HSA July 2023

M E M B E R A D V I C E
Implement a privileged access
management solution that
enforces the principle of least
privilege. Regularly monitor and
audit administrative activities to
detect any unauthorized access
attempts.
By implementing these four
controls, you can significantly
enhance your organisation's
cybersecurity posture and reduce
the risk of cyber attacks. However,
it is important to remember that
cybersecurity is an ongoing process
and requires continuous monitoring
and improvement.
IMPLEMENTING THE
REMAINING FOUR CONTROLS
OF THE ESSENTIAL EIGHT
FRAMEWORK
5. Patching operating systems:
Just like patching applications,
keeping your operating systems
up to date is crucial in preventing
cyber attacks. Establish a patch
management process for your
operating systems similar to the
one for applications. Regularly
apply security patches and
updates to address known
vulnerabilities.
6. Multi-factor authentication
(MFA): Implementing MFA adds
an extra layer of security to
your authentication process. It
requires users to provide multiple
forms of identification, such as
a password and a unique code
sent to their mobile device, to
access systems or applications.
By implementing MFA, you can
significantly reduce the risk of
unauthorized access, even if
passwords are compromised.
7. Daily backups: Regularly backing
up your critical data is essential
to ensure business continuity
in the event of a cyber attack
or data breach. Implement a
comprehensive backup strategy
that includes regular backups of
all important data, regular testing
of backups to ensure data
integrity, and offsite storage to
protect against physical damage
or loss.
8. User application hardening:
This control involves
implementing additional security
measures for web browsers,
PDF viewers, and other common
applications. Configure these
applications to restrict potentially
malicious activities, such as
automatically executing scripts
or downloading files without
user consent. Regularly update
these applications to ensure
they have the latest security
enhancements.
THE ROLE OF EMPLOYEE
TRAINING IN CYBERSECURITY
While implementing the Essential
Eight controls is critical, it is equally
important to educate and train your
employees on cybersecurity best
practices. Employees are often the
weakest link in an organization's
cybersecurity defenses, as they
can inadvertently click on malicious
links, fall for phishing scams, or
mishandle sensitive information.
By providing regular training
and awareness programs, you
can empower your employees
to become the first line of
defense against cyber threats.
Start by creating a comprehensive
cybersecurity policy that outlines
the expected behaviour and
responsibilities of your employees.
In a hotel setting, this is for finance
and other back office staff, people
handling social media, users of
your business email accounts etc.
This policy should cover topics
such as password management,
acceptable use of company
resources, safe browsing habits,
and incident reporting procedures.
Conduct regular training sessions
to educate your employees about
the latest cyber threats, phishing
techniques, and social engineering
tactics. Reinforce the importance
of following security protocols
and provide practical examples
of real-world scenarios to help
employees understand the risks
and consequences of their actions.
30 | Hotel SA | www.ahasa.asn.au Back to Contents