Cybersecurity for small business in Australia: a practical starting point

Cybersecurity for small business does not need to start with expensive tools or enterprise-scale programmes. It needs to start with the controls that prevent the most common incidents — and in Australia, there is already a clear framework for that.

The Australian Signals Directorate (ASD) publishes the Essential Eight — a set of baseline mitigation strategies designed to make it significantly harder for adversaries to compromise systems. While the framework was originally aimed at government, it is increasingly used as a practical benchmark for any Australian business that wants to get the fundamentals right.

The Essential Eight at a glance

The eight strategies target three objectives: preventing attacks from landing, limiting the impact when they do, and ensuring data can be recovered.

Prevent attacks:

• Application control — only allow approved software to run. This blocks malware and unauthorised programs from executing on business devices.
• Patch applications — keep third-party software such as browsers, PDF readers, and office applications up to date. Unpatched applications are one of the most exploited entry points.
• Configure Microsoft Office macro settings — disable or restrict macros for users who do not need them. Macros remain a common delivery mechanism for malware.
• User application hardening — block unnecessary features in web browsers and other applications, such as ads, Java, and Flash, that attackers use as footholds.

Limit impact:

• Restrict administrative privileges — limit admin accounts to those who genuinely need them and use separate accounts for day-to-day work. Compromised admin credentials give attackers broad access.
• Patch operating systems — apply security updates to operating systems promptly. This closes known vulnerabilities before they can be exploited.
• Multi-factor authentication — require MFA on every account, especially email, VPN, cloud platforms, and remote access. This is one of the most effective controls against credential theft.

Recover data:

• Regular backups — maintain tested backups of critical data and systems. Backups should be stored separately from the production environment and verified regularly, not just scheduled.

Applying the Essential Eight in a small business

The Essential Eight uses a maturity model with three levels. Most small businesses should aim for Maturity Level One as a starting point — that already addresses the majority of common attack techniques.

The challenge for cybersecurity for small business is rarely awareness. It is consistent execution. Patching drifts behind schedule, MFA is enabled for some accounts but not all, admin privileges accumulate over time, and backups go untested. Partial coverage creates a false sense of security.

That is why a managed approach matters. Somebody needs to own the posture end to end, review it regularly, and close gaps before they are exploited.

Sentinel Stack includes cybersecurity and data protection as a core part of managed service delivery. We use the Essential Eight as a practical baseline for every environment we support — covering patching, access control, MFA enforcement, backup oversight, and ongoing review so that controls stay current as the business changes.