By Peter Maynard >>

IF YOU THINK cyber security is an IT issue, think again. Fast.

Despite two decades of information technology (IT) weaponry, cybercrime attacks and breaches are only escalating. The reason has surprisingly little to do with software.

Fortunately, cybercrime is starting to be identified for what it truly is, a whole-of-organisation risk that requires a much broader strategy than a good firewall and some anti-virus software. 

Good cyber security guidance has always been difficult for small-and-medium enterprises (SMEs). Typically, it’s via internal IT teams or external IT providers. These guys will often have the latest tech solutions, but it’s simply not enough anymore.

Cyber criminals have shifted focus from frontal tech attacks to the largely unguarded side door, otherwise known as you and your people. Fake websites, fake emails, dangerous attachments, insecure links… this is known as ‘social engineering’ and it’s come a long way since African finance ministers’ cousins. One clever phone call and an attacker has access to your computer network, your credentials, your bank accounts, your data – your entire business.

Then there’s the question of what to do if you are breached. After all, what does your IT team know about managing reputation loss, responding to a regulator, or preparing to front the media and clients? Not a lot and nor should they. That’s not their job.

But maybe you think you’re too small to target or have nothing worth stealing. You’re not alone. Nearly 60 percent of SMEs don’t consider cyber crime to be a big risk to their business. About 44 percent don’t even consider strong security to be a priority – and 77 percent of SMEs believe their company is safe from an attack.

This is perfect for cyber criminals who can easily piece together masses of ‘small’ information from hundreds of organisations, or use smaller, easily-breached businesses to move up the supply chain to larger organisations or governments.

The fact is every organisation has something of value (its crown jewels), and so cyber security must be on the radar of every SME. In 2017 the number of small businesses that experienced attacks went from 55 percent to 61 percent. In one year.

For many of them, it was too late.  Reputations destroyed; customer confidence lost; significant financial, data and productivity losses. In fact 60 percent of SMEs go out of business within six months of a data breach.

Whether your organisation is hundreds of people or just you, the numbers say you will be hit by cyber attacks. Some you won’t even notice. And even if you have invested in important security controls (defences) like next-generation firewalls, intrusion prevention systems, anti-virus software and monitoring tools, it’s important to understand they don’t provide a full defence. Nor do they address the whole range of other risk mitigation components and strategies you need to manage the risk that cyber attacks represent to your business.

No matter what size your organisation, the best starting point is simply understanding the eight critical areas that a holistic cyber risk management strategy should be addressing.

1. Security culture – Cyber security is a risk issue that spans every part of your organisation and everyone has a role to play. How important is security to everyone in your business?
2. Self Awareness – Every business irrespective of their size or sector has ‘crown jewels’ or digital assets of value. How aware are you of your digital assets and what you have to lose?
3. External Awareness – The cyber security landscape is constantly changing. How aware are you of the threats and risks that your business will need to defend and protect against?
4. Identifying your Digital Assets – Knowing what you have to protect is fundamental to being able defend your business. Do you know what digital assets you have, where they are and who has access to them?
5. Preparing to Protect – Using technology solutions to protect against cyber attack is essential. Do you have the right tools in place to protect your business and its digital assets?
6. Ability to Detect Intrusion – Despite the best preparation, even the biggest get breached. How well are you set up to detect an intrusion before it can cause serious harm?
7. Ability to Respond - Cyber attacks are seemingly unavoidable for most businesses. How well prepared is your business to respond to the threats and minimise the damage?
8. Ability to Recover – You’ve been breached. How do you go about rebuilding your business and your reputation? Who tells your clients? What’s your plan?

If you’re like most businesses, you focus on number five – your tech solutions. But the other seven are equally important. 

Admittedly, this means a longer to-do list. The Australian Small Business and Family Enterprise Ombudsman released a great resource earlier this year titled Cyber Security: The Small Business Best Practice Guide. Their recommendation is to begin with an assessment of your business’s current cyber security.

A good cyber security evaluation should help you to prioritise your limited time, budget and resources by giving you a clear understanding of what you’re doing well and where your gaps are across your whole cyber security profile, not just your tech.

With this, you can develop a strong cyber risk management strategy – the goal for every SME. Without it, you will only ever be shooting from the hip.

So while it’s true the days of governments and software companies protecting us from cyber attacks are over, the good news is you can take control of your cyber security. With a little time and planning it doesn’t have to be hard or expensive. Regardless of what size you are, your turnover or your sector, the principals are the same.

And the most important thing you can do right now… is start!

Peter Maynard is co-founder and CEO of Australian cyber risk management advisory firm, CyberMetrix. CyberMetrix assists individuals and organisations of all sizes to understand and assess their cyber risk and partners with them to grow their risk management capability. https://cybermetrix.com.au

EXTRA >>

Why SMEs? Why now?

To the average cyber criminal, SMEs are the perfect soft target. They know they’re time poor and don’t have access to the same resources as the big guys. They typically think their firewall (router) and antivirus is enough or that they too small to target. And statistically, they’ll only try to do something after you’ve been attacked.

• 43% of cyber attacks target small business.
• 93% of breaches caused by human error.
• Over 50% of small businesses experienced a breach in 2017.
• 99% of computers are vulnerable to exploit kits.
• Attackers often target thousands of businesses at a time hoping one will bite.
• Attackers can use small business to infiltrate big organisations: Target in the USA was breached via an air conditioning contractor.
• On average it takes 120 days for a business to discover a data breach.

ends

BUDGET 2018 >>

MANAGING partner of Australian venture capital group OneVentures, Anne-Marie Birkill, has opened up wider discussion on the treatment of research and development after the changes announced in the 2018 Federal Budget.

“We are strong advocates for the R&D tax incentive, believing it provides capital constrained, research intensive companies like those in our portfolio with important funding to ensure they achieve their R&D objectives,” Ms Birkill said.

“We have many examples of companies that have continued to undertake R&D in Australia rather than moving to less expensive jurisdictions because the R&D tax incentive makes undertaking R&D in Australia economically viable.  

“Ideally, we would prefer there was no cap for research intensive companies however, we are realists and understand the government cannot have an uncapped and ever-expanding obligation.

“But one of the things that seems to have escaped commentary is that the R&D tax refund funds job creation – and those new employees pay tax; often at high rates as these are highly skilled roles.

“This means that the R&D tax refund is significantly offset by PAYG tax. And of course, there are all the other benefits of more R&D being done in Australia – including wealth and asset creation.”

The Federal Government announced changes to the R&D tax incentive that come into effect from July 1 this year.

A $4 million annual cap will be introduced on cash refunds for R&D claimants with aggregated annual turnover of less than $20 million. Amounts that are in excess of the cap will become a non-refundable tax offset and can be carried forward into future income years.

To be excluded are R&D tax offsets for clinical trials, from the $4 million cap on cash refunds, recognising the critical role of R&D expenditure on clinical trials in developing life changing drugs and devices.

The refundable R&D tax offset is to be amended so it is a premium of 13.5 percentage points above the claimant's company tax rate for that year.

OneVentures has been directly and indirectly contributing to the debate on Australia’s R&D tax system for several years, largely through its membership of the Australian Venture Capital and Private Equity Association Limited (AVCAL). Ms Birkill is a director of AVCAL and a member of its VC working group.

www.budget.gov.au

www.one-ventures.com.au

ends

BUDGET 2018 >>

THE CEO of Australia’s largest specialist SME working capital provider, Peter Langham of Scottish Pacific, said the 2018 Federal Budget was generally good news for the start-up and small to medium enterprise (SME) sector.

Mr Langham said while there were no major shocks in the 2018-2019 Budget, the key initiatives that will resonate with Scottish Pacific’s SME clients were: reducing red tape and time spent on BAS compliance; continuation of the $20,000 instant asset write-off; and pressure on the black market, which could help create a level playing field for SMEs.

While the government took tax cuts for large companies off the table, the continuation of plans to reduce SME company tax was welcomed, he said.

“Our clients are SMEs, the largest employer group in Australia,” Mr Langham said. “These business owners are mostly mums and dads, who are very busy, and risking it all to run a business and have a go. 

“The personal tax cuts flagged in the Budget are welcome as this will give SME owners more money to spend – and I believe most are likely to spend it on growing the business – because it is their business.”

Anything that encourages spending is welcome by businesses of all sizes, Mr Langham said. Increased dividends through lower tax rates at the higher end should improve superannuation returns and therefore benefit most Australians in retirement.

“Infrastructure spending is good for business because of the immediate demand it creates, but also because it introduces efficiencies that should reduce SMEs’ cost of doing business,” he said.

“There are three obvious areas in the Federal Budget where more could be done for the SME sector – encouraging employment, creating more skilled labour and further simplifying company taxation.

“It wouldn’t be an easy task, but I’d love to see the Federal Government working with the states to reduce the payroll tax regime – this would be a game-changer for small business.

“A growing business gets to a certain size and this tax discourages them from employing people, so in effect it discourages growth.”

Mr Langham said Scottish Pacific experts had identified key areas in the Federal Budget that would affect SMEs:

1. $20k instant asset write-off extended a further 12 months

This scheme, where business can claim an immediate deduction when buying an asset costing less than $20,000, was meant to come to an end on June 30, 2018, but the Federal Government has extended it for another year.

2. Infrastructure

• $24.5b over 10 years for nationally significant transport projects including $3.5b for strategically important roads to boost freight routes
• $200m for Building Better Regions Fund (supporting regional infrastructure)
• $41m allocated for national space agency
• $1b urban congestion fund to improve city traffic flow

3. Red tape/tax/compliance

• The Federal Government declared BAS streamlining had saved each SME an average annual $590.
• No new corporate rate cuts, however previously announced cuts for SMEs were still planned.
• The government flagged moves to protect SMEs against phoenix companies who don’t pay, or large businesses putting in place unfair contracts.

www.scottishpacific.com

ends

BUDGET 2018 >>

BUSINESS broker Raine & Horne Business Sales principal Simon Winter believes calls to extend the $20,000 instant tax write off indefinitely are “almost certainly premature given similar incentives in the past were eventually terminated”.

In the May Federal Budget announced last week, the Federal Government extended the $20,000 instant write-off for small business clients with a turnover of less than $10 million to the June 30, 2019.

“Before the budget was released, one media poll declared that 60 percent of respondents were hoping the government would make the scheme permanent,’ Mr Winter said. 

“However, you must look at why they are doing it.

“It’s a carrot aimed at encouraging manufacturing and employment. The instant tax-write off pushes employment and manufacturing along because the write-off gives businesses the incentive to buy something new.” 

Mr Winter said the current write-off regime is also not the first time a Federal Government had introduced depreciation acceleration.

“There have been several tax breaks used by different governments over the last four decades, with different levels of depreciation acceleration used,” said Mr Winter, a Certified Practising Accountant (CPA), and a member of the Australian Institute of Accountants.

“Small businesses earned a 40 percent write-off over and above the value of the plant or equipment about 10-15 years ago that virtually no one seems to remember,” he said.

“You could buy an item for $10,000 and immediately write-off $4,000. However, you could still claim the full depreciation of the article over its lifecycle.”

With this example in mind, Mr Winter said it would be difficult to make an accelerated depreciation break such as the $20,000 instant tax-write- permanent.

“There will be circumstances that arise where it is no longer needed, which are usually related to an improvement in the economy and business confidence,” Mr Winter said.

“It might seem hard to believe but the $20,000 instant tax-write off will run its race and businesses will even forget it’s there, especially if they have sufficient plant and equipment in place.

“Once the business environment gets to this point, the impact of the instant tax-write-off on job creation and manufacturing will be negligible. At this juncture, it will be time to end the tax break.”

WORKS FOR NOW – BUT WATCH CGT

For now, however, Mr Winter said almost 90 percent of the small businesses he supports were taking advantage of the instant tax-write off.

“As such, the value of the plant and equipment owned by many small businesses is almost zero because everything they’ve bought over the last three years they’ve written off,” Mr Winter said.

“We see many businesses such as restaurants and cafes which are plant and equipment rich but with a written down value of almost nothing by taking advantage of the accelerated depreciation attached to the instant tax write-off.

“If they are buying a new refrigerator, it’ll be less than $20,000. It’s entirely tax deductible in that year. Previously these assets were written off over a number year according to the depreciation schedule for that item.”

He said where the instant tax write-off may be causing some angst for small businesses was in relation to the difference between a ‘gain on sale’ and a ‘capital gain’.

“If a business claims the full tax write-off of an asset valued at $19,000, it’s is then deemed to have no value,” Mr Winter said. “However, if the SME sells the asset for $6000 three years later, they must pay tax on this gain at its full marginal tax rate.

“They are forgetting they enjoyed the full benefit of the instant tax deduction three years ago. This sale value is deemed to be a profit by the Australian Tax Office and is called a gain on sale.

“A gain on sale occurs when a business sells an asset for more than what it is written down to.

“A gain on sale is not a capital gain and there are no capital gains tax discounts that apply to this profit. A capital gain only occurs when you sell something for more than you paid for it.”

www.businesssales.rh.com.au

ends