By Valerina Changarathil, Deputy Business Editor, The Australian.
Australia’s network of 17,000 interconnected financial institutions will need to work collaboratively to counter growing cyber threats amid a ‘perfect storm of vulnerability’, cybersecurity experts say.
The superannuation industry needs to be resilient, taking a risk-based approach to cyber threats, technology solutions company Link Group’s chief information security officer Dave Cowan told attendees at the Australian Institute of Superannuation Trustees conference in Adelaide on Tuesday, which also heard from Prince Charles.
“Don’t be fearful of the tsunami of incidents coming,” Mr Cowan said.
“These are just opportunistic perpetrators looking for weaknesses in the system.”
He was supportive of the Australian Prudential Regulation Authority’s move to put pressure on boards for accountability, but said everyone had a role to play in protecting information.
“It is smaller organisations that are also incurring breaches.
“In the information sector, you are trying to protect the little pieces of information that can protect from bigger breaches.”
Visibility and mapping of critical assets of the organisation and deep collaboration with partners in the ecosystem would be important, but ultimately it was an operational risk.
“If your cybersecurity measures are not working for people, it’s not working.”
“Staff and people are your early warning systems against a breach,” Mr Cowan said
US-based cybersecurity expert Tim Kropp, global chief information security officer with SS&C Technologies said markets were more connected and converged in a post-pandemic world bringing “new opportunities, but also threats to our ecosystem”.
“A breach (in Australia) can have a cascading impact on the whole system,” Mr Kropp said.
“Hyperconvergence will only continue to grow. Breaches are only continuing to grow over time.”
Increasingly, regulators around the world were realising and needing to prepare responses to digital threats, said David Leach, JP Morgan’s Asia Pacific head of cybersecurity & technology controls.
“The world keeps turning while we are going through pandemic,” Mr Leach said.
“Much of the world is still working from home.”
“The number one way bad guys get into a system is human fatigue and weak systems.”
Describing COVID-19 as the “chief disrupter”, he said protecting organisations was just one step of a wholistic process.
“It involves really looking deep into your supply chain, seeing what you really need to work through and recognise how interconnected and interdependent the super industry is.”
Understanding how money leaves the organisation was important for the super industry to build protections while ensuring any checklists were constantly updated.
“Part of the conversation has got to be about planning to fail … about detecting (threats), responding and understanding how to recover by identifying where the controls sit.”
“It’s about calling out to industry, to boards and execs, to stop thinking about it as a pass or fail test, but as collective intelligence to strengthen the whole system.”
Adelaide business Fivecast is currently focused on identifying and protecting defence organisations from cyber risks.
“Across the intelligence and national security industry, the general consensus is that there is currently a perfect storm of potential risks and threats to security – not just for Australia but for many countries,” Fivecast co-founder and chief executive Dr Brenton Cooper said.
“This perfect storm of vulnerability is borne from a combination of factors including increased access to technology and online platforms.”
“Any cybersecurity strategy must have human intelligence as one of the primary first line defence mechanisms and put training and processes in place so that employees can act as key alert systems and complement the technology that is available.”
He said there was a desire in the defence and national security space for two key things – access to data from many different disparate sources across online platforms and the surface, deep and dark web and, importantly, the ability to quickly filter and prioritise that data to be able to identify the most important and risky data and uncover insights that can help protect communities.
“These same requirements can absolutely be mirrored in financial organisations and super funds, which are also challenged by masses of unstructured data within which they must be able to identify cybersecurity threats or, increasingly, threats to their supply chains.”
