Speaker 1: Hello, my name's Santasha Nabananga Bamblet. I'm a proud yorder
Speaker 1: order KERNI Whoalbury and a waddery woman. And before we
Speaker 1: get started on She's on the Money podcast, I would
Speaker 1: like to acknowledge the traditional custodians of the land of
Speaker 1: which this podcast is recorded on a wondery country, acknowledging
Speaker 1: the elders, the ancestors and the next generation coming through
Speaker 1: as this podcast is about connecting, empowering, knowledge sharing and
Speaker 1: the storytelling of you to make a difference for today
Speaker 1: and lasting impact for tomorrow. Let's get into it.
Speaker 2: She's on the Money, She's on the Money.
Speaker 3: Hello, and welcome to She's on the Money the podcast
Speaker 3: Millennials who want financial freedom. Guys, as you probably already know,
Speaker 3: my name is Victoria Devine and I don't have someone
Speaker 3: here with me today. I have a little solo episode
Speaker 3: for you today, all about keeping your small business cyber safe.
Speaker 3: I feel like at the moment, it's another day another
Speaker 3: high profile data breach Medibank, Canva Optist Latitude. But it's
Speaker 3: not just big corporations that are being targeted. Literally every day,
Speaker 3: individuals and small businesses are under attack and these stories
Speaker 3: just don't make the news because they're not that newsworthy
Speaker 3: according to the media. As a small business owner myself,
Speaker 3: this kind of terrifies me, and a cybersecurity attack could
Speaker 3: literally end my business but also ruin my reputation and
Speaker 3: hurt my community. But it is so easy to ensure
Speaker 3: that your business and your community and your customers are safe,
Speaker 3: and it's something that we all gloss over, right as
Speaker 3: a small business owner, it is something that we are
Speaker 3: so good at overlooking because it's always on the back burner.
Speaker 3: There's always something so much more important to do. But
Speaker 3: today I really want to chat to you about how
Speaker 3: to get cyber safe. But first i'm Statskirl, so I
Speaker 3: have come prepared with a number of stats for you.
Speaker 3: So research shows that women are not as confident as
Speaker 3: men when it comes to preparing, managing, and responding to
Speaker 3: cyber attacks, even though we are less likely to be
Speaker 3: scammed compared to our male counterparts. I feel like that's
Speaker 3: the only good thing to come out of that. A
Speaker 3: survey of more than two thousand small business owners and
Speaker 3: employees showed that while female business owners are less likely
Speaker 3: to be scammed compared to their male counterparts, they're not
Speaker 3: as confident as men when it comes to their general
Speaker 3: cybersecurity knowledge. And this survey it was part of the
Speaker 3: Council of Small Business Organization cyber Warden's program A mouthful,
Speaker 3: but it was developed in partnership with the CBA, so
Speaker 3: the Commonwealth Bank and Telstra. All right, let's start with
Speaker 3: arguably the most vital step, and that is passwords. I
Speaker 3: feel like I'm talking to myself here, one because this
Speaker 3: is a solo episode, but two because I'm really bad
Speaker 3: at passwords. They all used to just be one word,
Speaker 3: and everyone in my entire team used to know that word.
Speaker 3: If you knew my family, you probably knew that word.
Speaker 3: It wasn't good. But passwords really are your first line
Speaker 3: of defense against cyber break ins, and it's essentially the
Speaker 3: keys to your business. So strong, long and unique passwords
Speaker 3: make your accounts more secure and are more likely to
Speaker 3: keep out hackers. But now with the rise of supercomputers
Speaker 3: and AI having a short and simple password, it means
Speaker 3: that these are really easy for cyber criminals to crack.
Speaker 3: Reusing passwords across different businesses or even personal accounts can
Speaker 3: make you a target for what they call credential stuffing scams.
Speaker 3: One compromised account is like giving cyber criminals the master
Speaker 3: key to your entire business, which is really scaring. In
Speaker 3: really busy small businesses, the temptation to use short, simple
Speaker 3: passwords and repeat them is a really easy trap to
Speaker 3: fall into, and one I used to fall into until
Speaker 3: I learned about this and had to get myself to
Speaker 3: get If you're doing your best to create secure passwords
Speaker 3: and then struggling to remember them all, you're not alone.
Speaker 3: So pass phrases are actually your best line of defense. Now,
Speaker 3: if you're wondering what a passphrase was. When I first
Speaker 3: heard passphrase, I was a little confused, so they let
Speaker 3: me talk you through it. A passphrase are a type
Speaker 3: of password that are harder for cyber criminals to crack,
Speaker 3: and they're easy to remember, which makes them an easy
Speaker 3: cyber safety win. Passphrases are longer, and they actually contain
Speaker 3: a sequence of really random words, usually four or five
Speaker 3: of them, and the trick is making sure it isn't
Speaker 3: a proper sentence, but an easy combination for you to remember.
Speaker 3: So if you're wondering the how do I create a
Speaker 3: strong passphrase? A good passphrase generally contains at least four
Speaker 3: words that are completely unrelated and completely unpredictable, and the
Speaker 3: best way to generate a passphrase is to choose completely
Speaker 3: random words, be extra careful, and make sure that they
Speaker 3: don't contain any personal information. So if you were me,
Speaker 3: you wouldn't go, all right, well, I'll use my cats
Speaker 3: and my dog's name and my husband's name, because that
Speaker 3: is really easy to guess because it's all over the internet.
Speaker 3: It is not hard to find that information. Many websites
Speaker 3: now require you to have it a capitalized character, number
Speaker 3: and symbol, so you could still add this to a passphrase.
Speaker 3: So you could capitalize random letters, or you could add hashes,
Speaker 3: or you could add the at sign. You could also
Speaker 3: spell out numbers instead of just using the number and
Speaker 3: mix it all up. So that's what I've ultimately done.
Speaker 3: And the important thing here is that they're not words
Speaker 3: that are relatable to you. So I haven't used my name,
Speaker 3: i haven't used my cat's name. I've literally used random words.
Speaker 3: I've written down four key points that are kind of
Speaker 3: like pro tips when using passphrases. So let me whip
Speaker 3: through these really quickly so that we're all on the
Speaker 3: same page. Number one don't duplicate your passphrases. So what
Speaker 3: we want to do is ensure that each passphrase for
Speaker 3: each account is unique and we never double up. Ever,
Speaker 3: this means that if one does become compromised, you haven't
Speaker 3: breached all of your accounts. Number two, We're going to
Speaker 3: keep our passphrases to ourselves, so we're not going to
Speaker 3: share our log in details with team members. It might
Speaker 3: save some time and some money, but it honestly increases
Speaker 3: your cyber risks and it is not worth doing it.
Speaker 3: Number three is use a password manager to safely store passwords.
Speaker 3: So this has been a game changer for me. Apps
Speaker 3: can be used to securely manage passwords for all of
Speaker 3: your accounts, and using one is going to keep all
Speaker 3: of your accounts more secure. Number four is add a
Speaker 3: virtual alarm by pairing passphrases with multi factor authentication. So
Speaker 3: if your passphrase is ever compromised, multi factor authentication is
Speaker 3: going to add another layer of security to keep your
Speaker 3: account protected. And this for me, I thought it was
Speaker 3: going to be really complicated, but it's not. I have
Speaker 3: an app on my phone and it guards all of
Speaker 3: my accounts. It's a simple code. I pop it in
Speaker 3: and it just makes so much sense in all honesty,
Speaker 3: I don't know why I didn't do it earlier. Another
Speaker 3: massive threat to your small business is what's called a
Speaker 3: bin attack. No, someone doesn't come at you with a
Speaker 3: willie bin. Unfortunately, bin attacks are happening in Australia and
Speaker 3: they're increasing year on year. At the end of twenty
Speaker 3: twenty three, there was an ABC report who talked about
Speaker 3: a Melbourne based business who had more than fifteen thousand
Speaker 3: attempted transactions through their online shop in just a space
Speaker 3: of two months. You're probably wondering what's a BIN. So
Speaker 3: a BIN is a bank identification number and it refers
Speaker 3: to the initial sequence of four to six numbers that
Speaker 3: appears on your credit card. So it's the number used
Speaker 3: to identify a cards issuing bank or another financial institution.
Speaker 3: And a BIN attack is when cyber criminals steal BIN
Speaker 3: numbers and then attempt to generate working cards by guessing
Speaker 3: the remaining card numbers to check if these card numbers
Speaker 3: are linked to real cards. Fraudsters they test them on
Speaker 3: the payment page of your online shop and then if
Speaker 3: it's a successful transaction, it means they've guessed a winning
Speaker 3: combination of numbers and then they can start making a
Speaker 3: heap more fraudulent transactions, which is really scary. So although
Speaker 3: every bank card has sixteen numbers, it can be relatively
Speaker 3: straightforward and pretty fast for cyber criminals to cycle through
Speaker 3: the oldest of numbers that follow the bin in order
Speaker 3: to make enough correct guesses and find a live card
Speaker 3: number with accounts attached. So generating thousands of guesses and
Speaker 3: testing them is actually fairly easy for a cyber criminal
Speaker 3: thanks to the help of AI and computer bots. The
Speaker 3: cyber criminal might then use these working card numbers to
Speaker 3: make transactions themselves, or they might actually on sell those
Speaker 3: numbers to other criminals to use them for bigger and
Speaker 3: scarier things. Then, attacks pose two major risks to small businesses.
Speaker 3: So firstly, they can be really expensive. Depending on the
Speaker 3: contract with your payment gateway, you might actually be charged
Speaker 3: for each attempted transaction, so this expense can multiply really
Speaker 3: quickly if bots and AI are involved and your hit
Speaker 3: with a really large attack. Secondly, they can be a
Speaker 3: serious reputation risk when victims starts seeing your store charged
Speaker 3: on their credit card, which is terrifying because you know
Speaker 3: that wasn't you it was actually somebody else. So there
Speaker 3: are multiple signs of a bin attack. And here are
Speaker 3: some things that you need to look out for. So
Speaker 3: are you experiencing lots of low value transactions that might
Speaker 3: be pretty unusual for your business. You might have gotten
Speaker 3: a heap of notifications that your customer's cards have been
Speaker 3: declined multiple times. Have you seen the use of international cards,
Speaker 3: so banking cards consistently from countries that are outside of Australia.
Speaker 3: Maybe you've experienced a spike in transactions, whether they're attempted
Speaker 3: and processed in a short period of time and the
Speaker 3: same card number being used for multiple transactions. You might
Speaker 3: also have noticed strange transactions outside your normal customer behavior.
Speaker 3: So you might see things at three am in the morning,
Speaker 3: for example, when all your normal transactions generally take place
Speaker 3: between twelve pm and eleven pm. Or you might have
Speaker 3: seen an unusually significant increase in transaction fees from your bank.
Speaker 3: The final thing I want you to watch out for
Speaker 3: is a really unusual spike in customers disputing payments. If
Speaker 3: a group of customers all notice that their cards have
Speaker 3: successfully been used on your website, they might contact you,
Speaker 3: or they might just go direct to their bank and
Speaker 3: dispute the payment because they go, well, this is fraudulent,
Speaker 3: and process a refund or a chargeback. So these are
Speaker 3: things that I need you to be looking out for.
Speaker 3: And any small business with an online presence that accepts
Speaker 3: payments over the internet is ultimately at risk. And this
Speaker 3: includes me and I don't even have physical products. So
Speaker 3: the best thing that you can do is actually set
Speaker 3: yourself up with a payment processor that can identify these
Speaker 3: types of attacks. So when you're searching for this type
Speaker 3: of service for your online shop, I really need to
Speaker 3: make sure that you're reading through what they offer in
Speaker 3: regards to fraud prevention. Some processors may offer multiple additional
Speaker 3: layers of protection, requiring customers to type in a capture
Speaker 3: three D secure and the rate limit that you can
Speaker 3: easily implement on your website. And I've got a few
Speaker 3: points that I've written down here, so bear with me,
Speaker 3: my friends. So what these processes are going to do
Speaker 3: is check transactions are real and not a robot. This
Speaker 3: means that you're making sure that genuine customers can make
Speaker 3: their purchases, but a scammer using software to test various
Speaker 3: credit card numbers might not be able to get through.
Speaker 3: Adding a capture is one way that you can do this.
Speaker 3: So then we're going to want to limit transactions and
Speaker 3: set alarms for large transaction volumes. A rate limit actually
Speaker 3: prevents the number of new customers who can be created
Speaker 3: from a single Internet address in one day, which is
Speaker 3: really important if you're a small business where a customer
Speaker 3: only places maybe like one or two orders. A rate
Speaker 3: limit is a really sensible option and isn't going to
Speaker 3: impact your genuine customers because what type of customer is
Speaker 3: creating lots and lots of different accounts from the same
Speaker 3: Internet address right What it's going to do for you
Speaker 3: is ensure that a scammer can't process hundreds or even
Speaker 3: thousands of purchases through your website, which protects you and
Speaker 3: your consumer. And then the next thing you want to
Speaker 3: do is turn on a virtual alarm for online payments.
Speaker 3: Are you familiar with multi factor authentication for your online accounts?
Speaker 3: When you try to log in, you might have to
Speaker 3: enter like a code or a one time password to
Speaker 3: double check it's you. I mention before that I've got
Speaker 3: an app on my phone that lets me get into everything.
Speaker 3: And when I say everything, I mean everything. If I
Speaker 3: can multi factor authenticate something. I have my Facebook, my Instagram,
Speaker 3: obviously my bank, but also were recently I was able
Speaker 3: to multifactor my pet food ordering company. So we are
Speaker 3: going hard on this because it's so important, and to
Speaker 3: be honest, my credit card details are where my pet
Speaker 3: food is ordered, so I don't particularly want anyone jumping
Speaker 3: into that. And business is. You can do the same
Speaker 3: for all online payments. Its official name is three D
Speaker 3: Secure or three DS, but it works really simply when
Speaker 3: a customer's card is attempted to be charged, they will
Speaker 3: have to verify that you're the one trying to make
Speaker 3: a payment. Think of it like turning on a virtual
Speaker 3: alarm to online payments, which I think is really smart.
Speaker 3: Now let's go to a really quick break, because I
Speaker 3: feel like I have been talking underwater with a mouthful
Speaker 3: of marbles. So I'm gonna grab a coffee, and when
Speaker 3: we get back, i'm gonna give you my top four
Speaker 3: security tips for small businesses, and we're going to be
Speaker 3: talking about how to pimp your passwork. So don't go anywhere,
Speaker 3: all right, guys, we are back, and I did promise
Speaker 3: that I would give you my top four security tips
Speaker 3: and in a minute, I'll get to how to pimpy
Speaker 3: a password, but calm down, we actually need to get
Speaker 3: through these top four security tips first. So number one,
Speaker 3: I need you to make sure that you don't ignore
Speaker 3: software upgrades. I am always clicking the button that says
Speaker 3: remind me later, and it's really easy to do that
Speaker 3: when pesky software updates pop up on your phone or
Speaker 3: computer screen. Literally I have only just updated my iPhone
Speaker 3: and it has been months since the last update came out,
Speaker 3: and that is honestly not good enough. I also feel
Speaker 3: like whenever my computer needs an update, it always pops
Speaker 3: up at the most inopportune time. I'm jumping into a
Speaker 3: Teams meeting and my computer's like, oh hey, they good
Speaker 3: time to update your computer, and I always hit remind
Speaker 3: me later. But what you're gonna do if that happens
Speaker 3: is just set a little reminder on your phone so
Speaker 3: that you can come back to it. Software updates often
Speaker 3: contain really important patches or fixes for secure flaws in
Speaker 3: your operating system or software, so what we need to
Speaker 3: do is make sure that they're always up to date.
Speaker 3: Cybercriminals know about these weaknesses, and they know how to
Speaker 3: exploit them. It's why your software company wants to update
Speaker 3: them because they've identified them as well, and usually it's
Speaker 3: through a breach. So updating your software can close the
Speaker 3: gaps to make it harder for cyber criminals to break
Speaker 3: into your business, which is a win for everyone. And
Speaker 3: cyber criminals, let's be honest, they're quite intelligent. I mean
Speaker 3: I wish that they would use their intelligence for better
Speaker 3: but they don't. But they know this and they attempt
Speaker 3: to impersonate these trusted organizations to scam small businesses. So
Speaker 3: always check who is sending you this notification. Is it
Speaker 3: an email, Is that a trusted email? If it's a
Speaker 3: text message, make sure you're trusting where this is coming
Speaker 3: from before you action anything. In fact, across my entire life,
Speaker 3: I have decided to never click a link in a
Speaker 3: text message ever again, and I think that most businesses
Speaker 3: are on board with this nowadays. I know the banks
Speaker 3: are jumping up and down about how do not click links?
Speaker 3: We would never send you a link, We would never
Speaker 3: do that to you. So I feel like, if you
Speaker 3: want my business, you will not send me a link.
Speaker 3: You'll say, go to my website. I know your website.
Speaker 3: Oh key it in myself. Thank you. The second thing
Speaker 3: we're going to do is use multi factor authentication on
Speaker 3: your devices. So, as I said before, I'm obsessed with this.
Speaker 3: I have it now. It does make me feel a
Speaker 3: lot safer. Multi factor authentication is an added layer of
Speaker 3: security for your accounts that makes it so much harder
Speaker 3: for hackers to break in. Using multi factor authentication means
Speaker 3: that anyone who wants to log into your account is
Speaker 3: going to need to supply additional information in addition to
Speaker 3: your username and password, and some accounts use a unique
Speaker 3: text message wile others will suggest to use an authenticator app.
Speaker 3: So I use both. But I think it's really important
Speaker 3: that you're implementing these things. I told you that i'd
Speaker 3: tell you how to pimp out your password, so new
Speaker 3: financial year knew me, but also new password babe. The
Speaker 3: new financial year is a great time to wipe the
Speaker 3: slate clean with old passwords and usher in some new,
Speaker 3: stronger ones week. Passwords, especially those used across multiple accounts,
Speaker 3: are one of the biggest risks to cybersecurity for small businesses.
Speaker 3: As I mentioned before, a password manager can help you
Speaker 3: create strong passwords and then save them in a really
Speaker 3: secure place, meaning you don't need to remember them all
Speaker 3: for your accounts. They're in your password manager, which is
Speaker 3: completely protected. And then four, what we're going to do
Speaker 3: is back up our business. You back yourself in business.
Speaker 3: You need to back your actual business when it comes
Speaker 3: to protecting it from a cyber attack. What will you
Speaker 3: do if your small business was the victim of a
Speaker 3: cyber attack and your critical business information couldn't be recovered.
Speaker 3: There's a few things here, right. Let's pretend that someone
Speaker 3: attacks your business. You lose a heap of money, and
Speaker 3: the bank refunds all of your money. Fantastic money win. However,
Speaker 3: what about your reputation. I know that companies who have
Speaker 3: experienced these types of breaches lose a lot of customers.
Speaker 3: And they don't just lose customers because it happened to them.
Speaker 3: They lose customers because the reputation that they were safe
Speaker 3: makes people really, really worried. So it is so much
Speaker 3: more important than just worrying about the financial loss. A
Speaker 3: loss as important as business and customer data could be
Speaker 3: completely devastating for any small business, and a really good
Speaker 3: way to help protect yourself from that loss is to
Speaker 3: make a plan to regularly back up your critical business information,
Speaker 3: either through an external storage drive or in the cloud,
Speaker 3: or if you're me, you do both because you have
Speaker 3: anxiety while you make up a backup plan. It's a
Speaker 3: really good time to consider making an emergency plan in
Speaker 3: the event of a cyber attack. A sound emergency plan
Speaker 3: will outline how staff should report a suspected cyber incident,
Speaker 3: who would you contact for help, and how would you
Speaker 3: communicate any incident to customers or stuff, and how would
Speaker 3: you manage if critical systems are then offline for any
Speaker 3: period of time. An emergency plan sounds a bit silly,
Speaker 3: but it can actually help you feel in control and
Speaker 3: recover quickly in the event of a cyber threat or incident.
Speaker 3: The other thing I would say here is how do
Speaker 3: you educate your consumer in advance? So I know, because
Speaker 3: I own a mortgage broken company and we deal with
Speaker 3: money every single day, that at the bottom of our
Speaker 3: emails we are always letting customers know. It's literally in
Speaker 3: our email signature that we will never ask you via
Speaker 3: email to transfer funds. If we ever send you bank codes,
Speaker 3: BSB and account numbers to deposit money, it is not
Speaker 3: us because we would never do that. And I think
Speaker 3: that educating your consumer upfront is going to mean that
Speaker 3: you're protecting yourself as well as you can. Now, I
Speaker 3: feel like that was a lot, because it is a lot.
Speaker 3: Cybercrime is sadly on the rise, and I think it's
Speaker 3: so important to keep your small business cyber safe. It
Speaker 3: is something that has slipped to the wayside for a
Speaker 3: long time for me and now is not, thank God,
Speaker 3: But I think it's really important that you take it
Speaker 3: seriously as well. To me, one of the things that
Speaker 3: stopped me was it felt like an overwhelming admin task.
Speaker 3: So if you're going to do it, set some time
Speaker 3: aside and get it done, because it's one of the
Speaker 3: most important things that you do for your business. But friends,
Speaker 3: I know I have talked a lot about this. I'm
Speaker 3: happy to continue the conversation, but unfortunately when it comes
Speaker 3: to podcast time, that is all we have time for today.
Speaker 3: So if you'd like to chat more about this, we
Speaker 3: can jump into the Business Bible Facebook community. You can
Speaker 3: join us on Instagram. Obviously, we're a community that shares
Speaker 3: our business and money tips and tricks every single day
Speaker 3: free of judgment. So so she's on the Money or
Speaker 3: the Business Bible on Facebook and join us if Facebook's
Speaker 3: not your thing. Though, She's on the Money aus so
Speaker 3: don't forget to join the conversation and I will see
Speaker 3: you next time, hopefully for another solo episode. The advice
Speaker 3: shared on She's on the Money is general in nature
Speaker 3: and does not consider your individual circumstances. She's on the
Speaker 3: Money exists purely for educational purposes and should not be
Speaker 3: relied upon to make an investment or financial decision. If
Speaker 3: you do choose to buy a financial product, read the
Speaker 3: PDS TMD and obtain appropriate financial advice tailored towards your needs.
Speaker 3: Victoria Divine and She's on the Money are authorized representatives
Speaker 3: of Money sherper P t y lt D A b
Speaker 3: N three two one six four nine two seven seven
Speaker 3: zero eight afs L four five one two eight nine