Cyber Security
Australia just can’t hack it By Ryan Linn Director of Advanced Threats and Countermeasures, Nuix
I
’ve been reflecting on a number of conversations I had and some of the concerns people expressed to me about cybersecurity during my recent two-week trip to Australia. One thing has particularly drawn my attention: cybersecurity is just now becoming a talking point in Australia. In the United States, we are inundated at least once a week with stories about this hack or that hack. As a result, organisations are at most just a few days away from another heavily publicised incident. This has led to individuals becoming more concerned with security and this awareness puts them in a better position to protect themselves online. For various reasons, I don’t think Australia is quite there yet. Cybersecurity should be a national issue Raising awareness is the first step to protecting Australian businesses and critical infrastructure. The Australian Government has delivered its Cyber Security Strategy and made efforts to increase awareness of security issues. The distributed denial of service attacks that disrupted the 2016 census helped make security very real and visible. So did the recent announcement that the Australian Red Cross Blood Service had accidentally published the details of 550,000 blood donors on its website. However, such announcements are relatively rare because the Australian Government has still not enacted mandatory
28 | Australian Security Magazine
breach disclosure legislation. As a result, many organisations that suffer breaches try to sweep the matter under the carpet rather than suffering the bad publicity – and other consequences – resulting from telling people what happened. Until Australians are aware of the true frequency and scope of data breaches and broader security threats, cybersecurity will not become a national concern and it will be hard to focus the minds of lawmakers and business executives on these issues. Visibility into your networks is critical Across the globe we suffer from a lack of security as well as a lack of insight into what’s happening on our networks, computers, and phones. Computing is becoming more powerful and user interfaces are facilitating easier computer use at the expense of visibility. Why is visibility so critical when we have antivirus, firewalls, and all of these other technologies protecting us? The answer is that attackers are staying one step ahead of the good guys and as a result it’s fairly easy to bypass many of these security controls. I’ve heard the phrase “We haven’t been breached … as far as we know” more times than makes me comfortable. What is most distressing about this statement is that many people don’t even have a grasp on what a breach is. If your organisation has had a virus, malware or any other malicious application appear on one of your systems, you’ve