Cybersecurity: It's Covered

Somewhere in Australia this year, on a Tuesday no different from any other, a phone rang in a small business.

The owner answered it the way owners answer everything — half-listening, one eye on an invoice — while a calm voice explained that it was calling from the Australian Signals Directorate, the government's cyber people, about the business. The owner looked at the laptop. The screen was on, the files were open, the emails were arriving, and everything about the machine said Tuesday. So the owner said the only sensible thing a person can say when the most secretive agency in the country calls a business the size of a kitchen table: "Is this a scam?"

It wasn't an unreasonable question. It was just aimed the wrong way. The voice on the line does this for a living — last year it and its colleagues warned Australians more than seventeen hundred times about intruders moving through systems their owners believed were fine — so it was patient, and it mentioned details no scammer could know. And then the conversation arrived where every conversation like it must eventually arrive: at the question of what, exactly, had been protecting the systems.

And here the story turns, because the owner reached for the word every business in this country runs on — the word we use for the insurance, for the BAS, for Saturday's job, the word that means handled, mine, sleep well — and used it the way you'd grab a rail on a dark stair. "It's covered."

"Covered by what?"

Silence. The kind that changes a person. Because the honest answer was: whatever came with the laptop — a program never chosen, never named, never once opened — and the owner was discovering, live, on the phone to a federal agency, that "covered" had only ever been a feeling wearing a word.

What follows a call like that is paperwork and weeks, and a bill that for a small business now averages $56,600 — the Directorate's own figure, self-reported by the victims, fourteen per cent higher than the year before. And the strangest detail of all is that this Tuesday is not rare: in four ransomware cases out of ten, the victims never discover the break-in at all. The government does, and rings them. Which leaves the only question worth asking: how does a country full of people who watch every dollar end up hearing about their own break-ins from Canberra?

Rewind that Tuesday ten days, to the part the owner never saw. It begins in a market most people will never visit, in the unlit aisles of the internet where stolen logins are sold like inventory — close to three billion of them landed there last year, by the count in Verizon's annual breach report, a million more arriving every month — and where, filed somewhere between a stranger's Netflix and somebody's dentist, sat a password that had leaked years earlier from an app the owner had long forgotten. It cost its buyer about ten dollars.

The buyer wasn't a hacker in any sense the movies would recognise — just a man working through a list, and the owner's password was next on it. His software tried it, and it worked, because it was real. So what happened next never looked like a break-in. It looked like the owner, logging in. The program that came with the laptop watched it happen and saw nothing wrong, because nothing looked wrong — and even if it had sounded an alarm, there was nobody listening. Ten quiet days passed with a stranger inside the business. Then, on a Tuesday no different from any other, the phone rang.

Strip the uniform off that phone call and the man from the Directorate was only ever asking two questions — the same two the whole industry has buried under acronyms and lanyards for twenty years: can something get in, and if it does, are you back at work by lunch? That is the entire word "cybersecurity" at the size of a real business. Everything else is a bigger company asking the same two questions with more people in the room.

And if you're feeling cynical right about now — twenty years of being shouted at will do that — notice something: this story never needed you to be afraid. It needed you to be accurate. So here, plainly, is what would have saved that owner.

Two things. Software that watches what every program actually does — not what it's called, what it does — and shuts down anything behaving like an intruder, even one holding a real password. He bought the password; he can't buy the way you move, and moving like a stranger is what gets him caught. And a complete copy of the whole machine, taken automatically, kept apart, that nobody — not him, not you, not anyone — can quietly change or delete. One is the lock; the other is the reason the lock doesn't have to be perfect.

Both matter only if someone's checking they're running — four owners in ten found out from Canberra that nobody was. And if you do exactly one thing tomorrow morning, at no cost, make it this: turn on the second step — the multi-factor prompt — on your email. It makes a stolen password worthless.

So run the Tuesday one last time, the way it should go. The same list is sold. The same password is tried — and it still works, because it's still real. But this time something is watching how the stranger behaves, not just who he claims to be — wrong hour, wrong moves, wrong everything — and it shuts him out before his second step. Behind that, untouched, sits a complete sealed copy of the business, needed by nobody. The buyer's software registers nothing worth selling and forgets the business in the same millisecond it met it. The quote still goes out at ten. The invoice still goes out at four. And the phone never rings.

That is the strangest purchase in business: silence. A Tuesday with no story in it, nothing to see, nobody to congratulate you — just the place running the way you built it to run, while a spreadsheet somewhere scrolls on to the next name. So keep the two words; you've earned them everywhere else you run. Make them true first — a door that's watched, a copy that can't be touched, both checked while you work — and the next time anyone asks, across a counter or a contract or a line from Canberra, you can say them the way that owner couldn't.

"It's covered."

The quietest sentence in business, and the only one the government never has to ring you about.

Stay protected, my friends.
— THE MOST SECURE MAN ALIVE