Insights

Privacy Act: One small tweak that can make a big difference to data security and compliance

By:
Raj Tiwari,
Rachael Dean
11 Dec 202311 min read
insight featured image
If you only make one security tweak to your business, it should be this: turn on multifactor or two factor authentication. Multifactor authentication (MFA) is a simple change that can massively improve data protection. Without it enabled, your business or Not for Profit organisation could be in breach of the Privacy Act depending on the type of information you hold.
Contents

What is multifactor authentication? 

Multifactor authentication means accessing a particular app or system requires more than one method of identification. Without MFA, you log on via one device, with a single set of credentials.  MFA requires more from users based on three factors: 

  • Something you have, like a smartphone or a secure USB key 
  • Something you are, like a fingerprint or facial recognition.  
  • Something you know, like a password or PIN. 

For example, to log into Xero online, you enter your email and password. With MFA, you then need to confirm your identity another way – such as on your phone via the Xero app. If MFA is enabled for Microsoft Outlook and you log on using a device that isn’t trusted, you will also need to enter a security code that has been sent to a trusted email account or phone number.  

Whether it’s a text code, a fingerprint or a phone confirmation, MFA ensures more than one ID method is required to get into your important data. Most platforms and applications give you the option to switch it on through your security settings. 

It seems inconvenient – why would you bother?  

Single-factor authentication can make it much easier for a cybercriminal to compromise your bank accounts, accounting software, or business systems from anywhere in the world. All they need is your email address and password, which might have been stolen or leaked, or gained through phishing. 

With two-factor authentication, it becomes exponentially more difficult for malicious users to get access to your systems. According to Microsoft, there are more than 300 million fraudulent sign-in attempts on its cloud services daily: “All it takes is one compromised credential or one legacy application to cause a data breach.” It estimates that MFA can block more than 99.9% of account compromise attacks. If that seems too high, perhaps it is, but MFA is still highly effective; Google says its implementation of MFA halved the number of account compromises. 

When you have MFA enabled, it’s less concerning if your password is leaked or compromised. That alone won’t be enough to allow a hacker to gain access.  

Without MFA, you’re probably in breach of the Privacy Act 

The Office of the Privacy Commissioner recommends all organisations, regardless of their size to introduce MFA. When a breach occurs, one question often asked is whether an organisation has taken reasonable steps to protect the data they hold. If it is deemed the organisation did not take reasonable steps to protect its data, this could result in a breach of the Privacy Act. What’s reasonable depends on the size of the organisation breached and the scale and sensitivity of data it holds. No matter how small your business or charity might be, it almost certainly holds some personal information. It might be as basic as a list of members’ names, phone numbers and email addresses. Or perhaps it’s a more complex customer management system that includes payment details, health information or biometric data. As such, implementing the MFA is no brainer.  

Under the Privacy Act, every organisation or individual that holds data must collect it appropriately, keep it safe and allow the people it concerns to be able to access it (for more details, read the Privacy Principles).  

The Office of the Privacy Commissioner describes two-factor authentication as a bare minimum for small businesses or organisations that hold digital information. Without MFA in place, if someone unauthorised accesses your business data, you are likely to be in breach of the Privacy Act. This could lead to a penalty under the Act starting from $10,000; the most ever awarded is just over $168,000.  

The risks of a data breach go far beyond penalties, though. Your organisation may also experience potentially huge financial losses, reputational damage, and be forced to shut down. We know of one instance where a small online business experienced a data breach, and the cost of remediation and compliance was so high that dissolving the business was the best outcome. Cyber incursions are such a significant risk it’s hard to overstate their potential impact – yet many organisations are unaware of their responsibilities and risks.  

It’s all part of everyday risk management  

Cyber security can feel like a particularly thorny specialist topic that sits outside business as usual. But there’s a better way to think about it – cyber security is simply another risk management activity.  

It’s not separate or unique or different to other risks in your business, so managing it should equally be an everyday task. This means switching on MFA and getting everybody using it automatically, as well as keeping up to date with software patches and managing passwords effectively. Simple steps like these go a long way to protecting your organisation from breaches.  

In some cases, you might need to switch platforms to be able to access MFA for your organisation. We also occasionally see small regional organisations in areas that are digitally excluded, which can make this tricky. There may be workarounds available, or alternative platforms that can help.  

Create awareness and provide training  

We know that it can feel inconvenient to add MFA to apps you use frequently. If those who use your systems don’t understand the importance of using MFA, they may find this extra effort irritating, or try to switch it off.  

It’s essential to have all users on board. Education is the key – you need to explain to everyone why MFA is vital and why it is well worth the additional effort. You need to create awareness and provide training. According to research by Verizon, 82% of all cyber attacks “involved a human element”, and phishing scams still dominate social engineering attacks.  

We know that many small and medium enterprises and Not for Profits, don’t have in house IT and cyber expertise, however, being small or local doesn’t exempt you from the Privacy Act, so you still need to make the effort to not only enable MFA, but to understand your obligations under the Act, establish cyber security policies, and incorporate MFA into your overall approach to risk management.  

TAGS  

Related content

View more
2024: It’s time for businesses to be ruthless
Insights 2024: It’s time for businesses to be ruthless
Here comes the new year, and it would be lovely to think 2024 will be smooth sailing compared to the past three years. Unfortunately, that’s almost certainly not going to be the case. Instead, volatility will continue to reign as the pace of change only speeds up. Reflecting on 2023, most would agree it was a tough year, and those challenges are not going to disappear over the Christmas holidays. Businesses will continue to face cost pressures, high interest rates and staff issues in 2024. The world has fundamentally changed since the pandemic; buying patterns, financing, and technology have all been transformed. As a business decision-maker, not only do you need to get your head around our new economy, you need to do it while also tackling whatever new hurdles are thrown in your path. How can you help your business survive and thrive in 2024? The answer is simple: you must be ruthless. Start by building resilience When the economic landscape is in permacrisis, it’s essential to make your business as resilient as possible. To make sure you can ride the wave in 2024, you need to ensure your cashflow is reliable and predictable, and you must manage your costs. Look ruthlessly at your spending and outgoings to find efficiencies, while tightening your terms, invoicing and debt management processes to improve cashflow. The key is knowing what your cashflow is. Let go of underperforming products and services Cost-benefit analysis is valuable here as you decide what to let go. Crunch the numbers and identify parts of the business that aren’t providing strong and reliable profits, both historically and into the future. Ask yourself tough questions about those underperforming strands: ‘Why am I continuing to sell this product or service? Is it dying and do I just need to cut it out? Am I continuing to serve legacy customers because it’s in my comfort zone or I feel an allegiance to the past? Will I get a better return by investing the same amount of time and energy on something else?’ Cut out your D clients The Pareto principle, aka the 80-20 rule, says that 80% of your profits will come from 20% of your clients. Most businesses find this principle applies. This is an old exercise but an effective one: look at your client list and grade each one from A to D. Your A clients are the most profitable ones who are the best to deal with, and your D clients are the lowest-value, most headache-inducing to work with. It’s time to cut out your D clients and focus your energy on keeping, growing, and finding new A grade clients. Jettison outdated stock After the inventory rollercoaster of 2020 and 2021, some businesses are still sitting on outdated stock. Sell it if you can, provided you don’t cannibalise your own clients. In other words, don’t sell a cheap old item to a client who might otherwise buy a profitable new item. Instead, try to sell it to a market you’re not involved with. One of my clients was able to shift a huge amount of product to a dollar store, preventing the business from undermining itself. Otherwise, look for a way to give the stock away, or even better - recycle it if you can. Take legacy technology off life support Legacy technology is a drag on any business. We see it in government departments and large businesses, where slow, patchwork systems take hours to complete tasks that could happen almost instantly with up-to-date tech. Getting rid of desktops and landlines, and moving to the cloud, makes your business more resilient and cuts ongoing maintenance costs. Get the experts in to help your business transition to the cloud in a way that will work for your organisation – you should be able to find some significant efficiencies. Embrace AI The point of making all these cuts and cost savings is not only to boost your profitability and resilience. It will also free up funds so your business can be ready for the future, because any company not embracing AI will be left behind. As the pace of change increases, firms that embrace change, and have the knowledge and information to handle it, will accelerate their growth. Firms that keep doing what they’ve always done will start to fall behind. Eventually the gap between non-adopters and their AI-savvy competitors will become too wide to bridge, and the non-adopters will drop away. There will be some high-profile receiverships, but in general these failures won’t happen with a big bang. It will be death by a thousand cuts as small operators decide they’re too tired to keep fighting fires, decline to renew their leases, and let their companies wither away. Open that window of opportunity Skills shortages are already on the horizon for many industries, including accounting where the number of graduates is down by 40%. Overall university enrolment in New Zealand fell in 2022, in line with Australia and the USA which have also seen lower post-pandemic enrolment levels. When there are too few people to do the work, technology is filling the gap. We’ve seen this in our own horticulture industry, for example, where automation is being developed to pick fruit so we don’t need to rely on itinerant workers. And automation is much easier to apply to repetitive data-driven tasks – it will take over many of the drudgework elements of traditional roles undertaken by accountants, lawyers, managers or human resources. With the dreariest parts of the job outsourced, your business will be more efficient, and you and your team can concentrate on the kind of problem solving that needs a human brain - unlock that potential! Find accelerator opportunities The opportunities for innovative accelerators will be massive. Right now, as we head into 2024, we have a window of opportunity. This is the time to make change and prepare for a fast-changing future. By being ruthless now, you can set up your business to seize these opportunities when they appear. You can redivert resources to allow you to invest in technology so you’re better prepared for change and more resilient to challenges. The choice is stark when considering the outcomes. If you do nothing, your business will suffer and potentially dwindle away. But by changing the way you operate, you can become one of the accelerators, dominating in your niche and leaving your competitors behind. There is no middle ground.
Greg Thompson
Greg Thompson
| 11 min read | 11 Dec 2023
Cybersecurity: A vulnerable spot for NFPs
Insight Cybersecurity: A vulnerable spot for NFPs
Is your Not for Profit enterprise prepared for a cyberattack? If the answer is 'no', you're not alone. Our research report, Here for Good? uncovered some alarming statistics that highlighted cybersecurity as a major vulnerability in the sector
Barry Baker
Brent Kennerley
| 6 min read | 02 Aug 2023
A new PCI DSS version is coming: Are you ready?
Insight A new PCI DSS version is coming: Are you ready?
In March 2024, PCI DSS version 3.2.1 is officially retires and version 4.0 comes into full effect – and if your business accepts card payments, you need to ensure you’re ready. PCI DSS protects your customers’ information when they provide their credit/debit card details or planned payments, and you must comply with the standard.
5 min read | 01 Aug 2023
    View more