Five Cybersecurity Decisions to Help ANZ Retailers Keep Trading
Summary
Huntress outlines five security priorities for Australian and New Zealand retailers, from mapping critical systems and securing identities to rehearsing incident response. Its partner telemetry highlights compromised Microsoft 365 accounts and endpoint footholds as key,
Key points
- Map systems and dependencies essential to payments, POS, online orders, fulfilment, identity, email and store operations, including supplier access.
- Use phishing-resistant MFA where possible, least privilege, prompt account lifecycle management, and verification through a separate channel for payment-detail changes.
- Prioritize security issues by exploitability and business impact, assign owners, and verify that fixes reduce risk.
- Limit, log and review supplier access; test escalation paths and plans for supplier or service outages.
- Document incident authority, isolation, recovery and notification responsibilities, and practise realistic scenarios and restoration.
- Huntress reports that more than five in six critical identity incidents in its APAC retail partner data involved compromised Microsoft 365 accounts; endpoint incidents included footholds and persistence.
- The article reports median containment times of about eight minutes for compromised identities from the first detected event, and 23 seconds after an incident report was raised.
Article Details
- Defense Focus
- Reduce retail cyber risk and keep trading by improving visibility, identity and endpoint detection, incident response, containment, and recovery readiness.
- Detection Methods
- Maintain an accurate inventory and dependency map of critical systems, identities, suppliers, and security controls.
- Review administrator access, stale accounts, mail-forwarding rules, unfamiliar applications, and logins inconsistent with a person's role.
- Monitor endpoints, identities, email, and critical systems; add context to suspicious activity and validate whether alerts represent real threats.
- Treat multiple critical incidents across identities or hosts within a 24-hour window as a reason to assess the environment broadly and investigate related activity.
- Confirm containment by revoking sessions as well as resetting credentials, because valid session tokens can remain usable after a password reset.
- Verify that remediation reduced risk rather than relying only on patch installation or a security tool reporting that it is installed.
- Data Sources
- Endpoint detection and response telemetry
- Identity monitoring and account activity
- Email and mail-forwarding rules
- Logs from across the environment
- Asset, identity, supplier, and security-control inventories
- Platforms
- Endpoints
- Microsoft 365 identities
- Security Operations Center (SOC)
- Defensive Actions
- Use phishing-resistant MFA where possible, least-privilege access, separate administrator accounts, and temporary privileged access.
- Promptly onboard and offboard users; review and remove unnecessary or stale access.
- Prioritize internet-facing systems, VPNs, remote-management tools, POS devices, and servers; define response expectations for high- and critical-impact issues.
- Patch applications and operating systems, restrict administrative privileges, and set defined patching timeframes.
- Limit supplier access to what is needed, log and review it, and test supplier escalation and recovery contacts.
- Document incident ownership, isolation authority, recovery approvals, communications, and breach-notification decisions.
- Exercise realistic outage and compromise scenarios, including overnight response, and test restoration of critical data, configurations, and systems.
- For identity containment, revoke active sessions in addition to resetting credentials; investigate multiple critical incidents across hosts and identities as a broader event.
- Use managed security coverage where needed, with clear escalation ownership, access requirements, and handoffs to the retailer's team.
People
Vendors
Products
Essential EightIf you want a framework your team already recognises, the Essential Eight maps well to this. Patch applications, patch operating systems, restricting admin privileges and MFA are four of the highest-value strategies forManaged EDRHuntress can address the concerns mentioned above. We protect your endpoints and identities with Managed EDR and Managed ITDR, while Managed ISPM closes the misconfigurations attackers go looking for. Managed SATManaged ISPMmentioned above. We protect your endpoints and identities with Managed EDR and Managed ITDR, while Managed ISPM closes the misconfigurations attackers go looking for. Managed SAT coaches your people to spot theManaged ITDRaddress the concerns mentioned above. We protect your endpoints and identities with Managed EDR and Managed ITDR, while Managed ISPM closes the misconfigurations attackers go looking for. Managed SAT coaches yourManaged SATEDR and Managed ITDR, while Managed ISPM closes the misconfigurations attackers go looking for. Managed SAT coaches your people to spot the threats that reach them first. Managed SIEM pulls logs from across theManaged SIEMattackers go looking for. Managed SAT coaches your people to spot the threats that reach them first. Managed SIEM pulls logs from across the environment into one place, so activity can be investigated thoroughly andMicrosoft 365 Apps for Enterprisehardest because they run distributed environments. Point-of-sale (POS) systems, ecommerce platforms, Microsoft 365, warehouses, stores, support tools and third-party providers all connect to the business. Plus,
Countries
AustraliaAustralian Cyber Security Centre (ASD's ACSC) responded to 138 ransomware incidents across Australia. In 39% of them, the organisation found out simply because ASD rang to tell them.New ZealandIn New Zealand, the Privacy Act 2020 requires an agency to notify the Office of the Privacy Commissioner and affected individuals as soon as practicable when it has reasonable grounds to believe a notifiable privacy