Professional Services

Weaker Controls

Many professional services firms operate remotely on client sites like an accountant conducting an onsite audit. As a result the focus is easy access to resources on both corporate network and client’s network. In many cases, firms choose to remove or bypass security controls to conduct business. The focus on mobility and ease of access makes professional services firm vulnerable to cyber-attack.

Poor disaster recovery

Professional services SMEs might have adequate resources to plan for a disaster. They might not have a companywide backup strategy or robust controls to protect back up storage. Cybercriminals know that professional services SMEs lack strong cyber controls, and look for opportunities to exploit vulnerabilities. When the firm’s IT resources are wiped out and have no option for recovery, it’s the firm that pays the price. Between fines for exposing user data and the cost of recovery, that often means the firm ceases to operate.

False sense of security

Majority of the media attention is on cyberattacks on large organisations – like Optus or Medibank this sometimes gives a professional services SME a false sense of security, thinking they might not be a target of a cyberattack. This mindset sometimes leads to delay in planning or putting adequate security controls in place, leading to out of date devices with vulnerabilities easy to detect.