Cyber threats are one of the leading risks for small to medium-sized businesses in New Zealand— now more than ever as
businesses move to more digital and remote ways of working to curb the spread of COVID-19.
Andrew Beven is a specialist in cyber insurance at NZI, New Zealand’s leading provider of business insurance.
“The switch to working from home happened quickly and unexpectedly — and cyber criminals were quick to take advantage of
the situation with COVID-19 themed scams.”
New Zealand’s national Computer Emergency Response Team (CERT NZ) has raised awareness of a range of COVID-19 themed
scams, including those designed to attack remote working systems like Nefilim ransomware.
Scammers and attackers are also using the public interest in COVID-19 to create opportunistic online scams and attack by
posing as the World Health Organisation (WHO) as an example.
“Reports of incidents were up 38% last year; from 3,445 in 2018 to 4,740 in 2019 according to CERT. The top three
attacks were phishing and credential harvesting, scams and fraud, and unauthorised access.
But just like risks to the physical security of your business, you can protect yourself against cyber threats with the
right preparation and tools.”
NZI has 10 top tips on how business owners can build their cyber resilience.But first, what is cyber risk?
“A cyber incident can be as simple as attaching the wrong file to an email which results in sharing confidential
information,” Mr Beven said.
“Or it can be more complicated and malicious, such as a hacker attack and loss of customer information.”NZI’s top 10 cyber safety tips for businessesUse strong passwords with multi-factor authentication
Use strong, unique passwords for every account and never share them. A good practice is to create a passphrase using a
minimum of four words you will easily remember which add up to at least 14 characters.
One of the most effective security controls to prevent cyber criminals from accessing your computers and applications is
multi-factor authentication, which means you need to provide a combination of proofs to access your devices. For
example, in addition to a password, you might need to provide a code that is sent to your mobile phone.
You can also use a password manager to create and keep track of secure passwords for all your devices, applications and
online services. You will only need to remember one master password — but be extra careful to keep it secure.Don’t ignore software updates
Cybercriminals can use weaknesses and security loopholes in outdated software to access your computer and mobile
devices. It’s important to install software updates as quickly as possible, so vulnerabilities can be fixed before
hackers have time to exploit them.
Enable automatic updates for your operating system (such as Microsoft Windows or Apple iOS/macOS) and applications (such
as antivirus and web browsers). And don’t ignore the notifications to update!Train your employees to be cybersafe
Your employees probably have different levels of experience and comfort with working online or remotely. It’s important
to help them understand that cyber-attacks are increasing, and criminals are using the COVID-19 pandemic to lure people
with malicious emails and websites set up to look like sources of information about the crisis.
Make sure employees are trained to use any new devices or software and know how to report a cyber incident. Some warning
signs that an email is fraudulent include suspicious attachments or links, poor grammar, messages that are trying to
create a false sense of urgency, and low quality of design.
Other good practices to implement include asking employees to verify any request to change bank details by contacting
the supplier directly using trusted contact details they’ve previously used; having more than one person approve
transactions over a certain dollar amount; and creating a process to make sure the business billing you is the one you
normally deal with.Install anti-virus software
Cyber criminals can use malicious code and software like viruses and spyware to delete or corrupt your files, steal
information or allow others to access your computer and your personal or business information. Anti-virus software can
help by monitoring and protecting your devices from infection.
Make sure your anti-virus software is set to automatically install updates, so it protects you against the latest
threats and viruses.Use a business VPN
Virtual Private Network (VPN) creates a secure web connection between your home devices and your office network so that
you and your employees can safely share data while working at home. Using a VPN will encrypt your network and help make
sure it can only be accessed by your employees.Remember to back-up important information
‘Backing up data’ simply means making a copy and storing it somewhere safe so that you can access it if your data is
lost or damaged. You should back-up important data such as customer details and financial information.
There are many ways to back up data, including cloud storage services. Maintaining the security of customers’ data is
critical for any business, so you should seek expert advice to ensure you do this to the highest possible standards.
It’s a good idea to regularly test your backups to make sure you can restore your data if and when you need to.Keep portable devices secure
If your employees are using laptops, tablets or mobile phones for their work, it’s important they update their devices
before connecting to your businesses network and make sure they have a basic understanding of cyber security.
The physical security of portable devices is important too. With more staff working from home, there’s a greater risk
that mobiles, laptops and other devices will be lost, broken or stolen. So, make sure all portable devices have strong
passwords and remind employees to keep the devices safe and secure when not in use.Assess risk in your home office
For many employees the living room, kitchen table or spare bedroom has become a co-working space they share with their
spouse, children or flatmates.
So, it’s important to be aware of how your employees are working, for example by setting up one-on-one video calls to
assess their environment and discuss any changes they need to make to their work processes.
In particular, you may need to create new or modified processes for how staff handle sensitive information, such as
going to a private room to have confidential phone conversations and ensuring computers are shut down and private
information is not viewable on screens by other people in the household.Stay cyber-clean
Once you have put your cyber security measures in place, you need to monitor and keep them up to date. It’s a good idea
to conduct an IT audit as least yearly, checking passwords, software updates and the security of your VPN.
The government’s CERT NZ website is a good source of advice for staying safe online and provides more tips for identifying cyber threats and
reporting incidents.Insure against the unexpected
NZI helps customers build cyber resilience by helping them understand and prepare for cyber risks and providing cyber
insurance, should the unexpected happen.
NZI Cyber Cover has a broad range of cover tailored for the needs of small to medium sized businesses, including:Claims against you for privacy breach and loss of employee, personal or corporate informationLoss or damage to your IT systems, records and dataBusiness interruption arising from a cyber eventLiability arising from a hacker attack or virusBrand and personal reputation protectionCopyright and trademark infringementCosts of negotiating and mediating due to an extortion attemptBreach of statutory dutiesFines and penalties incurred due to a privacy breach, as well as cover for your defence and investigation costs.NZI also offers a cyber assessment tool, so businesses can assess their cyber risk - https://www.nzi.co.nz/en/what-we-cover/cyber-cover/assess-your-cyber-risk.html.Businesses should speak with their broker for advice on the appropriate NZI cyber cover.