Cyber Smart Week is over. Your security hygiene shouldn’t be.

Yah, Cyber Smart Week. Seven days of the NCSC reminding us all to turn on two-factor and stop using our dog’s name as a password. Then Monday arrives, the inbox fills up, and security quietly slides back to “we’ll get to it”.

Last week got me thinking about what our government clients actually need. Not another awareness poster. A practical health check. So here are the four checks I’d run on any agency website: can you see an attack, does someone hear about it, is your firewall tuned to your site, and are are you utilising the security tools you have already have available?

Why does security hygiene matter more now?

In September, the Australian Government revealed that an OpenAI agent had reached the backend of a Department of Health statistics portal back in July. The part that made me sit up wasn’t the breach itself. It was that the government found out because OpenAI told them, weeks later.

That’s the new normal. AI makes probing systems cheap and tireless, so attacks are more frequent and more aggressive than they were even a year ago. Good hygiene doesn’t make you invincible, but it does mean you’re the one who notices first.

Would you know if you were under attack right now?

Picture this: it’s 2am, something odd is hammering your site, and an alert fires. Great. Now, who gets it? And are they allowed to do anything about it, or do they have to wait for a manager who’s asleep?

Before you touch any technology, ask three questions:

• Are you monitoring traffic across your systems, not just checking whether the homepage loads?

• Do those monitors raise alerts, and does a real, named person receive them?

• If an attack started this instant, what’s your playbook? What can your team do straight away without asking permission?

That last one is where a RACI earns its keep. Spelling out who is responsible, accountable, consulted and informed isn’t paperwork. It’s what lets your people act fast and confidently when it counts, instead of drafting emails while the clock runs.

Is your firewall tuned to your website, or still on factory settings?

Here’s my slightly unpopular opinion: default firewall settings are not enough anymore. They’re built for every website on earth, which means they’re tuned for none of them.

At Effect we’re an Umbraco and .NET shop. So when our logs show someone requesting PHP pages or a WordPress admin URL, that’s not a curious visitor. That’s a bot rattling the handle on a door that doesn’t exist (and it does it thousands of times a day).

Have a look through your own logs and see what traffic you’re really getting. Then block what can never be legitimate for your platform. This isn’t just tidying up. All that junk is noise, and noise is exactly what slows you down when you’re trying to find the one request that matters during a real incident.

Tuning your firewall to match your website is one of the best things you can do for your security hygiene.

Are you using the security tools you already pay for?

Once the people and process side is sorted, look at the application itself and every moving part around it. The good news: the big cloud providers have a heap of security tools built in, and many are free or close to it.

We host our clients on Azure, and we lean on:

• Managed Identity, so apps authenticate without passwords stored in config files

• Private Link, keeping databases and services off the public internet

• Key Vault, a proper safe for secrets and certificates

• Entra ID, for single sign-on to the CMS and admin tools

• Microsoft Defender for Cloud, watching the whole environment and flagging weak spots

Most agencies we talk to already have access to tools like these. They’re just not switched on yet.

And one more tip: get AI to help. It has a ton of knowledge and is brilliant at walking you through a config setting or making sense of a log file. It’s like having a patient security mate on call. Just keep a human making the final decisions.

Cyber Smart Week might be over, but the bots didn’t get the memo. Pick one of these checks and do it this month. Your future 2am self will thank you.

Nick’s takeaways

• AI-driven attacks are faster and more frequent, so basic security hygiene matters more than ever.

• Start with people and process: monitoring, alerts that reach the right person, and a playbook with a RACI.

• Tune your firewall to your actual website, because default settings let noisy junk traffic bury real threats.

• Your cloud platform already has strong security tools, and many of them cost little or nothing.