Is Your Website Patched? Four Questions From ASD's Small Business Guidance

Plenty of small businesses cannot say who is responsible for keeping their website secure. The Australian Signals Directorate (ASD) gives a simple way in. Its guidance on defending against AI-enabled cyber attacks poses four questions to put to whoever looks after your site.

The four questions

1. Is our website software still supported with security updates?

2. Are updates applied automatically, or quickly after release?

3. Is it made by a reputable company and set up securely?

4. If we are hacked, how fast will you notice, tell us and restore from a clean backup?

ASD also recommends switching off any website you no longer use.

How to read the answers

Good answers name a person, a frequency and a date. "Updates run automatically each night and I check the log weekly" is a good answer. "I think it updates itself" is not.

Pay special attention to question four. Many people have backups but have never restored one. A backup stored on the same server as the website may disappear with it. Our post on regular data backups explains what a trustworthy one looks like.

Why it is worth asking now

Attackers do not need to target you specifically. Automated tools scan the internet for sites running out-of-date software. Once in, they can use your site to harm your visitors, for example with the fake security checks we describe in ClickFix: the fake CAPTCHA that asks you to run a command.

If nobody can answer the four questions, that is your answer. Name an owner, agree how updates and backups work, and remove anything you no longer use.

The full guide is in ClickFix: the fake CAPTCHA that asks you to run a command. Patching is a foundation of the Essential Eight, and if you would like someone to ask these questions for you, get in touch.