Reduce the cyber security risk for your business

Protect Your Email Accounts

Email remains the most common entry point for cyber attacks.

• Enable Multi-Factor Authentication (MFA) on all email accounts.
• Use strong, unique passwords.
• Disable shared email logins wherever possible.
• Be suspicious of unexpected links, invoices, attachments and QR codes.
• Verify unusual requests by phone before taking action.
• Never enter passwords after following a link in an email.
• Regularly review mailbox rules and account settings.

Train Your Team

People remain one of the most important cyber security controls.

• Train staff to identify phishing emails and scams.
• Discuss recent cyber incidents during team meetings.
• Encourage staff to pause and question anything unusual.
• Create a culture where reporting suspected scams is encouraged.
• Ensure all team members know who to contact if they are concerned.

Remember: cybercriminals increasingly use legitimate compromised business email accounts, making attacks much harder to identify.

Secure Your Computers and Devices

• Keep Windows, servers and software up to date.
• Replace unsupported operating systems.
• Use reputable anti-virus and endpoint protection.
• Restrict administrator privileges.
• Remove software that is no longer required.
• Secure tablets, mobile devices and laptops.
• Review who has access to critical systems.

Review Remote Access

Remote access tools are frequently targeted by cybercriminals.

• Enable MFA on all remote access systems.
• Use complex passwords.
• Disable unused remote access software.
• Review who has remote access permissions.
• Remove access for departed staff.
• Regularly audit remote access activity.

Protect Your Data

Maintain secure backups.

• Keep backups in at least three locations:
  • Live data
  • Local backup
  • Offsite/cloud backup
• Regularly test backup recovery procedures.
• Ensure backup data is encrypted.
• Know how quickly systems could be restored following an incident.

Monitor for Threats

Prevention is important. Detection is equally important.

• Implement cyber security monitoring.
• Review security reports and alerts.
• Monitor for unusual login activity.
• Investigate suspicious behaviour quickly.
• Ensure critical systems are monitored outside business hours.

Recent pharmacy incidents have shown that early detection can be the difference between a minor incident and a major disruption.

Have an Incident Response Plan

If an incident occurs, speed matters.

• Know who to call.
• Document emergency contact details.
• Ensure staff understand escalation procedures.
• Immediately disconnect compromised devices if instructed.
• Change passwords where compromise is suspected.
• Preserve information that may assist investigation.
• Understand your reporting obligations.

Consider Privacy Obligations

Pharmacies are custodians of highly sensitive health information.

• Understand the Notifiable Data Breaches Scheme.
• Assess whether patient information may have been accessed.
• Seek professional advice following a cyber incident.
• Be aware that reportable data breaches may need to be reported to affected individuals and the OAIC.