Cyber attacks are more sophisticated than ever before. And they’re causing more and more damage. Cybersecurity is therefore becoming a priority for businesses, and not only because of the new laws passed in February 2017 that created Australia’s Notifiable Data Breaches scheme. Since February 2018, organisations covered by the Privacy Act have had to notify affected individuals and the OAIC of eligible data breaches. In the US, Yahoo announced that hackers compromised the details of more than 1.5 billion user accounts in separate 2013 and 2014 attacks; in October 2017, it confirmed that the 2013 attack alone had affected all 3 billion of its accounts. In October 2016, DNS provider Dyn suffered a distributed denial-of-service attack that rendered popular websites such as Reddit, PayPal and CNN temporarily inaccessible. US intelligence agencies have even concluded that Russia ran an influence campaign targeting the 2016 United States presidential election, including stealing and leaking emails.
The pressure on Australian businesses hasn’t eased. ASD’s Annual Cyber Threat Report 2024–25 found that the average self-reported cost of cybercrime per business report rose 50% to $80,850, and the OAIC received 1,205 data breach notifications in 2025, the most since the scheme began.
But in cyber security, one size does not fit all. Cyber criminals don’t attack systems indiscriminately. They exploit specific weaknesses in specific systems. In today’s world of integrated marketing, CRM and e-commerce systems, no two businesses have exactly the same needs or vulnerabilities. So an off-the-shelf security solution isn’t enough to protect your crucial data.
The ideal security solution is one tailored to your business’s needs: one designed to protect your most important data and fortify the areas that hackers are most likely to attack.
The movement to bring your own devices (BYOD) means that many companies allow employees to bring their own computers and phones to work. The idea is that if an employee can perform tasks on a familiar device, they’ll work more efficiently. It might be a good idea for productivity but it’s a bad one for security. Each time you allow an employee to connect their own device to your corporate network, you create a potential security problem. Some employees jailbreak their devices to allow pirated apps to run – and many pirated apps contain malware. Employees can even end up with malware on their devices from normal web browsing.
Employee-owned phones are equally serious security risks away from the workplace. If an employee connects to a public wireless access point, for example, a hacker in the same location could use software to intercept and decode any unencrypted data transferred. Or if an employee loses a phone that doesn’t have full device encryption, a thief could steal the phone and access all of the data on it.
A large corporation typically has many different systems that interact with one another. Your business may have any or all of the following systems:
It’s likely that your business has integrated many of these systems. There are great reasons for integration. Integrating your network reduces hardware and infrastructure expenses. Integrating your CRM, CMS and marketing platforms helps you acquire new customers and provide better service to your existing customers. However, an integrated system also means that if a hacker penetrates one service, they could potentially gain access to every connected service.
Because corporate servers usually have some form of security software, hackers often look for an easier way in when they want to penetrate systems. Instead, they target the users. If a hacker penetrates an employee’s device or gets an employee’s network credentials, they gain access to everything the employee can access – and possibly more. It’s far easier to penetrate the deepest levels of a corporate network when you already have the access level of an employee.
Here are just two of the ways in which hackers can penetrate corporate networks through employees:
Just as different businesses have different security risk factors, they also have different needs. If your business is in the retail sector, for example, it’s likely that you store customers’ private information – such as names, addresses, phone numbers and credit card numbers – on your servers. If a hacker breaches that data, the results would be catastrophic for your business. On another server, your business may store corporate secrets about research and development, future business plans and other proprietary information. Your security measures should focus on protecting your business’s most crucial data.
Assessing your company’s risk profile is an important part of constructing a customised security solution.
Our cybersecurity by design approach recognises that all customers are not the same. Cybersecurity must now, and into the future, be built around a framework that provides structure and processes to manage changing cybersecurity requirements.
Cybersecurity is constantly evolving. Criminals are becoming more sophisticated and are very clever at finding new ways to access sensitive data. You would be foolish to think that your business is safe simply because it’s small. Our design framework gives you the tools, systems and processes to manage cyber security within your business – and the opportunity to develop a cybersecurity program that meets the unique needs of your business.
At StickmanCyber, we conduct holistic assessments on your cybersecurity by using the “by design” methodology which encompasses the implementation approach recommended by NIST.
Ready to design a cybersecurity strategy that fits your business needs?
No. ASD’s Essential Eight is a baseline of mitigation strategies, but its maturity model asks organisations to choose a target maturity level suited to their environment and the threats they face. ASD recommends reaching the same maturity level across all eight strategies before moving higher, and notes that even Maturity Level Three won’t stop every determined adversary.
Yes. ASD’s Annual Cyber Threat Report 2024–25 found the average self-reported cost of cybercrime for a small business rose 14% to $56,600. A small business strategy doesn’t need to be complex: ASD recommends basics such as strong multi-factor authentication, regular software updates, backups and staff awareness of phishing.
NIST describes risk assessment as the process of identifying, estimating and prioritising risks to an organisation’s operations, assets and people. It looks at threats, vulnerabilities and the likely impact if they are exploited, and considers the security controls already in place. The results show which data and systems need the most protection, which is the starting point for a tailored security plan.
ASD’s guidance on enterprise mobility recommends developing a strategy that balances business needs, security risks and compliance requirements. Use approved and managed devices, applications and security controls; enforce multi-factor authentication, encryption and regular security updates; and create clear BYOD policies, monitoring devices for security incidents and policy breaches. Keeping work and personal data separate also reduces risk.
It depends on the business. Organisations covered by the Privacy Act 1988 must take reasonable steps to protect personal information and report eligible data breaches under the Notifiable Data Breaches scheme. APRA-regulated entities must meet CPS 234, critical infrastructure owners have obligations under the SOCI Act, and businesses with an annual turnover of $3 million or more must report ransomware payments within 72 hours.