Don’t Be Next: Key ASIC Cyber Security Guidelines

Recently in the Tech News we saw that FIIG Securities is facing legal action from ASIC, the Australian Securities and Investments Commission, after failing to implement adequate cyber security measures over a period of more than 4 years!

This failure led to “the theft of approximately 385GB of confidential data, including included sensitive personal information such as names, addresses, birth dates, and financial details, affecting around 18,000 clients”

ASIC alleges that “FIIG did not have proper cyber risk management systems in place, which allowed a hacker to infiltrate its IT network undetected for several weeks in 2023”

This case serves as a stark reminder that cyber threats are no longer a question of “if” but “when.” If a cyber incident happens to your organisation today, do you know what to do next?

Common Cyber Incident Reports in Australia

Australia has experienced a significant increase in cyber-attacks, leading to financial losses, data breaches, and operational disruptions. Below are the common types of cyber threats reported to ASIC, along with recent incidents:

Ransomware Attacks Locking Critical Business Systems

• Ransomware involves malicious software that encrypts an organisation’s data, rendering systems inoperable until a ransom is paid. In February 2025, Genea, a prominent Australian IVF and fertility services provider, suffered a ransomware attack by the Termite group. The attackers exfiltrated approximately 940GB of sensitive patient data which were subsequently published on the dark web.

Phishing Scams Targeting Employees and Executives

• Phishing scams deceive individuals into revealing sensitive information, often through emails or messages that appear legitimate. ASIC has been actively combating such scams, reporting the removal of over 10,000 investment scam websites and online advertisements, including 1,564 phishing scam hyperlinks, between July 2023 and February 2025.

Insider Threats from Compromised or Malicious Users

• Insider threats occur when current or former employees misuse their access to harm the organisation. A notable example is the case of a former employee at the Australian National Maritime Museum (ANMM), who was jailed for a minimum of 15 months in March 2024 after manipulating financial systems to allegedly siphon $90,000 from individuals and businesses associated with the museum, highlighting the importance of internal controls to mitigate insider threats.

Supply Chain Attacks Exploiting Third-Party Vulnerabilities

• Supply chain attacks exploit vulnerabilities in an organisation’s third-party vendors or service providers. For instance, In July 2024, MediSecure, an electronic prescriptions provider, experienced a cyber attack resulting in the theft of personal data from approximately 12.9 million Australians. The breach exposed sensitive patient information, underscoring risks associated with supply chain vulnerabilities.

Why Do These Breaches Happen?

Many organisations fall victim to cyber incidents due to preventable mistakes. Some of the most common include:

• Weak or outdated security controls that leave systems vulnerable and ideal targets for cyber criminals.
• Lack of employee awareness and training making staff easy targets for phishing attacks.
• Poor access management allowing adequate access for attackers to escalate privileges.
• Delayed detection and response giving cybercriminals enough window of time to do damage.

Ignoring these risks doesn’t just invite financial loss, it opens the door to legal and reputational consequences.

ASIC recommends this guideline for companies to enhance cybersecurity and resilience:

1. Cybersecurity Strategy and Governance
   • Engage the board and establish responsive governance models.
2. Cyber Risk Management and Threat Assessment
   • Conduct routine threat assessments and manage third-party risks.
3. Collaboration and Information Sharing
   • Share information with other financial institutions, security agencies, and law enforcement to understand potential threats.
4. Asset Management
   • Implement centralised management systems for critical assets and ensure visibility of these assets.
5. Protective Measures and Controls
   • Use proactive measures like encryption and follow the Australian Signals Directorate’s strategies to mitigate cyber intrusions.
6. Detection Systems and Processes
   • Employ continuous monitoring systems and data analytics to detect threats in real-time.
7. Response and Recovery Planning
   • Develop and maintain plans to respond to and recover from cyber incidents.

These practices help organisations build a robust cyber resilience framework to protect against and respond to cyber threats effectively.

The Role of GRC and a Knowledgeable MSP

Governance, Risk, and Compliance (GRC) frameworks ensure structured risk management and regulatory adherence. A Managed Service Provider (MSP) with expertise in cyber security can offer proactive monitoring, rapid incident response, and strategic guidance to efficiently address an incident when it happens and fortify your organisation against future threats.

A cyber security breach can be devastating, but a well-prepared response mitigates damage and strengthens future resilience. If you need expert guidance, our Managed Cyber Security services extend beyond mere compliance to enhance your security posture, integrate robust cyber security practices, and maintain ongoing protection against evolving threats.

Let us help you secure your operations and ensure a resilient future. Contact us on 1300 307 907 today or fill out the form below.