Cyber & Risk

Understanding cyber security has never been as critical as it is today.

The importance of having cyber security and risk mitigation strategies is now well-embedded in the corporate conscience, with more and more senior executives required to know their exact security posture and how to respond in the event of an incident.

In a complex world where new threat vectors appear almost daily, organisations must be ready. How well prepared are you?

IBRS can help organisations understand how resilient their systems are, develop incident response plans and get the right policies in place to ensure compliance with the most rigorous of security standards.

Who wasn't moved by the story of Alan Turing, the brilliant English mathematician whose dedicated team cracked the Nazi Enigma code and saved countless lives during World War 2?

Fast forward more than 70 years and the ability of terrorist groups such as Islamic State and al-Qa’ida to harness encryption methods on the internet has created its own Turing doomsday imperative. Either we crack the codes or our law enforcement agencies will remain in the dark about terrorist plans for more carnage.

Next week, political and national security chiefs from Australia, New Zealand, the US, Britain and Canada will meet privately in the Canadian capital, Ottawa. High on the agenda will be ways to combat terrorism, and one of the key points will be cracking encryption in messaging apps.

The task at this conference, known as Five Eyes, is incredibly difficult — nearly impossible.

Some of the most common messaging apps are Apple’s iMessage, Facebook Messenger, WhatsApp, Signal, Telegram and Wire. Every day, millions of people send billions of messages to each other, secure in the knowledge that new-age encryption technology means their conversations will remain private.

Full Story

Details: James Turner; 23 June 2017

Security Readiness

Experts say efforts to get technology and social media firms to cooperate with the authorities in decrypting communications will be hard to achieve. The Australian government wants smartphone companies and social media platforms to ensure terrorists cannot hide behind anonymous posts or encrypted messages, but it has not said how or when.

In his recent national security statement to parliament, Australia’s prime minister Malcolm Turnbull said traffic on encrypted messaging platforms was difficult for security agencies to decrypt.

Most of the major platforms of this kind are based in the US, where a strong libertarian tradition resists government access to private communications, as the FBI found when Apple would not help unlock the iPhone of the dead San Bernardino terrorist,” he said. “The privacy of a terrorist can never be more important than public safety.”

James Turner, cyber security analyst at advisory and consulting company IBRS, added: “You can’t build crumple zones into encryption systems because it puts up big neon signs saying there’s a vulnerability.”

Instead of trying to gain access to the encrypted communications, Turner said governments should “aggressively target the endpoints”, especially as services such as Apple’s iMessage were being re-engineered to make encrypted content inaccessible to even Apple itself.

Full Story

Details: James Turner; 21 June 2017

Security Readiness

Two years ago, mobile device management (MDM) was the buzz. Mobile security was an essential part of a mobility strategy, and every enterprise needed one. Today, not so much.

"About 18 months ago at least, businesses across the whole market realised that the issue wasn't around mobility. Mobility was subsumed by this idea of 'any device, anywhere'," according to Joseph Sweeney, an advisor with IBRS who specialises in end user computing, including mobility, future workplace strategies, and enterprise solutions.

"We're now starting to treat the desktop and the tablets and all these other devices as one and the same thing. Most of the strategies I'm working with do not distinguish between mobile device and desktop," Sweeney told ZDNet.

"What's changed is that instead of trying to say that here's a bunch of untrusted devices, and here's a bunch of trusted devices, people are realising that everything is an untrusted device, including the stuff in the office."

Full Story

Details: Joseph Sweeney; 07 June 2017

Future Workplace

Conclusion: Much like the fable of the Boy Who Cried Wolf, the security industry has a limited number of opportunities to channel enterprise and national attention to cyber incidents. The WannaCry ransomware worm runs the risk of using up that credit for the security industry as so little impact was felt in Australia. The lack of local impact was more due to luck, and we cannot count on being that lucky twice. Therefore, IT and cyber security leaders must use the lessons from this experience now to prepare their organisations for a foreseeable future that includes similar incidents.

Details: James Turner; 04 June 2017

Search Advisory Papers

Cyber & Risk

Streams

Other Practices

In the News