat actors use their legitimate access to your business assets to cause damage to your company.

    Most companies invest a lot of resources into improving security to combat external threats. However, some of the biggest business cybersecurity risks can come from malicious insiders such as former or current employees. In fact, a 2021 study of APAC organisations found that insider threats caused 58% of data security incidents in the last 12 months. Another global study found that malicious insiders perpetuated one-third of ransomware attacks.

    Accidental leakage by insiders is also a major issue. In 2022, Telstra accidentally published the data of thousands of customers online due to a “misalignment of databases”.

    In 2020, a Melbourne council accidentally published the contact details of hundreds of customers on a public website for seven months before they realised their error. The University of Tasmania experienced a similar issue on a grander scale when they exposed the personal data of 20,000 students – all because the sharing settings on an internal SharePoint site were misconfigured.

    The reality is that employees have access to company systems, networks and data, and whether purposely or accidentally, they can cause considerable damage to your business. They can send sensitive and confidential information via their personal emails, upload company files and documents to external and cloud-based storage platforms, or even infect your network with a virus that can damage databases and computer systems.

    Despite this risk, 59% of APAC businesses do not prioritise protection against insider attacks as they do for external attacks. The vast majority also don’t have an insider risk management policy.

    Close-up of four businessmen and women in discussion. Disgruntled current and former employees can become malicious insiders.

    3 ways to protect your business from disgruntled employees

    1. Limit and control data access

    One of the best ways to protect your business data is to limit and control the level of access staff have to confidential information. Employees should only be allowed access to the information required to do their jobs well.

    A lack of defined processes can also lead staff to leave important information in shared folders, lost laptops and USBs, on desks or in printer out trays.

    However, if your policy specifies that staff must access and share all sensitive information via your secure document management system (DMS), you can reduce the risk of the above scenarios. You just need to make sure that staff stick to the process.

    Consider implementing a DMS or enterprise content management (ECM) solution to monitor and regulate document access and usage. An ECM can set access rights for specific employees and record who accessed certain information and when.

    Working from home

    With increased connectivity and changing expectations in the workforce, working from home is easier and in higher demand than ever. While employers may have traditionally assumed that workers are less productive at home, the pandemic has proven that employees can be up to 48% more productive in their own homes. Allowing employees the flexibility to work from home not only improves workplace productivity but also cultivates staff loyalty and reduces sick days and absenteeism. The key is to employ technologies that enable staff to work productively from anywhere. Content Services solutions allow employees to create, edit and share documents efficiently and securely, ensuring they always have access to the right information to do their jobs well. Enabling remote collaboration also encourages more diverse, strategic and innovative thinking as opposed to working in siloed, isolated teams. Plus, it gives employers critical visibility over every single process, and it’s easier for businesses to assess how they can improve operational efficiency.

    2. Have proper on-boarding and off-boarding processes in place

    Your Human Resources (HR) department plays a major role in protecting your business from disgruntled employees, so make sure they implement strict onboarding and offboarding procedures for all employees.

    For example, you could require new employees to sign a non-disclosure agreement to protect your intellectual property and business information.

    When an employee leaves, HR should have a process to terminate access to company accounts, networks and data they have access to, even mobile phones.

    You can also use ECM workflows to manage the whole process and ensure all essential tasks are completed.

    Two women discuss a paper document in a covered, outdoor setting. On-boarding and off-boarding processes are essential.

    3. Monitor access and user behaviour

    It’s important to track and monitor user behaviour across your systems and networks. This will allow you to identify unusual and suspicious behaviour and respond accordingly.

    However, there is a fine line to tread here. It’s important not to go overboard and turn into ‘Big Brother’. A lack of trust showed by you will breed a lack of trust in your employees – which increases the chance of resentment that could lead to malicious acts.

    Chapter 5

    Data security breaches

    What is a document security breach?

    A document or data security breach involves unauthorised access or use of sensitive and confidential information, including personal details, employee and customer data, financial information, trade secrets and intellectual property. 

    A data breach can have serious consequences for a business, from loss of customers, brand reputation damage and leaking of company secrets to identity theft, lawsuits and compliance issues. The average cost of a data breach to an Australian business was $3.35 million in 2022.

    Under the Notifiable Data Breaches Scheme, Australian businesses with an annual turnover of $3 million or more are obligated to notify authorities and customers in the event of a data breach. Failure to comply can attract fines of up to $2.1 million.

    How a document security breach can happen

    Data protection is an ongoing concern for many organisations. With almost every machine and device now connected to the internet or local network, it is increasingly difficult for businesses to ensure their data is safe and secure.

    As we have explained throughout this guide, data breaches can be caused by phishing emails, ransomware, social media hacking, or disgruntled employees. This makes effective digital document storage and management critical. While most companies are constantly improving strategies and technologies to combat these threats, there are a number of common endpoints that are often overlooked, such as printers and MFDs.

    The risks posed by unsecured printers and multifunction devices (MFDs)

    The connected printer can bring numerous benefits to an organisation, including increased productivity, streamlined workflows and reduced costs. But if left unconfigured and unsecured, such as when devices are dispersed across multiple locations, printers and MFDs can expose the business to unnecessary security risks.

    The possible risks and vulnerabilities include:

    • Confidential information being left in printer trays
    • Unauthorised access to printer and administration settings
    • Hackers using your printer as a backdoor to your network
    • Hackers accessing sensitive data that has been sent via unsecured printers

    3 ways to protect your business from a document security breach

    Printers and MFDs handle a lot of company information daily – so how do we make sure that all the data (both paper and digital) is protected

    Here are some tips on how to improve your document security.

    1. Update and configure printers and MFDS

    Your first step should be to assess the security of all your printers and MFDs – and that should start with updating any default passwords.

    Ameer Karim, VP and GM of Consumer IoT Security at Symantec, said that printer default passwords are often never changed. This creates a weak link that hackers can exploit to penetrate the system. Cybercriminals can see the information printed and use the access point to hack the wider network and uncover more sensitive information, including financial data (CeBIT 2018, ‘IoT Security for the Real World’).

    Also, take the time to configure and update your machines and devices with the latest software and technologies. Speak to your printer provider about activating built-in security features and measures for every device. For instance, KYOCERA offers three levels of configuration: basic or standard, medium-level and high-level security.

    2. Monitor access and user behaviour

    A document management system (DMS) or enterprise content management (ECM) system stores files digitally in a central location, streamlining how documents are created, organised, shared and accessed across the entire document lifecycle.

    It can help enhance data security and keep your sensitive business information secure through:

    • Individual and group access levels and permissions
    • Regular automated back-ups
    • Document usage monitoring
    • Total visibility and control of data
    A businesswoman points at a screen with data and coding points on it.

    3. Implement a mobile security policy

    As workforces are increasingly decentralised, more and more employees work on their mobiles. That’s why it’s important to implement a stringent and detailed mobile device security policy to which all employees must adhere.

    This could include:

    • Enforcing operating system updates: These often include important security patches, so updates should be performed promptly.
    • Requiring employees to undergo business cybersecurity training: Teaching employees how to identify phishing attacks or how to access company data securely will go a long way towards ensuring your data remains safe.
    • Restricting the applications employees can download: Not all apps are secure, so you may want to restrict what employees can download to apps your IT department has deemed acceptable.
    • Implementing a public Wi-Fi policy: This may include stipulations like only accessing the company network while connected to a VPN or only accessing secure https sites when connected to a public hotspot.
    • Having a contingency plan in the event of a breach: In the modern threat landscape, it is not a matter of if you will suffer from a data breach, but when. It’s important to be prepared with a cybersecurity incident response plan that you’ve practised using.

    4. Work with a managed print services provider

    Managed print services (MPS) take a holistic approach to your document and print operations.

    Implementing an MPS solution can help you assess the security of your entire printer network, identify vulnerabilities and enhance the security of your systems and devices. This also gives your employees the mobility to work effectively and efficiently in the digital era.

    For example, Kyocera can provide a solution to archive all jobs executed on an MFD (copy, print, scan and fax), classify each job by user, job or user type, and pass usage data to your DLP (Data Leakage Prevention) system in a real-time for analysis. Additionally, you can choose to stop suspicious print jobs and alert appropriate staff before they are printed using a built-in DLP within KYOCERA security solutions.

    Close-up of hands checking a pile of A3 printouts in a factory setting.
    High angle view of a team of workers in an open-plan office environment.

    Conclusion

    Your business data is one of your most valuable assets and must be protected.

    This guide has addressed some of the biggest security threats businesses face, from phishing emails and ransomware to social media hacking, disgruntled employees and unsecured printers.

    But the fight against cybercrime is never over. Organisations must be vigilant to stay ahead of criminals. This means constantly reviewing your systems, identifying vulnerabilities and implementing measures to protect your business from potential data breaches.

    The interplay of print and document security is increasingly complex in the era of remote work. But Kyocera customers can count on our industry-leading expertise and proven ability to protect their business. Download our guide to the modern age of cybsercurity to learn more about our specialised document security solutions.

    Connect with Kyocera

    Reach out to a Kyocera expert for advice on how to implement Content Services today.

    Contact Us
    ©2024 Kyocera Document Solutions Australia