Security Readiness

Conclusion: Cyber incidents and the protection of information have now taken enterprise and national significance. 

Organisations will need to learn to operate securely in a zero trust world. With an ever-increasing number of cyber-related incidents, cyber security risk has evolved from a technical risk to a strategic enterprise risk. The risk of a compromise for most organisations is increasing with the acceleration of digital transformation, adoption of technologies such as Cloud services, analytics and IoT. The threat landscape is further compounded by increased regulatory and compliance requirements.

A cyber compromise is almost inevitable and organisations are now focusing on improving the resilience of their organisation to a cyber incident. Many organisations now have cyber resilience programs in place which not only protect and defend their key information assets but are also well placed to respond should a cyber incident occur. Our cyber strategy, roadmap and implementation advisory are designed to assist on your cyber resilience journey.

Conclusion: Identity and access management is a crucial component of an organisation’s security posture. At its most basic, it is how an organisation determines whether an individual can access resources or not. In today’s world, it is also becoming the basis of how applications first identify then communicate with each other.

Assurance of identity is the cornerstone of managing access to information. An organisation must be confident in that assurance. One method of bolstering the strength of that assurance could be the deployment of multi-factor authentication – at a minimum to privileged users, but ideally to all users of the services and applications whether those users are staff or not.

As organisations move from office-bound networks to distributed workforces combined with Cloud-based Software-as-a-Service (SaaS) applications, identity will evolve to be almost the sole element used to assess and grant access. Identity is certainly a central element of zero trust environments.

Background: The federal government has finally unveiled its cyber security strategy. The Australia’s Cyber Security Strategy 2020, released on 6th August will see $1.67 billion invested in a number of already-known initiatives aimed at enhancing Australia's cyber security over the next decade. IBRS provides their key takeaways from the strategy.


Most of the funding for the Strategy 2020 is from July’s announced $1.35 billion cyber enhanced situational awareness and response (CESAR) package much of the Strategy details will be contained in legislation to be put before parliament.

Conclusion: Ransomware attacks are becoming increasingly common and Australian organisations have experienced several high-profile incidents in 2020. While the preferred option is to recover from backups, organisations may find that this is not feasible either because of the scale of the compromise or that backups themselves are compromised. While the decision to pay a ransom is complex and poses significant risks, it should be explored in parallel with the recovery from backup.

Conclusion: Australian financial organisations have been bombarding their suppliers and partners with requests to complete security assessments. If servicing or dealing with financial organisations is part of the operational model for the organisation, this has probably already happened or is about to happen.

Those financial bodies are being driven by an Australian Prudential Regulation Authority (APRA) issued prudential standard CPS 234 (Cross-industry Prudential Standard). This document lays out how a financial body should manage its cyber security with particular emphasis on extending that management to parties that support or supply the financial body.

These assessments can be tedious and raise concerns about cyber security maturity within the organisation. On the other hand, they bring a clear high-level focus on areas that all organisations should either be covering or working towards covering. This makes CPS 234 a valuable reference for senior executives building a cyber security program.

Conclusion: Many vendors, consultants and managed service providers are pushing ‘security information and event management’ (SIEM) as a panacea to security failings. The intent is correct. Having visibility of what is or has happened in the infrastructure is essential to detecting and responding to intrusions.

What often gets glossed over is that SIEM is a tool, not a complete solution in itself. Deployment requires deep engagement with the IT operations team and a clear vision of what is expected from the SIEM. The vision will be driven by how SIEM will be used, what outcomes would be expected and how its use would evolve over time.

With careful planning prior to deployment, some, if not most, of these issues can be addressed.

Conclusion: With an ever-increasing number of cyber-related incidents, cyber security risk has evolved from a technical risk to a strategic enterprise risk. While many organisations have enterprise crisis management and business continuity plans, specific plans to deal with various types of cyberattacks are much less common, even though many of the attack scenarios are well known. Every organisation should have an incident response plan in place and should regularly review and test it. Having a plan in place can dramatically limit damage, improve recovery time and improve the resilience of your business.

Conclusion: With cases of the novel coronavirus (COVID-19) emerging across Australia, many businesses are or should bewell into pandemic planning to ensure they maintain essential services. Teleworking, remote working, or working from home, is a centrepiece of those efforts and will increasingly be implemented by organisations. Cybercrime activity is rising rapidly with actors seeking to exploit the fear and uncertainty in the community. The use of remote working technologies presents additional cyber security challenges that can be different from the more secure on-premise environments. Below is a list of considerations to help guide businesses through these challenges.

"There is more security work to go round than there are resources. So I don't think the market is that crowded. It's important to remember that security is not something you buy and then it's done; it is an ongoing evolution within any organisation and requires constant care and feeding," IBRS adviser Peter Sandilands said.

"The big four has done a lot of their security work using fresh grads. They can use the tools but don't necessarily understand the real world implications."

Full Story.

Conclusion: The increased proliferation of critical digital services has resulted in ransomware attacks becoming one of hackers’ means to make money. As a consequence, many organisations have become the victims of such attacks. IT organisations should implement a full recovery strategy to restore IT services in the event of ransomware attacks. The recovery strategy should become an integral part of the disaster recovery plan. This will raise business stakeholders’ trust in the service security and reduce the spread of this type of IT organised crime.

Conclusions: Patching systems is regularly touted as the panacea for security breaches, yet many organisations continue to struggle with that seemingly simple process. There is obviously more to the problem than just buying and deploying a patch management system.

Most organisations are well-intentioned; it is not that they do not want to patch. As one delves deeper into the tasks around patching, it soon becomes clear that many unintentional, and some intentional, roadblocks exist in almost every organisation.

This note attempts to sort through some of those roadblocks and offer some approaches to diminish their impact. Some resources are identified to help with the design and build of a patch service. There is a real dearth of well-structured information around the patching process overall.

Conclusion: As detailed in part one of this pair of notes, the Australian Signals Directorate’s Essential Eight (E8) are detailed technical recommendations for securing an information infrastructure. Implementing them has been touted as being effective against over 85 % of potential attacks. It is hard to ignore that benefit to an organisation’s security stance.

The first note went on to highlight the real-world implications of attempting to implement the E8; in particular, listing the prerequisites for the implementation. Each of the E8 assumes that an organisation has in place the underlying capabilities and information that provide the supporting base for each element of the E8.

While at first glance that appears to put a negative connotation on deploying the E8, in many ways it points to some basic processes and capabilities that any organisation should have in place to use its information infrastructure effectively. This note will explore those implications. It will help any organisation build the basics of an effective security regime.

Conclusion: Cyber security and data privacy are currently hot topics at both executive and board levels and security incidents feature in the media on an almost weekly basis. CIOs and executive teams will face increasing scrutiny from their boards with a focus on accountability, risk assessment, reporting and organisational resilience to cyber incidents. Boards are genuinely grappling with how to assess risks and how to ensure that the organisation is sufficiently well prepared to protect and respond appropriately to security incidents, within budget and resource constraints. CIOs and CISOs have a unique opportunity to engage with boards and provide the leadership that is expected, as the move to digital accelerates. In this note we highlight the recent trends and outline some of the key recommendations to practical steps to strengthen your organisation’s ability to protect itself holistically from cyber and data loss risks.

Conclusion: The Essential Eight from the Australian Signals Directorate constitutes a recommended set of strategies to reduce the risk of cyber intrusion. They are said to prevent up to 85% of potential attacks. They are certainly worth assessing as a strategy to apply as an organisation plans out its security strategy.

However, while they may seem simple at first glance, the prerequisites for their implementation are far reaching. These add significant cost and effort to any attempt to take advantage of the E8. In fact, the effort and planning can easily exceed the effort in seemingly just doing the E8.

This will be a two-part article. The first part will explain the question at hand and describe the premise being explored. The second part will work through the implications for an organisation and list the strategies to deal with them.

Conclusion: IT auditors typically consult with, and report their findings to, the board’s Audit and Risk Committee. Their POW (program of work) or activities upon which they will focus may or may not be telegraphed in advance to stakeholders, including IT management.

To avoid getting a qualified audit report for IT, e. g. when internal (systems) controls are weak or IT risks are unmanaged, business and IT management must first get their house in order, by tightening controls and addressing risks before the possible arrival of the audit team. Failure to get the house in order, before an audit, could be career limiting for IT and business managers.

Shadow IT sounds like a covert — quite possibly dark — force. And to some people it may well be. But the truth is both far simpler and more complex.

According to Cisco, Shadow IT is the use of IT-related hardware or software by a department or individual without the knowledge of the IT or security group within the organisation.

“Shadow IT is a term that originally came from people having little apps they brought into the business themselves. Dropbox is the classic one, but there are plenty of them,” says Dr Joseph Sweeney, advisor at leading Australian IT research firm, IBRS.

“Today, shadow IT extends beyond consumer apps to the as-a-service delivery of enterprise business capability, such as Human Capital Management.”

Full Story

Organisations that are resisting the shift to Cloud computing are often basing their decisions on common misconceptions around security, price and integration.

That’s a key finding in a recent report conducted by IBRS, The State of Enterprise Software Report 2019.

The Security Myth

Many of the organisations surveyed declared security as the primary reason for not moving to Cloud services.

Concern over the security of systems — and, critically, of the data they hold — was common in the early days of Cloud computing and it seems at least some of that legacy remains. But it’s a myth.

Dr Joe Sweeney, author of the report said cloud service providers exceed most organisations’ budget and capacity to manage complex cyber security risks.

That’s certainly the view of the Commonwealth Government, which is moving to Cloud-delivered enterprise solutions aggressively.

Full Story

Conclusion: Recently, several architectural models and tools have become available to enable the microsegmentation of networks, which helps improve overall security within organisations and can help limit the scope of any potential breach within an organisation. This can be achieved by aligning microsegmentation of networks with the organisation’s mission-critical systems profile.

Organisations should ensure microsegmentation is included in their security strategy. However, there are several different architectural approaches and organisations should explore these and select the approach that most suits their current or planned enterprise architecture and assess the benefits each approach may offer.

Related Articles:

"Network Virtualisation – Security drives adoption" IBRS, 2016-09-02 05:06:16

Conclusion: The Agency Head/CEO is responsible to accredit the ICT system for use at the PROTECTED level. The accreditation process is specific to the services being delivered for the organisation. The Australian Signals Directorate (ASD) certification process is a generic process that assesses the Cloud Service Provider’s (CSP) level of security only.

The Agency Head/CEO remains responsible as the Accreditation Authority (AA) to accredit the security readiness for the services to be delivered for their organisation. In practice the CIO/CISO will lead the accreditation process on behalf of the CEO.

ASD’s role as the Certifying Authority (CA) for PROTECTED Cloud services provides the agency/organisation using the CSP with independent assurance that the services offered meet government Information Security Registered Assessors Program (IRAP) requirements and vulnerability assessment requirements at the PROTECTED level. The certification process provides a consistent approach to the cyber risk assessment of the CSP’s environment only. The PROTECTED Cloud certification does not cover security assessment related to the design and maintenance of the customers’ services and/or software to be run on the PROTECTED Cloud platform.

The adoption of a PROTECTED Cloud solution will still require a regular review of the security posture. ASD will conduct regular reviews of their processes as the certifying authority (CA), and the Agency Head/CEO will be required to regularly review the accreditation of the service as a whole.

Related Articles:

"Running IT-as-a-Service Part 38: Successful hybrid Cloud requires multi-provider governance framework" IBRS, 2018-02-01 10:08:33

"Running IT-as-a-Service Part 49: The case for hybrid Cloud migration" IBRS, 2019-02-03 01:26:59

"Should elements of your IT environments and data holdings be classified PROTECTED? Why and what to consider" IBRS, 2019-01-06 22:27:44

"The value proposition for PROTECTED Cloud" IBRS, 2019-02-03 01:32:06

Conclusion: Australians have become increasingly concerned not only with what data is being held about them and others, but how this data is being used and whether the resulting information or analysis can or should be trusted by them or third parties.

The 2018 amendments to the Privacy Act for mandatory data breach notification provisions are only the start of the reform process, with Australia lagging a decade behind the US, Europe and UK in data regulation.

Therefore, organisations seeking to address the increasing concerns should look beyond existing data risk frameworks for security and privacy, moving instead to adopt robust ethical controls across the data supply chain1 that embodies principles designed to mitigate these new risks. Risks that include the amplification of negative bias that may artificially intensify social, racial or economic discord, or using data for purposes to which individual sources would not have agreed to.

Early adopters of effective data ethics will then have a competitive advantage over those who fail to address the concerns, particularly of consumers, as to how their data is used and if the results should be trusted.

Conclusion: Throughout the year, most businesses invite in a third party to conduct an information security risk assessment – as per best practice. Often this is a compliance exercise, other times it is just good housekeeping. Assessors are paid to find gaps in security controls based on the threat landscape and risk profile and provide recommendations for how to better secure the organisation with appropriate controls. With a thud-worthy report in hand, those charged with remediation must prioritise the recommended tasks to best use their resources to appropriately protect the organisation.

Conclusion: CIOs should consider the environments for their PROTECTED information, both when building new capability and/or when renewing older infrastructure and services. The need to have cost-effective infrastructure services (in-house or IaaS), accredited security of services and responsiveness for clients using the service are three key deliverables for any CIO.

The Australian Government has identified PROTECTED ratings be applied where systems and data are at risk and where the systems or data are critical to ensuring national interest, business continuity and integrity of an individual’s data. Critical business functions are a combination of the IT systems they run on and the data they consume.

Defining what should be afforded a PROTECTED rating and therefore adequately protected is an ongoing challenge. The Australian Government’s Information Security Manual (ISM) and recent legislation “Security of Critical Infrastructure Act 2018” detail the requirements and framework for reporting, on government-run IT systems and critical infrastructure. Using this framework as a base, organisations should assess whether the data or IT environments that support critical business functions should be treated as PROTECTED.

Related Articles:

"Canberra-based Azure is about much more than security" IBRS, 2018-04-14 13:43:57

"On-Premises Cloud: Real flexibility or just a finance plan?" IBRS, 2017-05-06 06:37:20

"Running IT-as-a-Service Part 33: How to transition to hybrid Cloud" IBRS, 2017-08-02 02:32:44

 IBRSiQ is a database of Client inquiries and is designed to get you talking to our Advisors about these topics in the context of your organisation in order to provide tailored advice for your needs.

IBRS iQ is a database of Client inquiries and is designed to get you talking to our Advisors about these topics in the context of your organisation in order to provide tailored advice for your needs.

 IBRS iQ is a database of Client inquiries and is designed to get you talking to our Advisors about these topics in the context of your organisation in order to provide tailored advice for your needs.

The timing couldn't have been worse for PageUp; two days before Europe's new data protection regime came into force the Melbourne-based online recruitment specialist's security systems detected suspicious activity.

By May 28 – three days after the General Data Protection Regulation went live – PageUp knew client data may have been compromised and that it had 72 hours to alert the British Information Commissioner's Office, due to the UK's incredibly stringent laws on breach disclosure.

It has also liaised with the Office of the Australian Information Commissioner as required under the mandatory data breach notification rules, which came into force in February.

On June 1 it alerted its customers; on June 5 it confirmed the breach publicly.

Read More

In terms of cyber security years, Australia is still in the dark ages, a period typified by a lack of records, and diminished understanding and learning.

We're only a few months into practising mandatory data breach notification, while many parts of the world have been doing this for years. The United States has been disclosing breaches for more than a decade.

Countries where data breach notification is the norm are still maturing, and there is no upper limit for our understanding on managing cyber risk. But you can see that by the steps other parts of the world are taking that they do see security incidents very differently to Australia.

This month, at the annual gathering of the Society for Corporate Governance in the United States, Commissioner Robert Jackson Jr. from the Securities and Exchange Commission (SEC) said investors are not being given enough information about cyber security incidents to make informed decisions.

Read More

Cyber security and risk advisor at analyst firm IBRS, James Turner, said the cyber skills shortage was prompting a wider rethink around the domain in terms of resourcing for the last few years.

“It’s partly about talent scarcity but it’s also about bringing fresh eyes. It shows up in the diversity of thinking around cyber issues,” Turner said.

“Diversity is incredibly valuable, it counters groupthink. You want that in your security team, and definitely in any good red team.”

Turner said human history was “littered with disasters that stemmed from a group of people all thinking the same way and not contemplating that there could be other views.”

“I’ve seen people from not just analytics backgrounds but also as broad as history, languages and music go into cyber security and be highly effective.” 

Full Story

 

PageUp People, a successful Australian Software-as-a-Service vendor, has been the victim of a crime, with a data breach that could be extremely damaging for its prospects. There are two lessons for the industry that are worth drawing particular attention to.

The first lesson is that we need the victim to survive. Once PageUp is safely through this incident, one of the most valuable things its executives can do for the industry is to share their experiences and the lessons learnt.

Sharing this information is important because, as one security executive from an ASX50 company said to me, it could have been any of us. And, it is only through sharing these experiences and the lessons from these crimes that we, as an industry, can improve.

Despite years of security incidents and data breaches worldwide, many Australian executives think their organisations are magically immune. It's far too easy to underestimate the potential impact, the flow-on consequences, and the personal cost for people involved or affected.

 
 

Conclusion: A requirement of the European Union’s (EU) General Data Protection Regulation (GDPR) is the concept of “data portability”, which provides a right to receive personal data an individual has provided in a “structured, commonly used, machine-readable format”, and to transmit that data to another organisation.

Underlying data portability is an assumption that data standards exist and are widely used across all public and private sector organisations, especially in specific vertical industries, such as Financial Services, Health or Utilities. In many cases in Australia, no such standards exist and there is no framework to encourage industry cooperation.

Australian organisations needing to comply with GDPR will have to develop an approach and strategy to how they will provide data portability when requested to do so.

Australian businesses currently face a cyber security triple threat that has nothing to do with warding off hackers.

Rather there are three new regulatory forces impacting specific points of the cyber security posture of the Australian economy, where relevant businesses will face all kinds of trouble if they fail to keep up to speed.

These external obligations are the Notifiable Data Breach (NDB) scheme, the Security of Critical Infrastructure Bill, and APRA's draft of Prudential Standard CPS 234.

There are lessons to be learned from all three of these external obligations. At a simplified level, the NDB scheme addresses the security of people's data; the Security of Critical Infrastructure Bill addresses the technology that supports our lives, and CPS 234 addresses the processes and governance that protect our wealth.


Full Story:

Conclusion: The forthcoming General Data Protection Regulation (GDPR) legislation is being introduced by the European Union (EU), which has ramifications to organisations worldwide.

Key aspects of GDPR relate specifically to what data exactly an organisation should be able to legally keep and for how long. The underlying principle is that less is best in terms of data collected and kept. For the data to have been legally collected, an individual has to have explicitly given their consent to the organisation to collect, keep and process their personal data.

More than 60 data breaches have been reported in the first six weeks of the country's new Notifiable Data Breach (NDB) scheme, with healthcare providers making up almost a quarter of the mandatory notifications.

Of the 63 notifications revealed in the first report by the Office of the Australian Information Commissioner since the laws came into effect on February 22, legal, accounting and management services businesses made up 16 per cent, while finance institutions composed 13 per cent.

IBRS cyber security advisor James Turner said many companies in the healthcare sector still did not realise the gravity of the responsibility on their shoulders in terms of keeping people's data safe.

"I've been talking to healthcare providers around the traps and I'm stunned by the lack of awareness of the NDB scheme. I'm hoping the industry bodies and royal colleges are doing something to raise awareness," he said.

Full Story



 

Conclusion: UpGuard, Nuix and WithYouWithMe each have a proven capability to address an important aspect of the cyber defences of Australian organisations. WithYouWithMe is about people, UpGuard is about ensuring process is adhered to and exceptions are visible, and Nuix delivers technology which, through a data processing engine, enables organisations to make sense of large amounts of unstructured data.

Conclusion: The General Data Protection Regulation (GDPR) legislation being introduced by the European Union (EU) in May has ramifications to organisations worldwide.

Australian organisations that have already invested in ensuring that they comply with the Australian Privacy Act 1988, and have a robust privacy management framework in place, may find that they already comply with aspects of the EU’s GDPR. However, GDPR does have more stringent requirements including requirements that are not within the Australian requirements, so effort and investment will be required by organisations that need to comply with GDPR.

When considering an organisation’s position and defensibility in terms of whether they complied or not, organisations will need to develop an understanding of the specific requirements, and how exactly they have implemented “technical and organisational measures to show that they have considered and integrated data protection into their processing activities”1.

Do not mistake cyber security for being merely a technical discussion about IT problems to be fixed. Cyber security is now, and always has been, purely a response to risk. The risks have changed dramatically over the last 20 years, but the way many people view security is stuck in the 1990s.

Here in Australia, we're now under the Notifiable Breach Disclosure scheme and it's worth using this as a barometer to understand how well executives actually appreciate that they run digital companies working in a digital economy, with all the risks that come with hyper-connection and digital interdependence.

How well an organisation understands itself and its ability to work through responding to a suspected data breach is a direct reflection of how well it understands its business, as well as its dependence on technology and data. In other words, how well does the company understand and manage risk? Yeah, governance, that old chestnut.

People talk about digital transformation and disruption as though these were destinations to get to. But, digital transformation is a continual process and risk management is a necessary component. There is no finish line for transformation or risk management, there are only companies that will cease to be competitive.


Full Story

Conclusion: The foreseeability of cyber incidents is widely accepted, but many organisations still have not done the work to identify their own exposures and ascertain what they would do in a crisis. The openness of shipping giant Maersk in talking about the impact of the NotPetya malware on the organisation should be viewed through the lens of “what would that look like if it happened to us?” The business impact of NotPetya on Maersk is clear, but so too are many of the risk mitigations that should be put in place before a cyber incident – and many of these are not directly related to technology. Finally, risk management is just as much about recovering from an incident as trying to prevent one.

Conclusion: The forthcoming General Data Protection Regulation (GDPR) is new legislation being introduced by the European Union, which does have ramifications for organisations worldwide.

Being new, there is still a lot to be learned about what exactly some of the specific requirements will mean in practice and how they will impact organisations in being able to show that they have understood and completely complied with the regulation.

When considering an organisation’s position and defensibility in terms of did they comply or not, organisations will need to develop an understanding on the specific requirements, and how exactly they have implemented “technical and organisational measures to show that they have considered and integrated data protection into their processing activities”1.

Conclusion: Security awareness campaigns are essential for educating staff on security behaviours. However without staff engagement, these campaigns can fail to change behaviour – and behavioural change is the only outcome that really matters. Instead of continually focusing on security for the work environment, start focusing on esafety and educate staff on how to protect themselves in their online lives outside work. This has the benefit of informing staff on many of the risks that they can face personally, as well as educating them on practices and technologies that can help. Training staff on esafety also has the additional benefit of being the right thing to do and demonstrates corporate social responsibility.

NewsThousands of Australian small businesses remain woefully unprepared for the introduction of new laws that will require them to publicly disclose if their customers' data is breached by hackers or technology problems, according to local industry experts and recently conducted research.

Mandatory data breach reporting laws come into effect in Australia in February, years after they were introduced in other countries, such as the US, but a new study by cyber security provider CyberArk has found 44 per cent of Australian businesses are not fully prepared.

While it is predictable enough for a security vendor to warn that businesses need to worry more about security, independent Australian cyber security expert James Turner, of IBRS and CISO Lens, said small businesses were "absolutely not" prepared for the new laws.

Full Story

Cyber security experts have warned the long-term implications of chip vulnerabilities nicknamed Spectre and Meltdown discovered by researchers this week are still unknown, despite it appearing that cyber criminals were unaware of the flaws.

Australian cyber security expert James Turner, of IBRS and CISO Lens, told The Australian Financial Review just because these flaws were unlikely to have already been exploited, does not mean they could not be in the future.

"This is the exact reason why the security industry was screaming all through the last few years about the importance of security for the internet of things. The internet of things is billions of different devices, growing in size every month, all based substantially on hardware," he said

"It simply won't be economically viable to get everyone to replace the CPU on their TV, fridge, Alexa, lightbulb, thermostat, electric lock, and so on, just because we've found another hardware flaw that impacts billions of devices that are all hyper-connected."

Full Story

Conclusion: Third party bug bounty programs can be an effective way of incentivising security researchers around the world to share a discovered vulnerability. Third party bug bounty programs are invaluable as they help provide a structure for responsible disclosure and minimise the opportunity for the vulnerability to be exploited. When a bug bounty company uses crowdsourcing of security researchers, it adds the gamefied imperative for the researchers to report quickly in order to get the bounty before their peers. Engaging with a crowdsourcing bug bounty company not only demonstrates a reasonable security measure, it also helps close the window of opportunity for criminals.

 

The adults in the lives of young people need to know more about security and safety in an online world and they could be learning this at work

The Office of the eSafety Commissioner deals with some of the most confronting aspects of abusive behaviour on the Internet: child exploitation material, image-based abuse, and cyber bullying, to name a few.

Julie Inman Grant, the eSafety Commissioner, is dedicated to helping ensure young people have positive experiences online.

To this goal, in the first week of November, the Office of the eSafety Commissioner, in conjunction with its New Zealand equivalent NetSafe, hosted Australia's first online safety conference.

About 400 delegates from around the world came to share ideas, approaches and research in the area of cyber safety.

 Full Story

Conclusion: Cyber security is an area in which organisations do not compete. They each face similar risks and threats, and it is only through the development of trusted relationships and the resulting collaboration that Australian organisations can work together to sustain their own operations and maintain the economic wellbeing of the nation in the face of cyber threats.

There is still a way to go, and leading Chief Information Security Officers (CISOs) with international experience believe we are between six and nine years behind the US and the UK. Australia is coming off a low base, but we are getting better quickly.

Commonwealth Bank of Australia has admitted it is culling the number of technology partners it works with as part of a cost cutting drive that has some industry observers concerned it is stepping back from its previous leadership position on cyber security.

CBA has been the subject of ongoing rumours in IT circles that it is taking the knife to its celebrated technology operations, and chief information officer David Whiteing confirmed to The Australian Financial Review that changes were under way, including some cyber security work going offshore.

However, Mr Whiteing rejected suggestions that any of the changes would compromise the quality of work or the bank's resilience, and insisted that the bank had not retreated from the national cyber security arena since the departure through ill health of its well respected chief information security officer, Ben Heyes, last year.

"The reality is this is a very competitive space and we have a global perspective around talent," Mr Whiteing said.

 Full Story

When was the last time you had a delightful customer experience with insurance? Well, we need to talk about cyber insurance.

In 2013, the Financial Ombudsman Service penned a circular titled "Queensland floods – lessons learnt" and there are useful ideas for us to bring to the cyber insurance discussion.

The Financial Ombudsman Service noted that among the improvements between the experience of Queenslanders claiming on flood insurance in 2011, and then 2013, was the standardised definition from the government of what a flood is. Words matter.

It's easy when we're dealing with fire, theft and flood. Well, at least in theory it's easy. We've been dealing with natural disasters for millennia. But the cyber domain and the risks that come with it are comparatively new, and evolving rapidly. A year is a long time on the internet.

Full Story

Conclusion: Whilst the forthcoming General Data Protection Regulation (GDPR) is a European regulation, some Australian organisations are likely to be impacted and will need to comply. One of the requirements of the regulation is to appoint a Data Protection Officer (DPO), whose job role has very specific duties and legal responsibilities which are defined as part of the GDPR.

However, the guidelines are not completely clear as to when it is mandatory for an organisation to appoint a DPO. Australian organisations should consider if, 1: will they need to comply with the GDPR, and, 2: will they need to appoint a DPO?

Telstra has taken a high-profile step in its bid to establish itself as a significant player in the booming global cyber security market, with the official opening of the first of a string of new security operations centres, aimed at increasing the work it wins with government and corporate clients.

The multimillion-dollar Sydney centre was unveiled by chief executive Andy Penn alongside federal Cyber Security Minister Dan Tehan on Thursday afternoon, as the company continues its mission to prove to investors it has a solid post-NBN plan.

Telstra shares were hit hard after its annual results, led largely by Mr Penn announcing the company's much-loved dividend would be slashed by 30 per cent. Investors are now looking to the CEO to demonstrate that the company is on the front foot in establishing business lines in growing sectors.

Full Story

Conclusion: The recent high profile malware incidents, WannaCry and NotPetya, are a bellwether for a change in what the industry should reasonably expect online. WannaCry demonstrated that a group with nation state links can target everyone online, simply to harvest money. NotPetya demonstrated that a group with nation state links can target a nation’s economy with the explicit intention of causing economic trouble. Australia must prepare itself accordingly. It is no longer enough to know that we have a government agency that excels at cyber-spooking, we need a formalised capability to respond to global and national malware incidents.

 Conclusion: Despite increasing focus on information and data in an as-a-Service age, thought leadership in the data management discipline has waned. Today, few of the frameworks, methods and bodies of knowledge that emerged either from the data modelling fraternity or the records management community in the last decade remain active.

This leaves organisations seeking to address the impacts of increasing privacy regulation, cyber security risks from increased digital delivery or improving data integrity to support automation with only one real choice – the Data Management Association (DAMA)’s Data Management Book of Knowledge whose 2nd Edition (DMBoK2) has emerged after almost three years of international collaboration.

Despite the wait, DMBoK2 provides a much-needed update on an already solid foundation addressing contemporary issues with the exception of fully addressing the challenges of data science in its broadest form. Organisations seeking to comprehensively address data management would be well served by adopting DMBoK as a foundational model, thereby ensuring they have a single point of reference regardless of the specific outcomes or priorities that need to be addressed now or in the future.

Who wasn't moved by the story of Alan Turing, the brilliant English mathematician whose dedicated team cracked the Nazi Enigma code and saved countless lives during World War 2?

Fast forward more than 70 years and the ability of terrorist groups such as Islamic State and al-Qa’ida to harness ­encryption methods on the internet has created its own Turing doomsday imperative. Either we crack the codes or our law enforcement agencies will remain in the dark about terrorist plans for more carnage.

Next week, political and ­national security chiefs from Australia, New Zealand, the US, Britain and Canada will meet privately in the Canadian capital, Ottawa. High on the agenda will be ways to combat terrorism, and one of the key points will be cracking encryption in messaging apps.

The task at this conference, known as Five Eyes, is incredibly difficult — nearly impossible.

Some of the most common messaging apps are Apple’s iMessage, Facebook Messenger, Whats­App, Signal, Telegram and Wire. Every day, millions of people send billions of messages to each other, secure in the knowledge that new-age encryption technology means their conversations will remain private.

Full Story

Experts say efforts to get technology and social media firms to cooperate with the authorities in decrypting communications will be hard to achieve. The Australian government wants smartphone companies and social media platforms to ensure terrorists cannot hide behind anonymous posts or encrypted messages, but it has not said how or when.

In his recent national security statement to parliament, Australia’s prime minister Malcolm Turnbull said traffic on encrypted messaging platforms was difficult for security agencies to decrypt.

Most of the major platforms of this kind are based in the US, where a strong libertarian tradition resists government access to private communications, as the FBI found when Apple would not help unlock the iPhone of the dead San Bernardino terrorist,” he said. “The privacy of a terrorist can never be more important than public safety.”

James Turner, cyber security analyst at advisory and consulting company IBRS, added: “You can’t build crumple zones into encryption systems because it puts up big neon signs saying there’s a vulnerability.”

Instead of trying to gain access to the encrypted communications, Turner said governments should “aggressively target the endpoints”, especially as services such as Apple’s iMessage were being re-engineered to make encrypted content inaccessible to even Apple itself.

Full Story

 

Conclusion: Much like the fable of the Boy Who Cried Wolf, the security industry has a limited number of opportunities to channel enterprise and national attention to cyber incidents. The WannaCry ransomware worm runs the risk of using up that credit for the security industry as so little impact was felt in Australia. The lack of local impact was more due to luck, and we cannot count on being that lucky twice. Therefore, IT and cyber security leaders must use the lessons from this experience now to prepare their organisations for a foreseeable future that includes similar incidents.

It's now a year since the launch of the Australian Cyber Security Strategy. Could progress be better? Of course. But the progress is good. Actually, it's great.

The collaboration between government and the private sector has had a fresh wind touch its sails and the level of cyber security collaboration between many of Australia's largest organisations is at an unprecedented level. The recent global wave of ransomware, variously termed WannaCry or WannaCrypt, was a live-fire exercise for testing the efficacy of this collaboration.

The recent launch of the ASX 100 Cyber Health Check report was an excellent step on the journey to a more complete understanding of what will come to be viewed as due care in the domain of cyber risk management, and the launch of the Australian Cyber Security Growth Network is already making waves for the local start-up community.

The prevailing sentiment is that we don't really have a choice other than to work together because we absolutely have to be good at this. Collaboration is

Full Story

Cyber security experts said Australian businesses and government agencies got lucky in avoiding potentially devastating effects from a global ransomware cyber attack, which wreaked havoc around the world at the weekend, but warned problems could emerge as organisations return to work on Monday.

Unlike in Britain, where some hospitals ground to a halt, no major victims of the so-called WannaCry malware attacks have emerged in Australia, where there was only one unnamed case of infection, after companies called in security staff on Saturday to quickly update software patches.

However, despite Prime Minister Malcolm Turnbull seeking to calm any local alarm over the weekend, the government's cyber security experts have copped some criticism for failing to show sufficient leadership in proactively advising organisations about the threats and required course of action.

Full Story

Conclusion: Australian organisations and agencies need to embrace the European Union’s new General Data Protection Regulation (GDPR) legal framework for protecting and managing Private Individuals Information (PII). There is considerable risk to organisations that do not take action to comply, financially and to organisations’ brands.

There are also potential upsides in embracing the requirements and being able to demonstrate compliance with the accountability principles, and implementing both technical and organisational measures that ensure all processing activities comply with the GDPR.

Whilst Australian companies may already have practices in place that comply with the Australian Privacy Act 1988, GDPR has a number of additional requirements, including the potential appointment of “data protection officers”. Action should already be taking place, and organisations should not underestimate the time and effort it may take to reach and maintain compliance.

Conclusion: IT executives must appreciate that managed security services is not a simple IT outsourcing function, because cyber security it not merely an IT problem. Engagement with an MSSP (managed security service provider) is using a vendor to help manage the highly dynamic risks of conducting operations in a modern, hyper-connected environment. This engagement has cost implications for both parties and will require a commitment to continually reviewing suitability of services. Executives should aim to evolve their own cyber risk management capabilities around people, process and technology, because this internal maturity is required to get the most from engaging with an MSSP.

 IBRS iQ is a database of Client inquiries and is designed to get you talking to our Advisors about these topics in the context of your organisation in order to provide tailored advice for your needs.

Forensic software firm Nuix has begun a search for a new chief executive with a "global IPO skill set", all but confirming plans to pursue a public listing in 2017 that may deliver the ASX a new $1 billion-plus technology company.

The move comes at the same time as the company has appointed cyber security expert and former US ambassador to Australia, Jeffrey Bleich, to its board, signalling a greater focus on its cyber products.

The company, which was founded in 2000 by a team of computer scientists and last year was instrumental in the Panama Papers investigation by providing the technology that was used to analyse the documents, is expected to be worth more than $1 billion when it lists.

Full Story

Cyber security experts have warned the federal government must put aside budget deficit concerns and invest in upgrading aging computer systems vulnerable to a damaging attack from a foreign state. 

 
Concerns about such an attack intensified after the United States government recently accused Russia of using cyberpower to influence the outcome of the 2016 presidential election by ordering attacks on the Democratic National Committee's computers and those of other political organisations.
 
 
 

Conclusion: Bugcrowd, Hivint, Kasada, and Secure Code Warrior each has a proven capability to address an important aspect of the cyber defences of Australian organisations. The Australian Cyber Security Strategy, launched in April 2016, advocates the promotion of local capabilities where Australia can build globally competitive solutions. These four vendors are already being used by leading local cyber security executives, and their capabilities are acknowledged.

Related Articles:

"Hot cyber security vendors for your shortlist Part 3 – more Aussies" IBRS, 2018-03-31 07:06:21

"Hot cyber security vendors for your shortlist – Part 1" IBRS, 2016-12-03 02:41:25

After making a splash in the data centre, software-defined networking (SDN) is now becoming increasingly relevant for the enterprise WAN, with analysts saying the software-defined WAN (SD-WAN) has the potential to reduce capital and operational expenditure, hasten network provisioning and increase network availability.

In their recent paper, ‘Cloud and Drive for WAN Efficiencies Power Move to SD-WAN’, IDC analysts Brad Casemore, Rohit Mehra and Nav Chander discussed how SD-WAN can help organisations meet the network requirements of their branches and remote sites.

Full Story

Conclusion: In the IBRS Security Leadership capability maturity model, buying more product is level 2: Alienated, and is typified by IT teams that are struggling to take on the challenge of cyber security because they address it as a technical problem. Buying product without a clear understanding of the business risk it is aiming to address is a guarantee for failure. But for organisations that understand that cyber risk is much more than IT, know there is a business risk that comes with cyber capability, and have the organisational will to address it, technology can make a significant difference in automating and accelerating capability. These three vendors, Crowdstrike, CyberArk and Tanium, are well regarded by leading Australian customers.

Related Articles:

"Hot cyber security vendors for your shortlist Part 2 – Aussie startups" IBRS, 2017-01-01 10:35:40

"Hot cyber security vendors for your shortlist Part 3 – more Aussies" IBRS, 2018-03-31 07:06:21

Conclusion: Organisations must proactively manage exactly which data is kept, secured, and backed up, as well as which data must be archived or permanently deleted. Data hoarding adds considerably to storage costs as well as potentially exposing organisations to risks especially if the data is inappropriate, unencrypted, or could put an organisation’s brand at risk.

Organisations need to have clear policies on exactly what sort of data is to be kept, especially when there are legal, regulatory or other specific reasons for keeping the data. Additionally, organisations need to be clear on what should not be kept.

Organisations cannot leave the management of this issue at simply expecting compliance to a policy. Business stakeholders must be closely involved in defining the business imperative for tracking data relevance and the value of data. Data specialists equipped with the appropriate tools will be required to specifically find data and manage it based on defined policies.

FireEye has recently struck a deal Microsoft, designed to place the security vendor's iSIGHT Intelligence into Windows Defender, an inbuilt Windows security offering.

Terms of the deal will see FireEye gain access to telemetry from every device running Windows 10, serving up access to almost 22 per cent of the total desktop market, alongside laptops and Windows mobile phones.

Widening the security scope further, Microsoft previously intended to have one billion devices running Windows 10 by 2019.

While the vendor has since backtracked on this statement - stating that the process would take longer than originally predicted - the direction of travel is clear.

Full Story

 

The Reserve Bank of Australia's top technology executive has said the central bank's networks are being probed by potential hackers every two seconds and that almost 70 per cent of the emails received by RBA addresses are malicious.

In a wide-ranging speech to an annual conference held by technology research giant Gartner in Queensland, RBA chief information officer Sarv Girn highlighted the conflicting challenges involved with running an innovative tech strategy, while also remaining secure.

He said the RBA's tech strategy was a delicate balancing act between the need for resilience and the need to innovate and react to changes being wrought by the numerous disrupters in the booming start-up fintech sector.

"Whilst attaining digital reliability has been a crucial need for many years, the impact and consequence of getting this wrong in today's economy can threaten the very viability of an organisation," Mr Girn said.

Full Story

Commonwealth Bank of Australia's technology chief has led calls for increased cooperation among businesses and public sector agencies regarding cyber attacks, following the release of a government report highlighting increasing threats.

The government's peak cyber security agency the Australian Cyber Security Centre (ACSC), released an annual threat report on Wednesday morning, warning that government agencies were being compromised by hackers and that many businesses were too secretive about the threats they were facing.

While security industry insiders said the report did little to provide new information or practical advice about well-known threats, CBA's chief information officer David Whiteing told The Australian Financial Review he viewed it as an important contribution to a nation-wide effort to uplift the awareness of security teams and the general public

The report provided anecdotes about recent assistance that government departments and private sector organisations had needed from The Australian Signals Directorate (ASD) in tackling cyber attacks

Full Story

Conclusion: To be effective a cyber security program that controls access to hardware, software and data needs to be comprehensive and include all stakeholders. The challenge for IT and line management is to shape the message to the audience in terms they understand so they take their responsibilities seriously.

Conclusion: This research note sets out and describes the Security Leadership capability maturity model. In using this model, organisations must be honest about their current level before they can even speculate on the benefits of working towards a higher maturity level. Working towards higher levels of maturity has clear benefits for both IT and the business, as well as business alignment of IT. However, a critical part of the journey will be dealing with any resentment from business units about their experience to date. Security Leadership cannot emerge unless prior bad experiences around service delivery are acknowledged and addressed, because it is a commitment to trust and resilience from the organisation as a team.

  • Gain valuable insights into how security leaders are positioning cyber-security and risk within their organisations
  • Be able to self-assess how your organisation measures up on the IBRS capability maturity model for security leadership
  • Learn how to position cyber-security so that it is aligned to business priorities 

"This Master Advisory Presentation is designed to guide and stimulate discussion between business and technology groups, and point the way for more detailed activity. It also provides links to further reading to support these follow-up activities." James Turner, Author of the Security Leadership MAP.

For a deeper understanding of how security impacts the way business is done, download your copy now. 

A security leader understands today’s cyber risks, how these apply to their organisation and market, and has management’s confidence to address these risks responsibly. A security leader guides the organisation through the realities of the new business environment, aligning the organisation’s practices and technologies to its risk appetite, and ensures these controls match and support the organisation’s desire for growth and innovation.

This MAP is designed to guide and stimulate discussion between business and technology groups, and point the way for more detailed activity. It also provides links to further reading to support these follow-up activities.

Conclusion: The introduction of Software Defined Networking (SDN) offerings touted a number of benefits around simpler and more agile network management and provisioning, lowering capital and operational costs.

With the recent issues that the ABS has experienced trying to execute an online census, IBRS is sharing an Advisory Paper by James Turner which reviews a practical framework that helps organisations make better decisions with their information assets and service providers.

Applying the Five Knows of Cyber Security is a must read for organisations that may be exposing themselves to risks through their supply chain.


Business leaders must accept that ransomware attacks are a foreseeable risk. 

Conclusion: Ransomware has proven such a successful cash cow for criminals that it is unlikely they will voluntarily stop their attacks. This means that business leaders must accept that further ransomware attacks are a foreseeable risk. While there are important conversations around the level of appropriate technical controls that an organisation may wish to implement, this conversation can only occur after business leaders have decided whether they want their organisation to help fund organised crime, or not. For organisations with a strong corporate social responsibility ethos, this is a very easy decision to make, but it is imperative that business leaders understand why they are committing to better technical hygiene and accepting tighter technical controls.

Outside of the big four banks and Telstra, Australia lacks world-class cyber security teams.

by James Turner

A few weeks ago I was fortunate enough to attend the world's largest cyber-security event, RSA Conference, in San Francisco. This year was the 25th anniversary of the conference, and there were 40,000 attendees, and over 500 vendors exhibiting.

My experience at RSAC reflected my experiences at many other international cyber-security gatherings over the years. I have come to the conclusion that Australia has pockets of cyber-security leadership that are world-class, and in some instances, world-leading. But these pockets of capability – almost all at the top end of town – are insufficient for the nation's needs.

In Australia we have a small number of organisations with big cyber-security teams, and established leaders with excellent bench strength in their direct reports. Principally, these pockets of cyber maturity are in the big four banks, and a hothouse of talent that has emerged in Telstra.

Conclusion: Cyber security can be perceived by outsiders as an occult domain. Psychologically, people can respond in many ways to something they do not understand with responses ranging from denial to fear. Consequently, a frequent challenge to better security maturity is inertia, rooted in ignorance. It is imperative that security practitioners break down this barrier by communicating with decision makers in a way that empowers the decision maker. Consequently, valuable conversations about risk and threats can be grounded in conversations about reliability, resilience, safety, assurance and reputation. Security may not need to be mentioned and, in many cases, even raising the label of security can undermine initiatives that had security as an objective.

Conclusion: As cyber security gains awareness among business leaders, many organisations are undertaking new cyber risk management initiatives. However, these initiatives can be misdirected if business leaders are not clear on why they are doing them. On the journey to improving an organisation’s cyber security maturity, the question “why?” is a powerful tool to test alignment of security to business requirements.

Conclusion: Organisations must understand that cyber risk is not merely a technical issue that can be delegated to IT but is a business issue that comes hand-in-hand from operating in a modern, online, ecosystem. Until cyber risk is treated as a business risk, we will continue to see organisations fighting a rear-guard action to threats that should have been designed-against through better digital business strategy.

Conclusion: It is undeniable that Cloud services will only become more important to organisations. However, executives must bear in mind that as increasing Cloud adoption meets an onslaught of cyber-attacks, regulators and courts will be looking for evidence that organisations exercised due care in vendor selection and support of information security initiatives. The great challenge is in communicating to non-technical people what are often thought of as merely technical issues. In this shifting market, an approach such as the “Five Knows of Cyber Security” can prove invaluable in shifting a technical conversation to a governance conversation.

Related Articles:

"Applying The Five Knows of Cyber Security (Video)" IBRS, 2016-08-15 02:39:16

Conclusion: Security leaders know that it is not enough for the security group to do its job; they must be seen to be doing their job. This need for communication between security and the business is resulting in organisations creating outreach roles. Many organisations have yet to realise that this communications gap directly impacts their risk management capabilities. While the security team may be executing its work with technical accuracy, it is not serving the true needs of the business. The key to bridging this gap is an outreach function.

Conclusion: as cyber-security becomes a board-level topic, organisations in the A/NZ region are feeling the pinch of the security skills shortage. In this environment, moving IT services to the Cloud has the potential to streamline and/or automate some basic IT security practices. Cloud services are not an IT security silver bullet, but for many organisations, the scale and maturity of some Cloud vendors will be an improvement over their current IT operations.

Conclusion: Awareness of risks and threats, by itself, is not enough to protect an organisation. Security awareness campaigns are a sustained attempt at behaviour modification. But behaviour modification works best when an individual is not resisting the change. This means that the first step for any security awareness campaign must be to assess employee engagement. If employee engagement is low, this must be addressed before a security awareness campaign can be effective.

Conclusion: As much as the industry should not blame the victims of cyberattacks, the industry must also learn from these crimes. There are important lessons that must be drawn out from these breaches, because most organisations would be equally vulnerable to similar attacks. Three key lessons are: look for indicators of compromise and be sufficiently resourced to respond, review exposure through third parties and, consider compliance to security standards as a bare minimum for required effort.

Conclusion: Organisations must ensure they have taken reasonable steps to not release IT equipment which contains information assets. Leading software options for wiping data will be more than adequate for most organisations, and physically destroying disks is both excessively costly and environmentally unfriendly. However, as important as ensuring that sensitive data is destroyed, it is equally important that the organisation has an audit trail to demonstrate that the data destruction policy has been followed. The more sensitive the information is, the greater the need for the assurance of an audit trail.

Mandatory data breach disclosure is exactly what it says: legislation that obliges an organisation to reveal that it has experienced a data breach and lost control of its customers’ personally identifying and/or sensitive information. The industry buzz really started in 2003 with California Senate Bill 1386 which obliged organisations to inform their customers if there was, or reasonably believed to have been, a compromise in the confidentiality of the customers’ data (which meant “lost” + “unencrypted”).  

Conclusion: IT executives from Australia’s largest organisations are actively looking for ways to create cyber-resilience, not just in their organisations, but also in the ecosystem their organisations operate in. These executives are acknowledging that it is not enough for an organisation to survive, if the community they operate in is crippled. IT security executives are concerned that in the event of a severe attack the current, disparate, communications channels between private sector and government will not be effective. There is a need for a coordinated, national, response to a severe cyber-attack; and that everyone in the information security community knows what this response is

Conclusion: The probability of an inside attack is hard to gauge and depends entirely on the inner state of the attacker, but the impact can range from inconsequential to disproportionately vast. CIOs must assess the risk of a malicious insider in the context of their organisation’s information assets and risk management priorities. Astute CIOs will know that technology alone will not mitigate this risk, and that an ongoing

Conclusion: Windows XP will not stop working in April 2014 when Microsoft stops supporting this popular operating system. However, as time passes, this OS will become an increasing burden on organisations, due to third party support, security challenges, increasingly specialised skillsets, and perception. Windows XP will quickly become a legacy environment, with all the associated challenges. Consequently, CIOs should have a clear plan for any remaining Windows XP machines. The value of a clear plan is two-fold: firstly for common understanding within the IT department, but also for communicating to stakeholders.

Conclusion: In engaging with an external incident response provider, it’s vital that they are not walking blind into your environment. Equally, you need to know exactly who they are, what they are capable of, and what the agreed outcomes of the engagement will be. If you have been attacked, or are still under attack, your organisation’s information assets are potentially at their most vulnerable, so the trust in your incident response provider needs to have been established prior to the attack. This places higher than normal importance on your vendor selection process, and in engaging with the incident response provider as early as possible.

Related Articles:

"Preparing for cybercrime - communications" IBRS, 2013-03-24 00:00:00

"Preparing for cybercrime: incident response" IBRS, 2013-09-25 00:00:00

In 2010, IBRS wrote that “My dog is a cloud” and noted that defining cloud was an exercise in fuzziness, there’s a gap between expectations and experience, and the self-promotion by cloud vendors is relentless. The more things change, the more they stay the same.

IBRS recently ran a series of roundtables where CIOs were able to meet and discuss the impact of the cloud on IT departments and their organisations. An interesting theme was that the CIOs often experienced great frustration with the cloud. Promises of lower costs, transparent billing, responsive support, and integration often varied from reality. Some of the stories sounded like a commercial version of Russian Roulette, or what it would be like dealing with an unregulated banking industry.

Conclusion: Recent exposure of US intelligence community actions, to monitor data of non-US entities, has highlighted the tenuous control organisations have over maintaining the confidentiality of their data. Whether US intelligence explicitly, or informally, assists US commercial interests, non-US organisations have been served with a clear warning as to how they should see this new world.

Organisations should review what information assets they are entrusting to US cloud vendors, and what the impact on the organisation would be if the confidentiality of these assets were to be compromised without the organisation’s knowledge.

Conclusion: In this era of targeted, self-obfuscating, and successful cyber-attacks, organisations must do three things. First, recognise that the organisation cannot prevent a dedicated attack. Second, understand what the organisation’s information assets are, and where they are. This is because we cannot always anticipate how the attacker may get in, but it is imperative to know what they are likely coming for. Third, increase your focus on detection and incident response, because you must be able to deal with a breach when it happens.

Conclusion: IT departments must alert both HR and legal counsel that the Mobile Device Management (MDM) platforms being deployed have the potential to put the organisation in breach of workplace surveillance legislation. MDMs can activate the cameras built into smartphones, activate the microphone, and access the smartphone’s GPS. Working with Legal and HR will likely result in new Acceptable Usage Policies for staff, and IT most likely needs to review controls for the MDM platform to ensure that these capabilities are not abused.

Conclusion: The intention and skill of an attacker will ultimately determine the impact of the attack, regardless of the preventative technologies an organisation has. In this respect, a skilled attacker intent on destruction is akin to a natural disaster: measures can be taken but ultimately it’s out of your hands. We cannot prevent floods and earthquakes, so what makes a difference is how organisations respond to these disasters. It is imperative that organisations with disaster recovery and crisis management processes extend these to include responding to cybercrime. The first area to look is at how the organisation will deal with not being in control of its own IT, including communications systems such as email and VoIP.

Related Articles:

"Preparing for cybercrime: incident response" IBRS, 2013-09-25 00:00:00

"Preparing for cybercrime; incident response Part 2" IBRS, 2013-11-27 00:00:00

Many years ago when I lived in Perth, one evening after work I was standing in chest-deep water at Cottesloe beach admiring the sunset. I happened to turn and look to my left and saw a fin sliding out to sea, about 10 metres away.

I quickly realised that the fin was making the sine wave motion of a dolphin, not the sideways sweep of a shark. When I turned to face the beach, there was a small crowd of 20 or so people gathered at the water’s edge. As I got out, a lady said to me, “He was swimming right behind you”.

IBRS, along with many other organisations, has written extensively about “the cloud”. Every organisation selling a product and/or service puts its own spin on what the cloud actually is.

The appeal of cloud computing cannot be denied,and the buzz in the market for the last few years is evidence of the desire of IT organisations to find ways to deliver IT services that are: better,cheaper, more resilient, more secure, and moreuser friendly.

Cloud services are not similar to a highly virtualised internal IT operating environment, although cloud vendors may use virtualisation extensively. Nor are they similar to the tightly controlled experience of time-sharing on a mainframe back in the 1970s, although cloud vendors may price their services in a similar user-pays model. Even though webmail, a form of Software as a Service,has been available to consumers since the 90s, cloud vendors have moved well beyond that simple offering.

While there are excellent and crisp definitions of what the cloud should be, for example the definition provided by the National Institute of Standardsand Technology1 (NIST), what really makes cloud new is how the term itself has become both all encompassing, and yet completely useless at defining the nature of the service!

Conclusion: Blackberry 10 will, at best, bring Blackberry functionality to where iOS and Android have been for over a year. However, most organisations are moving away from Blackberry, either publically or in a steady, quiet, exodus as users choose which handset they’d rather have. BB10 will not stop this exodus as it is designed for the enterprise, not the consumer. The steady decline in fortunes for RIM will be painless for most organisations, except the few that are tightly coupled to the Blackberry ecosystem. These organisations should act now to minimise the coming impact of dealing with a company with a bleak future.

Conclusion: Organisations which have gone down the Mobile Device Management (MDM) path with a view to enabling their staff to bring their own device (BYOD) are discovering the shortfalls of this device-control approach. A BYOD device is not a corporate asset and cannot be treated as such: it should be viewed as untrusted and treated accordingly. Consequently, leading organisations are treating BYOD as an exercise in remote access. Instead of trying to control the untrusted device, focus on user experience, and controlling access to the data.

Conclusion: Identity management projects do not have a good reputation for successful delivery. Too often, the final implementation fails to live up to promises. Identity management projects can deliver genuine value to a business, including: compliance with regulation, improving customer satisfaction, or reducing risk. But if the business is not driving the project, then the project is probably off the rails and heading for failure. In this situation, CIOs must seriously consider terminating the project because a project not driven by the business is one being imposed on it – it is the tail wagging the dog.

Conclusion: IT security strategies are an invaluable resource as a means of coordinating security efforts and in improving funding approval for security projects – because they can be shown to be following a coherent consistent strategy. The process to create them is an overlooked source of value for the information that it uncovers. An IT security strategy must be closely aligned with what the business believes its security and risk priorities to be. The process of uncovering business impact against various systems is likely to bring up unexpected gaps in knowledge for both IT and the business, and it is here you will find additional gold.