sb-au logo
Story image

ESET says Australia's mandatory breach disclosure doesn't go far enough

20 Mar 2017

MinterEllison found that 13% of Australian business boards have absolutely no briefing at all on understanding the risks and how to prevent cyber attacks; a telling statistic that complements findings that cyber incidents doubled to more than 40% in the last year.

Australia’s mandatory data breach disclosure scheme is now becoming law. Those laws don’t cover all organisations which means potential threats are left unmonitored, even in large businesses and other government institutions.

ESET senior research fellow Nick FitzGerald shares his insights into the Australian security market.

He believes that boards must put data breach risks and cyber attacks on their agenda.

“In 2017, the idea that boards of businesses exempt from the mandatory data breach disclosure laws still don’t need to have cybersecurity, cyberattack and data breach risks and plans on their agenda is very worrying,” he says.

He believes that criminals are using more sophisticated tools and going after confidential data, which could be disastrous for companies caught in the mess. 

“Businesses should prepare for attacks by understanding the risks and implementing comprehensive measures, including: discussing with the board and employees what risks the business might face, planning an emergency procedure in case of an attack or data breach, and making sure IT teams inform top executives and board members of threats and updates to the law,” he says.

ASIC has put a fresh focus on cyber preparedness, laying bare the fact that boards aren’t taking enough notice of cyber risk.

“I agree wholeheartedly with the ASIC Commissioner’s comments last year that there is one clearly incorrect response to board-level questions about cyber-risk, and that is to the effect of, ‘I’m not sure – ask the IT guy’. Sadly, that response is still all too common, as is reinforced by the latest MinterEllison Perspectives on Cyber Risk report.”

He believes the Privacy Amendment Bill is good for personal data, but it doesn’t really cover businesses. 

“Unfortunately, a very large group of organisations which Australians would hope and reasonably expect to have the highest standards of data privacy, are not covered,” he says.

“Specifically, state and territory Government agencies, public universities (except ANU) and public schools are not covered by the Privacy Act and hence will not be required to disclose data breaches when the new mandatory reporting requirements come into force, sometime in the next year,” he continues. 

This means those with less than $3 million in turnover aren’t covered either - but there are exceptions “Including organisations that handle health, tax and credit report data, or those whose main business involves the handling of personal data,” FitzGerald concludes.

Story image
Ripple20 threat has potential for 'vast exploitation', ExtraHop researchers find
One in three IT environments are vulnerable to a cyber threat known as Ripple20. This is according to a new report from ExtraHop, a cloud-native network detection and response solutions provider. More
Story image
Video: 10 Minute IT Jams - Who is Vectra AI?
Today, Techday spoke with Vectra AI head of security engineering Chris Fisher, who discusses the company's key products and offerings, updates on its operations in the A/NZ region, and the latest improvements on its products.More
Story image
Why it’s essential to re-write IT security for the cloud era
Key components of network security architecture for the cloud era should be built from the ground up, as opposed to being bolted on to legacy solutions built for organisations functioning only on-premises or from only managed devices.More
Story image
Gartner: Security leaders must balance risk, trust and opportunity
Security and risk leaders must focus on balancing risk, trust and opportunity to help maintain the ability of their organisations to function.More
Link image
Webcast series: The necessary tools to secure a remote workforce
Experts from across the A/NZ region discuss the best security practices in a remote working world - with sessions available on the first Thursday of every month.More
Link image
How a metrics-driven mindset can enable DevOps at enterprise scale
Here's how to enable dev teams to deploy higher-quality software and create reporting standards that clearly communicate software performance.More