< News MFT: Not Just Your First Line of Cyber Defence 16 Sept 2025 Every organisation serious about protecting its data will likely come to view a Managed File Transfer (MFT) solution as one of their first lines of defence. Employing MFT as the standard when exchanging data puts organisations light years ahead of businesses still relying on risky File Transfer Protocol and email to transfer files. MFT platforms not only centralise – and therefore, control - data transfer, they also enable companies to apply comprehensive policies which protect data. Data can be insulated from threats as diverse as inbound malware to careless employees entrusting files to external platforms beyond an organisation’s direct control, such as Google Drive and Dropbox. Critical protection policies, such as those encompassing encryption, monitoring, and auditing capability, can be enforced. High Volume = High Exposure In 2024, businesses were responsible for generating around 30% of the world’s data—an astonishing ~44.1 zettabytes. That included data such as transaction records, CRM logs, ERP systems, IoT sensor data from manufacturing and logistics, internal communications, analytics, and cloud backups, AI training datasets and other enterprise software usage. But as the volume of data used and consumed by businesses grows, so too does the cost and impact of potentially losing that data. The high ransoms now regularly being paid to cyberthieves amply demonstrate just how valuable business data has become. Surely it makes more sense to invest in a relatively inexpensive protective technology like MFT, than to lose equivalent funding — or greater — in the form of ransoms paid to cyber thieves? Lessons from Bankers Banks, traditional repositories of valuables from cash, precious metals and sensitive documents, have learned a lot over the years about protecting assets. And their learnings are relevant to how we should be protecting our valuable data. Banks no longer store our valuables in a single bank vault. Nor for that matter do they store our digital currency on a single server. Rather, banks protect our precious assets — physical and digital — behind layers of security. Physical valuables sit behind physical barriers, multiple locks, access control systems, remote monitoring and security guards. Digital valuables are protected against threats such as malware, ransomware, accidental data loss, third-party exposure, and zero-day attacks by a broad array of technologies. Sitting beneath those technologies, ensuring they’re enforced and providing a sound bedrock of centralised control, surveillance and auditing, is MFT. Adding Layered Defence At Generic Systems Australia we’re adept at installing and maintaining the world’s leading MFT, GoAnywhere . And our Advanced Threat Protection (ATP) bundle significantly enhances GoAnywhere’s data protection capabilities by introducing a proactive, multilayered defence against both external threats and internal data leakage. While GoAnywhere already provides secure encryption, access controls, and audit trails for file transfers, the ATP bundle adds dynamic inspection and sanitisation that targets the content itself—not just the container. At the heart of this integration is the Clearswift Secure ICAP Gateway, which enables deep content inspection and adaptive Data Loss Prevention (DLP). This means every file transferred through GoAnywhere can be scanned for malware, embedded scripts, macros, and other active content that could compromise systems. Unlike traditional antivirus tools, ATP sanitises files in real time—removing only the malicious elements while allowing legitimate content to pass through uninterrupted. Limiting Exposure Beyond malware, the ATP Bundle also addresses sensitive data exposure. It can detect and block files containing personally identifiable information (PII), financial records, or confidential metadata before they’re shared externally. Policies can be set to redact sensitive text, strip geotags and even apply optical character recognition (OCR) to scanned documents to catch hidden data. This empowers organisations to enforce granular control over who can transmit sensitive content and under what conditions—adding a layer of governance that encryption alone cannot provide. In essence, the ATP Bundle transforms GoAnywhere from a secure conduit into an intelligent gatekeeper. It doesn’t just move data safely—it understands what’s inside, evaluates its risk, and ensures that only clean, compliant content reaches its destination. Modular Enhancements Augmenting GoAnywhere’s capabilities are Modules which can further protect an organisation from the inherent risks of legacy protocols such as SFTP/FTPS, email attachments and manual processes. SFTP Server can be upgraded to by GoAnywhere SFTP Server Module, enabling SSH-encrypted transfer with centralised access control, audit logging and integration with Active Directory. FTPS Server can be upgraded to FT Module, offering SSL/TLS encryption, customisable access, and DMZ-safe deployment via GoAnywhere Gateway. HTTPS Web Uploads can be replaced by the Secure Folders Module to create browser-based file access with HTTPS encryption and user authentication. AS2/AS4/PeSIT can be replaced by Certified Protocol Modules, providing Retail and banking-grade secure exchange with Drummond certification. These modules consolidate disparate protocols into a single, scalable platform—reducing complexity, improving visibility, and enforcing consistent security policies across all transfers. Making Email Secure Email is ubiquitous. However, it's also one of the least secure ways to transmit sensitive data. Fortra’s Secure Mail module in GoAnywhere transforms ad-hoc file sharing into a secure, trackable process without disrupting user workflows. Using Secure Mail, Users send files as secure encrypted packages via their browser or an Outlook plugin. Recipients receive a unique link to download via HTTPS — no files are sent directly via email. Senders can set expiration dates, download limits, and password protection, and all activity is logged for auditability and compliance. Secure Mail keeps files on your infrastructure until accessed, eliminating third-party hosting risks and ensuring full control over sensitive data. Strategic Defence By replacing legacy protocols and insecure email practices with GoAnywhere’s modular architecture, organisations gain: • Unified governance over all file transfers; • Reduced attack surface via DMZ-safe deployment; • Improved compliance with GDPR, HIPAA, PCI DSS; and • Streamlined user experience without sacrificing security. Here to Help At Generic Systems Australia we have decades of experience helping Australian and New Zealand organisations protect themselves against malware and other cyber attacks through the power of the world’s leading MFT solution. Our Migration Service makes the transition even easier for organisations who prefer to use their resources building their businesses rather than improving their IT plumbing. If you’d like a no-cost, no-obligation discussion about how we could help you simply and affordably adopt an advanced MFT solution, please feel welcome to get in touch with us. At Generic Systems Australia, we’re your local experts in Secure Managed File Transfer. Previous Next

< News Secure Your Email with these 6 Steps 16 Apr 2024 Secure Your Email in 6 Steps Email continues to be the world’s most frequently-used tool for collaboration. In fact, research group Radicati predict 376 billion emails will be sent by 4.5 billion users by the end of next year. Email’s enduring popularity makes it a prime target for cyber criminals. Phishing attacks, spam, and viruses, as well as compromised business emails being used as a gateway to other forms of data loss, can turn email from a collaboration tool into a weapon used against you. Balancing risk vs restraint With so much at stake, IT teams need to carefully balance the minimisation of email risks against the potential for placing draconian restraints on their organisation’s ability to efficiently conduct business. Secure Email Gateways –– such as the Clearswift Secure Email Gateway –– help organisations achieve the right balance for them, enforcing protective email policies without overburdening IT departments, email administrators and messaging teams. Handle with Care Email attachments continue to be a particular risk, and so, managing their transmission warrants particular care. A secure alternative to emailing files, such as the Secure Mail module in GoAnywhere MFT, enables employees to easily send files to other individuals via a secure link with a specific expiry date. Because it is much more secure than traditional email, Secure Mail doesn’t limit the size or types of files being transmitted –– a drawback of many email clients such as Outlook and Gmail. 6 Steps to Secure Email From our many years of helping organisations protect their valuable data, we recommend IT teams define robust email security policies and determine what’s required from their email security defence, by following these six easy steps: 1. Define which data needs to be protected 2. Be clear about the dangers 3. Establish a robust and sustainable email security policy 4. Close the zero-day window 5. Encrypt sensitive data 6. Monitor behaviour and performance --- If you’d like to discuss how your organisation’s email can be made more secure –– without impeding your team’s efficiency ––p lease feel free to contact me , Bradley Copson (mail to: bradley@gensys.com.au ). I’m always happy to have an obligation-free discussion, explain how we can transition you from your existing approaches hassle-free, and offer you a zero-cost Proof of Concept. Generic Systems Australia Your Local Experts in Secure Managed File Transfer #MFT #managedfiletransfer #securefiletransfer #sft #cybersecurity #datatransfer Previous Next

< News Nine Real World Experts Share How They’re Leveraging GoAnywhere 13 Feb 2025 A great way to learn about the value of a Managed File Transfer (MFT) solution is to hear from those who use one. Fortra have published a useful eBook “MFT's Role in Business: IT Leaders Weigh In” in which nine IT and security professionals share their experiences using Fortra’s GoAnywhere MFT . Meet the Experts · Chris Payne, Director of Strategic Alliances & Technical, Pro2col · Paulina Sumska, Regional & Supplier Security Coordinator, Canon · Heath Kath, Lead Solutions Engineer, Fortra · Christian Toon, Head of Cyber Professional Services, Pinsent Masons · Antonio Sanchez, Principal Evangelist, Fortra · Jay Triche, Senior Programmer/Analyst, Lamps Plus · Steve Merrigan, IT Operations Senior Specialist, BT · Loveleen Trotter, Solutions Architect, Fletcher Building · Matthew Hankinson, Infrastructure Manager, Seven Network MFT in Action MFT enables organisations to transfer large quantities and sizes of files securely and quickly, every time. It: · leverages secure file transfer protocols; · encrypts file transfers; and · employs authentication and authorisation to their recipients safely. However, as the class-leading MFT , GoAnywhere MFT goes several steps further. It turbo-charges your organisation’s efficiency by replacing repetitive, manual processes with centralised, automated, and fully-compliant ones. Unsafe legacy scripts can be replaced with automated workflows. Files transfer securely, when and where you say, and without a team of people spending valuable resources - every time - to ensure it happens. Large files can be sent quickly. GoAnywhere’s built-in transfer technologies accelerate file transfers at speeds up to 10Gbps - hundreds of times faster than typical FTP. And it achieves that even in environments experiencing packet loss or latency. GoAnywhere also features bundles for threat protection and secure collaboration. You can secure all incoming files against malware, encrypt all outgoing files, and even control access permissions once they’ve left your network. Encryption and compliance are further benefits. Files stay safe at rest and in motion, which builds trust and credibility across supply chain partners. With so much data transfer occurring in cloud environments, GoAnywhere MFT deploys on AWS, Microsoft Azure, and other cloud computing platforms to give you the same level of coverage no matter where you keep – or send – your data. Leveraging MFT As the experts explain in the eBook, organisations can scale their use of GoAnywhere’s features and technologies, starting with the basics and then exploring and expanding the solution’s more advanced features to supplant operations traditionally performed by specialised middleware. From integrating with web services to drive automation, to customising unique solutions complete with bespoke emails, nearly any file transfer capability is possible. If you’re wondering “could an MFT do that?”, this eBook may well have the answer. And with GoAnywhere MFT, that answer most often is “Yes!” If you’d like a complimentary copy of “MFT's Role in Business: IT Leaders Weigh In”, just let us know via the link on our Resources page. Previous Next

< News Migrate from SolarWinds Serv-U to GoAnywhere MFT 28 Sept 2026 SolarWinds Serv-U has been a familiar part of many organisations’ file-transfer stacks for years. However, as security requirements rise, compliance frameworks tighten, and integration demands accelerate, more teams are reassessing whether SolarWinds Serv-U adequately serves their needs. One of the most common questions I hear is: "How hard is it to move from Serv-U to GoAnywhere MFT?" The short answer is: more manageable than most people expect. 1. A step up in scope, not just a swap GoAnywhere MFT is a broader Managed File Transfer and automation platform. So the migration from SolarWinds Serv-U is a move up to a platform with more moving parts: workflow automation, resources, connections, credentials, and scheduled jobs. That's good news in terms of capability. It also means the migration effort is proportional to how much automation and how many integrations you're bringing over. A shop using Serv-U purely as an FTP endpoint will have less to migrate than one that has built years of custom scripting around it. Of course, eliminating primitive and risky custom scripting – one of the key cyber security exposures for businesses – is in itself a key advantage of moving to GoAnywhere. 2. GoAnywhere's migration path is built to reduce friction Fortra (GoAnywhere's developer) has designed the platform with migration from legacy or multi-tool environments in mind. In practice, that shows up as: Reusable components (connections, resources, keys, credentials) that make rebuilds faster than starting from scratch; Drag-and-drop workflow design that reduces scripting overhead; Native protocol support (SFTP, FTPS, HTTPS, AS2/AS4/PeSIT, APIs, cloud connectors) that covers most Serv-U use cases plus additional B2B protocols Serv-U doesn't support natively; and Centralised logging and auditing that simplify validation during cutover. 3. Clean up accumulated complexity Tools that have been in place for many years tend to accumulate a job here, a script there, a custom integration someone built years ago. Migrating gives you a natural checkpoint to: Consolidate scattered workflows; Retire brittle scripts; Standardise security controls; and Centralise governance. That cleanup is a real benefit of deliberate re-platforming. 4. Security and compliance capabilities GoAnywhere MFT includes a host of meaningful security capabilities: Encrypted vaulting for credentials; Granular role-based access controls; Integrated auditing and reporting; A NIST-certified FIPS 140-2 (and, more recently, FIPS 140-3) validated cryptographic module; and Secure API integrations. These are real advantages, and highly-relevant for organisations working under ISO 27001, SOC 2, or PCI DSS. 5. Significant integration enhancements GoAnywhere is built to orchestrate data movement across a wide range of systems - legacy servers, cloud platforms, partner protocols (including AS2/AS4/PeSIT), REST/SOAP APIs, and native connectors into databases and some ERP/CRM systems. For organisations juggling multiple partner integrations or complex B2B protocols, this is a genuine differentiator and often the strongest practical reason to migrate. 6. The business case Migrating to GoAnywhere can plausibly deliver: Lower long-term operational overhead, once workflows are rebuilt; Broader automation and integration coverage; Better audit trails with tamper-resistant logging; and Faster partner onboarding for organisations with complex B2B protocol needs. The Bottom Line Moving from Serv-U to GoAnywhere MFT is a realistic, well-supported migration path, especially when your integration and automation needs have outgrown it. If your organisation is reassessing its file transfer and automation strategy, GoAnywhere is worth evaluating on its real merits - broader protocol and integration support chief among them. Make migration even easier A common concern of companies considering a switch to a better MFT is the potential for disruption. But at Generic Systems Australia, we alleviate this directly through our comprehensive Migration Services . Our technical experts can quickly and efficiently install GoAnywhere MFT and then configure it to replace all your existing scripts, integration packages and other file transfer middleware. This way, you and your team can keep on doing what you do best – free of distractions – while we do what we do best. Make the Move With GoAnywhere MFT from Generic Systems Australia, migration is not only achievable but also streamlined through expert guidance and automation – all available from local technical experts who are the best in their field. Previous Next

< News What Boards Need to KNOW and DO About the Latest AI Threats 11 Aug 2026 Advances in AI are making cyber attacks faster, more effective, and easier to execute. In partnership with the Australian Institute of Company Directors, the Australian Signals Directorate recommends the following key actions: Review how advances in frontier AI models could affect your organisation’s cyber security posture, including new AI-enabled cyber threats. Assess the risk of relying on AI providers, including cyber supply chain risks and concerns about foreign ownership, control and influence. Make sure your organisation is prepared to prevent, detect, respond to and recover from cyber security incidents in an agentic AI-driven threat environment. Strengthen cyber security by improving governance, processes, and capabilities to manage AI use within your organisation. What do boards need to know? Cyber threats are rapidly evolving due to the constant advances of “frontier” AI models. Frontier AI models are typically characterised by advanced reasoning, software development capabilities, natural language processing or multimodal capabilities, and are trained at scale using state-of-the-art techniques. Such AI models can perform complex tasks that exceed the capabilities of conventional automated tools. Frontier AI models have been widely available since early 2023 and continue to rapidly evolve. These AI models can: identify vulnerabilities and rapidly weaponise them; chain together multiple low severity vulnerabilities into high-impact compromises; and perform malicious cyber activities with little to no human oversight. Newer AI models are also dramatically increasing the speed, scale and ease at which vulnerabilities and weaknesses in systems and cyber supply chains can be identified and exploited, including by malicious actors that previously lacked the knowledge or skills to perform such activities. Combined with malicious actors exploiting weaknesses in proprietary AI model guardrails and illegally distilling such AI models, these developments enable broader access to advanced capabilities and amplify traditional attacker-defender asymmetries. This may rapidly invalidate organisations’ current risk tolerance. Overall, AI models are currently, and will continue to, fundamentally transform both offensive and defensive cyber capabilities. Boards should also be conscious that the implications of AI models extend beyond their effect on cyber security operations. For example, boards should consider cyber supply chain risks associated with their reliance on particular AI vendors and the foreign ownership, control or influence risks this may pose. These dynamics have clear implications for how boards should oversee proactive steps to enhance cyber security and resilience within their organisations. Organisations that fail to act now are exposing their organisations to greater business risk and losses. What threshold questions should boards ask? Boards should quiz management on the following: How vulnerable is our organisation to AI-enabled attacks? What assumptions underpin our current risk assessments, and how might AI threats invalidate those assumptions? Have we reviewed our risk tolerance in light of AI threats and is that risk tolerance still appropriate? If AI models were used to identify and exploit weaknesses across our organisation, what areas of our business would be most exposed? Where could minor weaknesses in our systems and cyber supply chain be combined into a major cyber security incident? Are there known weaknesses in our systems that could become materially more dangerous if identified and exploited at machine speed? Are we relying on vendors and service providers without sufficient governance and oversight, including an understanding of their foreign ownership, control or influence? Do we have visibility of the security and resilience posture of third and fourth-party suppliers within our cyber supply chain? Do we have control over our cyber security fundamentals, such as adherence with a recognised cyber security framework? What legacy technology risks are we carrying and do we have a plan to remediate these risks? Are we delaying addressing any weaknesses due to a perceived low exposure or severity? Would our cyber security operations remain effective if cyber attacks became more frequent, more targeted and more automated? Can we keep the business operational during a serious cyber security incident? If one of our critical systems was compromised, could we continue operating our most important services? If attacks moved from taking days to hours, could we still detect and respond to them effectively? Have our incident response and business continuity plans been updated and tested to capture AI threats? What should boards focus on? AI has the potential to significantly reduce vulnerability discovery and exploitation timelines from days to hours while significantly lowering the skill and knowledge barrier for malicious actors. Organisations should enhance their cyber security fundamentals now and boards should oversee and challenge management on how their organisations are implementing the following strategies. Immediate priorities Secure attack surfaces:  Systems are securely configured to approved and maintained baselines to reduce system exposure, including by reducing attack surfaces and attack paths, with configurations continually monitored and consistently enforced. Reduce software vulnerabilities:  Vulnerabilities in systems are identified, documented, validated and prioritised for remediation or mitigation in a timely manner, with all remediation and mitigation actions verified for effectiveness. Short-term priorities Replace legacy systems:  Systems that aren’t capable of meeting cyber security requirements are managed using compensating controls, along with enhanced monitoring and assurance activities, to maintain an acceptable level of residual risk until they can be decommissioned or replaced. Reinforce identity, credential and access management:  Robust and secure identity, credential and access management is used to establish, maintain and control access to systems and to support effective detection of identity and credential misuse. Restrict unnecessary privileges:  Personnel and services, including AI agents, are granted the minimum access to systems required to undertake their duties. Prepare for cyber security incidents:  Cyber security incident response, business continuity and disaster recovery plans for systems support continued business operations during cyber security incidents, and the resumption of normal business operations following cyber security incidents. Medium-term priorities Adopt AI for cyber defence purposes:  Artificial intelligence is used for cyber defence and is secure, controllable, human-supervised and used in an ethical and accountable manner. Longer-term priorities Modernise for the future:  Systems are planned, designed, developed, tested, deployed, maintained and decommissioned according to business criticality ratings and security and resilience requirements using Secure by Design and Secure by Default principles and practices. What practical actions can boards oversee? Boards are encouraged to engage with, and where appropriate challenge, management on their implementation as their organisation develops its response to AI threats. This should include regular reporting and assurance. Secure attack surfaces Define approved configuration baselines that disable or remove unnecessary services, insecure settings, and unsupported or weak communication protocols. Deploy approved configuration baselines on systems, including infrastructure, operating systems and applications. Detect and respond to configuration drift from approved configuration baselines through automation or continuous technical assessments. Reduce software vulnerabilities Identify known software and configuration weaknesses of assets through continuous and repeatable assessment activities, including vulnerability scanning activities. Apply security patches or updates within defined risk-based timeframes or, where operational impact is low, automatically. Remediate or mitigate vulnerabilities exceeding defined risk thresholds within defined risk-based timeframes based on their severity and exposure. Replace legacy systems Establish and maintain a process for identifying, assessing and managing the cyber security risk associated with legacy systems until they can be removed or replaced. Reinforce identity, credential and access management Identify and disable or remove default and unused accounts on a regular basis. Store authentication keys, secrets and tokens in approved secure repositories with access controls, including multi-factor authentication. Regularly scan codebases, configuration files, file shares and user collaboration platforms to identify unsecured keys, secrets and credentials. Use phishing-resistant multi-factor authentication for users authenticating to systems, including from untrusted, external or high-risk locations. Disable legacy authentication protocols that bypass or weaken modern authentication controls. Ensure that user, machine, system and service credentials are unique per system or account, particularly in high-privilege contexts. Restrict unnecessary privileges Periodically review and update access privileges in alignment with current roles, duties and business requirements. Restrict permissions to create, modify or delete accounts, roles or access to privileged functions or applications to authorised administrative roles. Provision user, administrative and non-person accounts with only the minimum access and privileges required to perform defined operational functions. Prepare for cyber security incidents Review cyber security incident response, business continuity and disaster recovery plans to ensure they remain fit for purpose. Regularly exercise cyber security incident response, business continuity and disaster recovery plans. Adopt AI for cyber defence purposes Deploy suitable AI models for augmenting software development activities, such as identifying and remediating vulnerabilities and weaknesses for software before its release and periodically throughout its life. Deploy suitable AI models for augmenting security assessment activities, such as performing vulnerability scanning and vulnerability assessments. Deploy suitable AI models for augmenting security monitoring activities, such as identifying and triaging cyber security events. Modernise for the future Design systems to provide visibility, enforce authorised access, protect data, minimise required and default privileges, limit exposed services, and remove unnecessary functionality. Secure build and deployment processes to enforce controls consistently across systems. How can MFT help mitigate the AI threat? Managed File Transfer (MFT) mitigates AI cyber risks by imposing strict governance over how sensitive data moves, shutting down the very leakage paths that AI‑enhanced attackers exploit. By centralising all file flows, MFT prevents shadow‑AI behaviours - such as staff feeding regulated data into external LLMs - through granular access controls, encryption, and content inspection that blocks sensitive prompts before they reach uncontrolled endpoints. While AI adversaries can discover vulnerabilities and weaponise exploits at machine speed, MFT counters this by enforcing hardened, vendor‑supported transfer channels, rapid patching, and continuous anomaly detection that flags abnormal transfer patterns and stops malicious exfiltration in real time. Critically, MFT maintains immutable audit trails for all AI‑related data flows, giving organisations forensic visibility and compliance evidence as AI models become autonomous actors in enterprise systems Here to Help At Generic Systems Australia , we are the nation’s most experienced and dedicated provider of the industry’s leading MFT solution, GoAnywhere . We’re right here and on hand locally to help your organisation protect itself against malicious AI incursions. As the ASD recommends: don’t leave yourself exposed to the risk from AI. Boards should press management to act now to ensure their organisation does not fall victim to current and emerging AI threats, including by supporting targeted investments to enhance cyber security and resilience. Acknowledgement: this article substantially reproduces (and expands upon) excellent advice provided by the ASD in partnership with the AICD. Previous Next

< News Sugar Attack Illustrates Supply Chain Exposure 16 June 2026 Last week’s cyber attack on Australia's second-largest sugar producer demonstrates how cyber exposures within a supply chain can flow on to disrupt other organisations within that supply chain. Sugar Shutdown Mackay Sugar operates three mills and generates annual revenue of more than $420 million, supplying raw sugar to domestic customers and export markets across Asia.  It reported yesterday that a cybersecurity incident had forced two of its three major sugar mills to shut down, bringing harvesting operations in the region to a halt.   Sugar milling and cane haulage operations at both the Farleigh and Racecourse mills have been suspended. Both facilities had only recently begun the annual sugarcane crushing season.   Growers reliant on the mills have needed to immediately cease harvesting sugarcane until the mills’ operations can be restored.  Canegrowers Mackay, the representative body for local sugarcane farmers, said in statement: "Mackay Sugar has asked for all harvesting to cease immediately and not resume until further communication comes directly from the company."    Supply Chain Susceptibility The sugar shutdown demonstrates the truth of the Australian Signals Directorate’s warning last month.  It cautioned that errors and vulnerabilities in an organisation’s supply chain posed a significant threat and were a leading cause of data breaches.   If supply chain partners rely on spreadsheets, email attachments, or bespoke scripts, even small mistakes - wrong file versions, incomplete data, mis‑formatted payloads, missed deadlines - can cascade into operational failures that expose your business.   A Managed File Transfer (MFT) solution reduces your exposure to supply chain vulnerabilities. Replacing inconsistent file‑exchange practices with a single, governed, and automated data‑movement framework, it provides standardised protocols, automatic validation and end‑to‑end visibility across every file transfer. Files are checked, encrypted, logged, and monitored in real time, ensuring that corrupted or non‑compliant data is caught before it enters your core systems.   Here to Help At Generic Systems Australia, we're a global leader in implementing the world's best MFT - Fortra's GoAnywhere. We've helped dozens of Australian and NZ organisations make their supply chains more robust. And we're right here in Australia, ready to put our expertise and experience to work for you.  Previous Next

< News 'Twas the Week Before Christmas... 16 Dec 2024 Previous Next

< News Black Friday Sales Splash Creates Data Surge 12 Nov 2024 Data transfer traffic is already surging across Australia as many online retailers jump the gun and promote Black Friday Sales early this year. Australians are set to spend a record $6.7B during the Black Friday/Cyber Monday weekend, according to Roy Morgan Research. An increase of 5.5% on last year, this level of spending will mean Black Friday has well and truly eclipsed Boxing Day as Australia’s top shopping event of the year. 50% of Australians plan to participate in the annual sales splurge, according to Future Publishing Australia’s inaugural Consumer Confidence Report. Of these, 45% plan to find their Black Friday deals online. Data Transfer Tsunami The surge in sales will in turn create a tsunami of data transfers, as businesses transact, process orders, and share a variety of e-commerce files with their supply chain partners. For some businesses – those still using outdated file sharing technologies like email and FTP – this will be a hugely stressful period. They’ll need to be hyper vigilant for lost orders, failed file transfers, and man-in-the-middle hack attacks. Other businesses - those taking advantage of modern, automated file transfer technologies such as Managed File Transfer (MFT) - will surf the data tsunami with ease. MFT will comprehensively address the risks and challenges of moving information, both within their organisation, and with external suppliers, partners and customers. Through centralised control, encryption, automation and auditing, MFT will provide the security, efficiency, reliability and scalability that FTP and email never could. “Cyber Trust” Consumer trust in retailers’ e-commerce transactions will be an even more important factor in eventual sales numbers this year. High profile hacks of consumer data over the past 12 months are leading consumers to question the security of a company’s systems before handing over credit card and other information. Companies will need to be able to provide reassurance – and proof – that transactions and personal data will be secure. Companies with MFT will be better able to provide that reassurance, keeping a clean history as responsible guardians of customer data. Shopper Shift Chris Ferguson, commercial director APAC at Future Publishing Australia, described the popularity of Black Friday in the local market as a “pivotal” change in the retail landscape. “Consumers are increasingly drawn to the prospect of early savings and the convenience of online shopping, so retailers anticipate and accept this new reality to capture their share of the market.” He said that, despite the current economic climate, his research showed Australians remained committed to their festive spending plans. 56% of Australians still plan to spend the same amount as last year on Christmas gifts, while 21% intend to spend even more. Australian Retailers’ Association CEO Paul Zahra said retailers were “pulling out all the stops to ensure they have the best product lines and gift solutions, customer service offerings and enhanced online platforms to make shopping during this peak season more seamless than ever.” He said most discretionary retailers expect to make up to 66% of their annual profit during peak season. Surf the Tsunami Generic Systems Australia are Australia’s experts in deploying Managed File Transfer and other layered defences, such as Advanced Threat Protection . We routinely help local organisations better manage their file transfers, seamlessly scaling up to meet the heightened demands of sales events like Black Friday. If you’d like to discuss how we can help you, please feel welcome to contact me . I’m always happy to have an obligation-free chat and explain how simply we can level up your file transfer approaches. I can even arrange a simple, zero-cost Proof of Concept. Previous Next

< News Migration Services make upgrading easy 17 Mar 2024 Are you attracted to the security and efficiency of a Managed File Transfer solution… but a little worried about the potential disruption of installing one? You needn’t be! Our technical experts at Generic Systems Australia have decades of experience migrating clients from handwritten scripts, outdated integration packages and other legacy software - and everything in between. So it’s no surprise that many of our clients prefer to leave the changeover to us and our Migration Services. Our technical experts can quickly and efficiently install GoAnywhere MFT – the world’s leading file transfer solution – and then configure it to replace all your existing scripts, integration packages and other file transfer middleware. You and your team can keep on doing what you do best – free of distractions – while we do what we do best. Once you have GoAnywhere MFT installed, you may be pleasantly surprised at just how simple it is to set up further automated file transfers into the future. GoAnywhere features an easy-to-understand drag-and-drop interface to create automatic file translation and transfer workflows. In fact, configuring workflows is so easy that most users quickly learn to do it themselves, freeing up your technical staff to focus on other important work. If you’d like to discuss how your organisation’s file transfers can be made more efficient and secure, please feel free to contact our Business Manager , Bradley Copson (mail to: bradley@gensys.com.au ). He’s always happy to have an obligation-free discussion, explain how simply we can transition you from outdated software and approaches, and offer you a zero-cost Proof of Concept. Generic Systems Australia Your Local Experts in Secure Managed File TransferMore Resources at: www.gensys.com.au (Covering Post by Bradley a few days later) Talking to clients, I sometimes sense they’re worried about the perceived complexity of moving from their existing ad-hoc file transfers to a modern, secure and efficient Managed File Transfer solution. I reassure them that they needn’t be concerned. Our technical experts at Generic Systems Australia have decades of experience migrating clients from handwritten scripts, outdated integration packages and other legacy software - and everything in between. This article explains the benefits and advantages of using our Migration Services . #MFT #managedfiletransfer #securefiletransfer #sft #cybersecurity #datatransfer Previous Next

New Cyber Laws Passed – What Australian Businesses Need to Know and Do Earlier this week, the Australian Parliament passed a suite of legislative reforms designed to enhance Australia’s cyber security. The reforms include a raft of new requirements and obligations on Australian businesses. About the Legislation Based on recommendations by the Parliamentary Joint Committee on Intelligence and Security, the new legislation addresses a number of proposals initially set out in Australia’s 2023 – 2030 Cyber Security Strategy, and spans three separate Acts: the Cyber Security Act 2024 (Cyber Security Act); the Intelligence Services and Other Legislation Amendment (Cyber Security) Act 2024; and the Security of Critical Infrastructure and Other Legislation Amendment (Enhanced Response and Prevention) Act 2024 (SOCI Amendment Act). Mandatory reporting of ransom payments, and the introduction of a new voluntary information sharing regime, will have the most immediate impact on organisations. Mandatory reporting of ransomware payments Ransomware attacks are rife across Australia. The Australian Signals Directorate (ASD) reported that this form of cyber extortion accounted for 11% of all cyber incidents to it in 2023-2024, up from 8% in the previous year. The Government had previously pursued a ban on ransom payments. However, its position has since moderated somewhat. The Cyber Security Act only requires organisations to report ransomware payments to the Department of Home Affairs and the ASD. This new reporting obligation will commence at latest six months after the Act receives royal assent (potentially earlier by proclamation) and applies broadly to: organisations which are a responsible entity for a critical infrastructure asset; and other private sector organisations which conduct business in Australia with an annual turnover exceeding a threshold (to be specified - likely to be A$3M). Ransomware reports are required to be made within 72 hours of making a payment (not the receipt of a demand or the discovery of a ransomware attack). Difficult Decisions The requirement to report payments will need to be taken into account by Boards when considering whether to pay a ransom. The Government’s general view on ransoms continues to be that organisations should not pay them. It reasons that payments don’t guarantee the recovery or confidentiality of stolen data, but do encourage cyber attacks to proliferate. Organisations in receipt of ransom demands are left to ponder several competing considerations… Paying a ransom could potentially contravene sanctions (such as the one imposed on Aleksandr Ermakov, the individual responsible for the 2022 Medibank data breach) or anti-money laundering laws. Company Directors fulfilling the duty of care to act in the best interests of their organisation will need to balance the risks of payment - commercial damage, incentive to re-target, uncertainty of data recovery – against the risks of not paying - loss of systems data, reputational damage, third party claims, lost customers and business disruption. If a ransom payment is made, then the new mandatory reporting obligation will be in addition to other applicable reporting requirements an organisation is subject to. These could include the Privacy Act 1988, the SOCI Act, and continuous disclosure obligations under the ASX Listing Rules and CPS 234. In fact, it’s important that Cyber Incident Response plans developed by organisations specifically address these overlapping requirements, taking into account the various regulators and timeframes of each. Be aware that, for any entities regulated under the SOCI Act, it’s also conceivable that the Government could use its directions power to direct an entity to pay - or not pay - a ransom. An organisation which fails to comply with mandatory ransom reporting will incur a civil penalty of 60 penalty units (currently A$93,900). Voluntary reporting regime A new National Cyber Security Coordinator (NCSC) is being established under the Cyber Security Act to lead a whole-of-government response to significant cyber security incidents. The Act provides a framework for the voluntary disclosure of information by any organisation operating in Australia, or any responsible entity under the SOCI Act, to the NCSC relating to cyber security incidents. However, it imposes various limitations on how the NCSC may further use and disclose information voluntarily provided by entities, depending on the significance of the incident. Non-significant cyber security incidents: Information can be used for limited purposes such as directing the reporting entity to assistance services, coordinating a government response, and informing Ministers. Significant cyber security incidents: Information can be used for broader ‘Permitted Cyber Security Purposes’. These include preventing or mitigating risks to critical infrastructure or national security, and supporting intelligence or enforcement agencies. A cyber security incident is deemed “significant” if: there is a material risk that the incident has seriously prejudiced, is seriously prejudicing or could reasonably be expected to prejudice the social or economic stability of Australia or its people, the defence of Australia or national security; or the incident is, or could reasonably be expected to be, of serious concern to the Australian people. Information voluntarily provided by organisations to the NCSC is subject to limited use protections similar to those which apply to information disclosed as part of a ransomware payment report. The new voluntary reporting regime and corresponding limited use protection has come into immediate effect. Limited use protection The Cyber Security Act outlines how businesses should work with the NCSC and other government agencies to obtain assistance and guidance when responding to cyber incidents. It also provides businesses with certain limited use protections when collaborating with the government’s cyber security agencies - a legislative foundation for the CISA Traffic Light Protocol government agencies have recently offered when assisting organisations. Such protections were requested by business lobby groups. They provided feedback during the public consultation period that disclosing information about a data breach could risk exposing an organisation to further regulatory or enforcement action, adverse publicity and litigation. Further, if disclosing a cyber incident was determined to be against an organisation’s best interests, its directors could potentially be in breach of their duties in approving the disclosure. That could in turn expose directors to enforcement action from ASIC. Counterweighing these concerns, the Government believes that sharing information on current threats and incidents can help other organisations avoid similar incidents. In balancing these competing interests, the Cyber Security Act limits the purposes for which information contained in a ransomware payment report or voluntarily report provided to the NCSC can be used or disclosed. The NCSC (and any Government agency it coordinates with) cannot record, use or disclose the information provided for the purposes of investigating or enforcing or assisting in the investigation or enforcement of any contravention of a Commonwealth, State or Territory law. An important exemption from the limited use protections are that crimes and breaches of the limited use protections created by the Act. In this way, the protections stop short of being a full “safe harbour”. Information provided under these protections isn’t admissible in evidence against the disclosing entity, including criminal, civil penalty and civil proceedings (including a breach of the common law). And, the provision of information to the NSCS does not affect any claim of legal professional privilege over the information contained in that information. These limited use protections will be of value to organisations disclosing information to the Government about cyber incidents. However, directors should bear in mind the notable gaps in the protection they provide. For example: Information provided can’t be used or disclosed for the purposes of investigating or enforcing any contravention by the reporting entity of another law (whether federal, state or territory), other than a law that imposes a penalty or sanction for a criminal offence. This means that if the ransomware report indicates that a payment was made in breach of relevant sanctions laws, then the limited use protection will not prevent the use of the report in a subsequent investigation or enforcement action. While information provided to the NCSC cannot be obtained from the NSCS by regulators or government agencies, the protection offered under this Act does not prevent regulators from obtaining the underlying information through other means, including via regulatory investigatory powers or where provided under other mandatory reporting regimes, such as those in the Privacy Act 1988, the SOCI Act, the Telecommunications Act 1997 and the ASX Listing Rules continuous disclosure obligations. So, cyber incident notifications provided to the ACSC under the SOCI Act are not captured by the limited use protection, even if that information is also voluntarily provided to the NCSC or detailed in a mandatory ransomware report. A similar limited use protection has been introduced via the Intelligence Services and Other Legislation Amendment (Cyber Security) Act 2024 for cyber incident information voluntarily shared with the ASD. Other Inclusions in the Legislation This article has focused on developments within the new Cyber Security legislative reforms which will most impact companies and organisations. However, in the interests of completeness, here is a brief overview of other key developments covered in the legislation: Mandated Security Standards for Internet of Things (IOT) Devices. These standards will be detailed in legislative rules, with suppliers required to provide a statement of compliance for devices supplied to the Australian market. New Cyber Incident Review Board. This independent advisory body will be empowered to conduct no-fault, post-incident reviews of significant cyber security incidents and provide recommendations and information to both the private and public sector. It will have the power to compel entities to provide information about significant cyber security incidents. Critical Infrastructure definition expanded. Data storage systems which hold business critical data have been added to the definition of critical infrastructure assets. This closes a gap in the regulations which became apparent in the aftermath of the Optus and Medibank data breaches. Expanded Incident Response Powers. The Government will now have the power to direct an entity to take, or not take a specific action, in the event of a cyber incident affecting critical infrastructure. Security and incident notification obligations moved from the Telecommunications Act 1997 to the SOCI Act, consolidating the cyber obligations of telecommunication carriers and carriage service providers under a single piece of legislation. What Organisations Should Do Cyber security response plans should now be reassessed and upgraded to ensure they align to the new mandatory ransomware reporting requirements. Playbooks and procedures should take account of how an organisation plans to engage with cyber security authorities, bearing in mind the extent - and limitations - of the defined limited use protections. Focus on preventing cyber incidents - not just responding to them. A Managed File Transfer (MFT) solution such as GoAnywhere MFT can encrypt data at rest and in transit, complying with the highest data security standards. It manages inbound and outbound file transfers across an organisation, using industry-standard file transfer protocols and encryption to protect your data. Advanced Threat Protection and Adaptive Loss Prevention add a further layer of defence. SFT Threat Protection facilitates safe collaboration with external parties, helping to prevent malware from entering an organisation, and reducing the risk of employees losing or mishandling sensitive data. Finally, organisations should seek professional legal counsel in determining and responding to their obligations and responsibilities under the new Cyber Security legislative reforms. The information provided in this article has been general in nature, and the interpretations and advice outlined above should not be interpreted as professional legal advice.