Cyber Security Action Month: Pick One Fix and Finish It

The Australian Signals Directorate (ASD) has changed the framing of October's Cyber Security Action Month on purpose. The campaign has moved from awareness to action. Its own wording is direct: "Awareness alone is not enough, it is time to turn awareness into year-round collective action." You can read the full message in ASD's post, Take a second to stay secure this Cyber Security Action Month.

ASD's five priorities for businesses

1. Replace or mitigate legacy technology.

2. Turn on proper event logging.

3. Choose products that are secure by design.

4. Start preparing for post-quantum cryptography.

5. Prepare for AI-enabled threats.

What this means for a small practice

For a team of around ten, three of these tend to be the real work.

Legacy technology. Think of the old server under the desk, or a PC running software that no longer gets security fixes. If you cannot replace it yet, mitigate it: isolate it, restrict who can reach it, and set a date to retire it. Our guide to Windows 10 end of support shows how to plan one.

Logging. A firewall nobody has logged into since installation, or logs that were never switched on, leave you blind. After an incident you want to know what was accessed and when. Without logs, you often cannot answer, and that affects whether you have to notify people of a breach.

AI-enabled threats. Start by listing the AI tools your staff use and protecting those logins. We cover this in Your AI logins are now a target.

Secure-by-design purchasing is simply asking suppliers how their product protects you before you buy. Post-quantum planning is mostly for vendors to lead, though it is worth asking yours what their plan is.

Choose one and finish it

A long list tends to produce no change. Pick one item this month and see it through to the end: retire the server, turn on logging, or inventory the AI accounts. A finished fix is worth more than five intentions.

This work sits naturally under the Essential Eight, the framework we use to prioritise security for Brisbane businesses. For the numbers behind the urgency, see the record year for data breach notifications, or talk to us about where to start.