Leon Fouche

Despite enhanced cyber maturity, beefed up cyber budgets and improved security posture, many Australian businesses still lack the ability to act quickly and comprehensively in the face of a cyber security attack.

The key take-away from accounting and professional services firm BDO in Australia’s annual Cyber Security Survey, which – in conjunction with leading cyber emergency response team AusCERT – examined the cyber security risks and realities experienced by more than 500 board, business and IT executives across Australia and New Zealand.

The 2018/2019 BDO and AusCERT Cyber Security Survey found that despite the introduction of stricter compliance regulations and greater executive and leadership team buy-in on cyber security, untried or poorly planned response protocols were leaving both government and private enterprises vulnerable to increasingly sophisticated cyber attacks.

BDO’s National Cyber Security Leader Leon Fouche said all industries needed to ramp up their focus on employee education and training to empower their people to take action, with the 2018/2019 survey finding that 64 per cent of all data breaches were caused by targeted, malicious attacks on people.

“While recent compliance regulations have boosted data breach notification numbers and industry leaders have endorsed the implementation of more comprehensive resilience measures, many Australian organisations do not have the capability to detect a breach or respond to it in a manner that contains cost and reputational damage,” Mr Fouche said.

“Sophisticated cyber attacks and data breaches sit alongside weapons of mass destruction and natural disasters in terms of their ability to disrupt and damage, however in many business cases, the focus on preventative measures has far outweighed response or incident management.

“Every organisation should have a pre-defined plan, which is regularly tested, to ensure that everyone in the organisation knows what to do and how to respond to cyber security incidents.”

On average, the cost to an Australian organisation for a data breach was almost $US2 million.¹

The potential for huge financial implications is one reason 86.4% of survey respondents indicated they expected to have a cyber security awareness plan in place within the next 12 months.

The most common vehicle for cyber attack remained phishing, which accounted for 20.19% of all cyber security incidents experienced in 2018 and has been trending upwards since the inaugural BDO and AusCERT Cyber Security Survey in 2016. Phishing was followed by malware (14.08%) and ransomware attacks (9.39%).

“Phishing attacks remain popular as hackers seek the simplest, cheapest tactic to prey on human curiosity and achieve the best results,” Mr Fouche said.

“The level of sophistication of some phishing attacks makes it difficult for a recipient to determine if these types of emails are real or fake.

“That’s why education and training are so important. Employees need to be given the knowledge to detect a potential cyber attack and the tools to respond if they suspect there has been a breach or they have inadvertently disclosed sensitive information.”

AusCERT Director Dr David Stockdale was encouraged by the survey findings.

“AusCERT has long supported the concept of mandatory breach notification, and it is heartening to see evidence that organisations expected to comply with at least one data breach regulation spend approximately 20% more on information security controls,” Dr Stockdale said.

“It is also pleasing to observe the survey finding that leadership awareness has increased.

“This has forced a change of culture within our own management as we’ve shifted from a purely technical organisation to a business focused, modern incarnation of a Cyber Emergency Response Team.

“Increasingly AusCERT is seeing greater uptake amongst members for training courses, impartial advice, post-incident reviews and the development of incident response plans.”

Respondents are anticipating data loss and theft of confidential information to be the most prevalent threat in 2019 and beyond.

———-

[1] Ponemon Institute’s Cost of a Data Breach Study: https://databreachcalculator.mybluemix.net/assets/2018_Global_Cost_of_a_Data_Breach_Report.pdf

The post Lack of cyber-attack preparedness leaves Australian businesses vulnerable despite lift in breach notification compliance appeared first on AdviserVoice.

A report published by leading global advisory firm BDO, in conjunction with leading cyber emergency response team AusCERT, has revealed 20% of incidents experienced by respondents in the past financial year were malware attacks, compared to 16.7% for both ransomware and phishing attacks.

BDO National Leader for Cyber Security Leon Fouche said he was unsurprised by the high reporting of malware attacks on these type of businesses.

“Cyber criminals use malware to take control of a user’s computer system and perform fraudulent activities,” Mr Fouche said.

“Once they have access to someone’s private or financial account information the potential for financial gain, at the expense of an often unsuspecting victim, can be significant.

“But it’s not just the financial loss businesses need to be concerned about, the extensive reputational damage must also be considered.

“If organisations have to disclose they’ve been the victim of a cyber attack that has resulted in financial loss, there is significant reputational risk.”

Mr Fouche said what was equally alarming—particularly given the financial impact at play—was that a quarter of respondents in this sector stated they had not currently planned to report cyber security risk to the board or executives.

“Despite 51.6% of respondents in this sector currently reporting these risks to the board, it’s quite confronting when you see so many not even considering it in the future,” he said.

“It’s important the board and CEO continue to play an increasingly active role in the cyber security of their own business. After all, they are ultimately accountable for it.

“This is particularly important in this sector because data breaches will impact the reputation and financial stability of an organisation and it’s essential for boards and executives to be educated about the impact and likelihood of a cyber security incident, and what the organisation’s capabilities are to defend against it.”

Key Financial and Insurance statistics

Cyber security controls already or currently being adopted in the financial and insurance sector (% of respondents)

• Patch management processes 64.5%
• Privileged account management 74.2%
• Email filtering system to block suspicious emails 93.5%
• Regular cyber security risk assessments 54.8%
• Cyber security awareness program 58.1%

Top three cyber security incidents experienced last financial year in the financial and insurance sector (% of respondents reported)

• Malware/trojan infections 20%
• Phishing/targeted malicious emails 16.7%
• Ransomware 16.7%

The post Malware attacks most prevalent in financial and insurance services appeared first on AdviserVoice.

Leon Fouche

The critical focus of many Australian organisations on maintaining current awareness and defending themselves against the threat of a cyber attack has prompted leading audit, tax and advisory firm BDO to bolster its advisory capacity in this area.

Cyber security and technology risk specialist Leon Fouche has joined BDO’s Brisbane Risk Advisory team, providing the firm’s clients with an enhanced suite of solutions to tackle cyber security threats such as information loss and system disruptions.

His appointment follows the addition of business systems risk and assurance specialist Sharee Bartlett to the team in late 2015.

BDO National Leader, Risk Advisory Services, Marita Corbett said there was growing demand in the market for consultancy on technology-related risks.

“The short and long-term effects of cyber security incidents can be devastating to organisations and their broader stakeholders, operationally, financially, and from regulatory and reputational perspectives,” Ms Corbett said.

“Not only are Boards and executives trying to balance the efficiency benefits of technology-based business systems with the risks, they are facing increasing accountability including possible future legislation to manage these better.

“For example, the Federal Government’s draft Privacy Amendment (Notification of Serious Data Breaches) Bill 2015 – if passed – would introduce requirements to notify the national privacy regulator and affected individuals whenever such a breach is suspected.

“Leon significantly boosts BDO’s ability to work with clients to address these issues, bringing to the firm more than 20 years of experience including senior roles working with the public and private sectors.”

Mr Fouche is an active member in the Australian cyber security community and recently led G20 cyber security assessments and preparations for both government and private sector companies. He suggested broader sectors could learn from recent Federal and State Government moves to safeguard against cybercrime.

“The Federal Government is in the process of preparing its Cyber Security Strategy and the Queensland Government recently committed to investing in a highly specialised Cyber Security Unit,” Mr Fouche said.

“While governments are certainly prime targets for cybercrime, all entity forms are becoming more cyber-dependent and criminals becoming increasingly sophisticated in the ways they target them.

“The ability to detect and respond to cyber attacks is critical for all businesses, and requires both an understanding of current cyber security threats as well as collaboration across industry on cyber threats.”

The post BDO bolsters Risk Advisory team to help Australian organisations tackle cyber security risks appeared first on AdviserVoice.