Log in

Security Leadership



Conclusion: As much as the industry should not blame the victims of cyberattacks, the industry must also learn from these crimes. There are important lessons that must be drawn out from these breaches, because most organisations would be equally vulnerable to similar attacks. Three key lessons are: look for indicators of compromise and be sufficiently resourced to respond, review exposure through third parties and, consider compliance to security standards as a bare minimum for required effort.

Conclusion: When considering using cyber-insurance to deal with the potential costs associated with a successful attack, there are important considerations that CIOs and CISOs should be highlighting to operational risk and finance executives. Most organisations will need to raise their risk maturity substantially, and this means investment as well as changes to practices, before they are in a position to be able to take advantage of cyber-insurance.

Conclusion: There are a number of traits and behaviours to look for in an effective security leader, which are different from a traditional IT leader. The measure of an effective CISO is not whether their organisation has had a breach, or not. The measures of an effective CISO are the types of incidents their organisation has, and how their organisation responds to these. Consequently, an effective CISO is a requisite component for comprehensive risk management and organisational resilience.

Conclusion: Security leaders should approach security frameworks as a challenge to how the organisation secures its information assets. So, security leaders should be able to defend adherence, or variation, from any point on a chosen framework. Variance may be critical for business function, but the security leader needs to know this and be able to articulate it. This is not an argument for non-compliance, but toward a deep understanding of business requirements – and being able to defend this position to internal and external auditors.

Conclusion: Organisations must ensure they have taken reasonable steps to not release IT equipment which contains information assets. Leading software options for wiping data will be more than adequate for most organisations, and physically destroying disks is both excessively costly and environmentally unfriendly. However, as important as ensuring that sensitive data is destroyed, it is equally important that the organisation has an audit trail to demonstrate that the data destruction policy has been followed. The more sensitive the information is, the greater the need for the assurance of an audit trail.

Mandatory data breach disclosure is exactly what it says: legislation that obliges an organisation to reveal that it has experienced a data breach and lost control of its customers’ personally identifying and/or sensitive information. The industry buzz really started in 2003 with California Senate Bill 1386 which obliged organisations to inform their customers if there was, or reasonably believed to have been, a compromise in the confidentiality of the customers’ data (which meant “lost” + “unencrypted”).  

Conclusion: Cyber-insurance will be an inevitability for all organisations. However, executives should be clear on what level of cover they are buying, what incidents they are getting cover for, and the costs and impacts on the organisation that insurance cannot (or may not) cover.

An exploration into the feasibility of cyber-insurance is likely to raise good questions about whether an organisation has sufficient controls in place, as well as to what degree the organisation is willing to self-insure. But these questions, like the purchase of cyber-insurance, can only be addressed by the business.

Conclusion: The deadline for compliance with the Privacy Act passed in March, yet some organisations have not yet started reviewing their level of non-compliance. More mature organisations have been proactive and, in projects driven by the business, have reviewed and addressed areas of non-compliance. Some of these projects are still underway. These proactive organisations have the view that the cost of ensuring compliance is outweighed by the potential damage to the organisation’s reputation in the event of a publicly disclosed privacy breach where the organisation is found to be at fault.

Conclusion: IT executives from Australia’s largest organisations are actively looking for ways to create cyber-resilience, not just in their organisations, but also in the ecosystem their organisations operate in. These executives are acknowledging that it is not enough for an organisation to survive, if the community they operate in is crippled. IT security executives are concerned that in the event of a severe attack the current, disparate, communications channels between private sector and government will not be effective. There is a need for a coordinated, national, response to a severe cyber-attack; and that everyone in the information security community knows what this response is

Conclusion: Many IT executives are still unclear as to their obligations under the amended Privacy Act. IT executives should use the Privacy Act as an opportunity to start transitioning into a technical advisor role for their organisation. They should avoid falling into the trap of trying to unravel the Act from a legal perspective. It is paramount that the business understands that while IT can take leadership on a project for compliance with the Privacy Act, compliance is a business obligation and not an IT problem.

In the News

The three cyber security challenges Australian businesses can't ignore - AFR - 6 May 2018

Australian businesses currently face a cyber security triple threat that has nothing to do with warding off hackers. Rather there are three new regulatory forces impacting specific points of the...

OAIC report reveals 63 data breach notifications in first six weeks of NDB scheme - AFR - 11 April 2018

More than 60 data breaches have been reported in the first six weeks of the country's new Notifiable Data Breach (NDB) scheme, with healthcare providers making up almost a quarter of the mandatory...

New data breach notification scheme will be a barometer for business maturity - AFR -12 March 2018

Do not mistake cyber security for being merely a technical discussion about IT problems to be fixed. Cyber security is now, and always has been, purely a response to risk. The risks have changed...

The Future of Work: The Role of People - Adobe - 31 Jan 2018

The Future of Work: The Role of People Foreword by Joseph Sweeney, IBRS Advisor For the past 30 years, organisations have applied technology to people to make the workplace more productive. But...

Businesses unprepared for new data breach notification laws - AFR - 29th January 2018

Thousands of Australian small businesses remain woefully unprepared for the introduction of new laws that will require them to publicly disclose if their customers' data is breached by hackers or...

Subscribe to IBRS Updates

Invalid Input
Invalid Input
Please enter a valid email address
Please enter your mobile phone number
Invalid Input

Get in-context advice from our experts about your most pressing issues or areas of interest

Make an Inquiry


Already a subscriber?

Login to read your premium content.

        Forgot your password?
Recently Viewed Articles