The Australian Signals Directorate’s (ASD) Annual Cyber Threat Report 2023-2024 highlights the increasing threats and costs to SMEs, particularly through vulnerabilities in operational technology (OT) systems – we suggest reading our article Hidden Cyber Risks of Office Printers for a primer on commonly overlooked OT devices.
Cybercriminals and nation-state actors view SMEs as prime targets because they often lack the resources and security measures of larger organisations. This makes them an attractive entry point for cyber threats that can disrupt supply chains, steal sensitive data and even cause physical harm.
Cyber threats are no longer just a concern for large corporations or government agencies. SMEs play a crucial role in keeping Australia’s economy and infrastructure secure. Yet many SMEs underestimate the cyber risks they face, especially now they rely on OT to conduct everyday business processes.
Why Are SMEs at Risk?
1. SMEs are Gateways to Larger Targets
Many SMEs work with larger enterprises, providing goods, professional services and software. A weak link in a small business’ cyber defences can give attackers access to more extensive, high-value networks.
2. SMEs Often Lack Cyber Security Investment
Unlike large corporations with dedicated IT teams and budgets, SMEs often struggle with limited cyber security resources, leaving gaps that attackers exploit.
3. OT Systems are Increasingly Connected
As SMEs adopt smart technologies and Internet of Things (IoT) devices to improve efficiency, these systems become interconnected. Without proper security, cybercriminals can exploit these connections to cause disruption or even take control of operations.
6 Principles of OT Cyber Security for SMEs
To help SMEs defend against cyber threats, the ASD has outlined key principles for protecting OT environments:
1. Safety is Paramount – Ensure the System is Safe
Cyber incidents in OT can have real-world consequences, from operational shutdowns to risks to human life. SMEs must prioritise system safety to prevent physical and financial damage.
2. Know and Defend Your Vital Systems
Understanding how your business operates is crucial to protecting it. Identify key systems, processes, and vulnerabilities so you can implement effective cyber security measures.
3. Protect Your OT Data
OT data, such as system configurations and control settings, is highly valuable to cybercriminals. Secure access to this data and limit its distribution to prevent unauthorised tampering.
4. Segment and Segregate OT From Other Networks
Many cyberattacks occur because OT systems are connected to broader IT networks, including the internet. SMEs must keep OT networks separate and restrict access to reduce exposure.
5. Secure Your Supply Chain
Every software tool, device and managed service provider you use could be a potential entry point for attackers. SMEs should vet suppliers for cyber security risks and ensure their partners follow strong security practices.
6. Train Your People – The First Line of Defence
Technology alone cannot stop cyber threats. Your employees must be equipped with the right training and awareness to identify risks and respond effectively to incidents. Your organisation’s cyber security culture must support practical safe practices.
Edge Devices: A Silent Entry Point for Cyber Threats
Especially now working from home is a much more, albeit under-monitored, scenario, one of the biggest cyber vulnerabilities SMEs face is through edge devices—routers, VPNs and firewalls that connect internal systems to the internet. Attackers target these devices because they often contain unpatched vulnerabilities, giving cybercriminals a backdoor into business networks.
Simple steps your staff should undertake to secure edge devices include:
- Regularly updating routers and enabling automatic updates where possible.
- Changing default Wi-Fi network names and passwords.
- Updating router usernames and passwords to prevent unauthorised access.
The Cost of Inaction: Business Disruption and Reputation Damage
A cyberattack can bring a business to its knees. The consequences of a breach include:
- Operational downtime – Loss of productivity and revenue.
- Legal and compliance issues – Failing to protect sensitive data can lead to penalties and lawsuits.
- Reputation damage – Customers and partners lose trust in a business that fails to secure its systems.
Investing Time Now to Save Your Business Later
Cyber security is not just a technical issue—it is a business continuity and reputation issue. SMEs that take proactive steps to secure their OT and IT systems can protect themselves from becoming an easy target. By implementing the ASD’s OT Cyber Security Principles and securing edge devices, SMEs can safeguard their business, customers and Australia’s broader security landscape.
Cyber Collab is here to support SMEs with practical, effective solutions to enhance their cyber resilience. Our Cyber Health Check Service helps businesses assess their current cyber security posture and identify critical vulnerabilities. Through penetration testing, we simulate how real-world cybercriminal might uncover and be able to act on your weaknesses. Our training empowers Boards and employees with the knowledge and skills to identify and mitigate cyber threats. Additionally, our Tabletop Scenario Exercise prepares your leadership team to respond swiftly and effectively to cyber incidents, minimising downtime and reputational damage.
In today’s evolving threat environment, cyber security is not a luxury—it is a necessity. Now is the time to act.
Need help securing your business? Cyber Collab is here to help SMEs strengthen their cyber security posture. Contact us today to learn more about how you can protect your OT and IT systems from cyber threats.