Story image

ESET says Australia's mandatory breach disclosure doesn't go far enough

20 Mar 2017

MinterEllison found that 13% of Australian business boards have absolutely no briefing at all on understanding the risks and how to prevent cyber attacks; a telling statistic that complements findings that cyber incidents doubled to more than 40% in the last year.

Australia’s mandatory data breach disclosure scheme is now becoming law. Those laws don’t cover all organisations which means potential threats are left unmonitored, even in large businesses and other government institutions.

ESET senior research fellow Nick FitzGerald shares his insights into the Australian security market.

He believes that boards must put data breach risks and cyber attacks on their agenda.

“In 2017, the idea that boards of businesses exempt from the mandatory data breach disclosure laws still don’t need to have cybersecurity, cyberattack and data breach risks and plans on their agenda is very worrying,” he says.

He believes that criminals are using more sophisticated tools and going after confidential data, which could be disastrous for companies caught in the mess. 

“Businesses should prepare for attacks by understanding the risks and implementing comprehensive measures, including: discussing with the board and employees what risks the business might face, planning an emergency procedure in case of an attack or data breach, and making sure IT teams inform top executives and board members of threats and updates to the law,” he says.

ASIC has put a fresh focus on cyber preparedness, laying bare the fact that boards aren’t taking enough notice of cyber risk.

“I agree wholeheartedly with the ASIC Commissioner’s comments last year that there is one clearly incorrect response to board-level questions about cyber-risk, and that is to the effect of, ‘I’m not sure – ask the IT guy’. Sadly, that response is still all too common, as is reinforced by the latest MinterEllison Perspectives on Cyber Risk report.”

He believes the Privacy Amendment Bill is good for personal data, but it doesn’t really cover businesses. 

“Unfortunately, a very large group of organisations which Australians would hope and reasonably expect to have the highest standards of data privacy, are not covered,” he says.

“Specifically, state and territory Government agencies, public universities (except ANU) and public schools are not covered by the Privacy Act and hence will not be required to disclose data breaches when the new mandatory reporting requirements come into force, sometime in the next year,” he continues. 

This means those with less than $3 million in turnover aren’t covered either - but there are exceptions “Including organisations that handle health, tax and credit report data, or those whose main business involves the handling of personal data,” FitzGerald concludes.

WatchGuard announces A/NZ partners awards
Four Australian companies were named partner award winners at the WatchGuard conference in Vietnam.
Telstra’s 2019 cybersecurity report
Cybersecurity remains a top business priority as the estimated number of undetected security breaches grows.
Why AI and behaviour analytics should be essential to enterprises
Cyber threats continue to increase in number and severity, prompting cybersecurity experts to seek new ways to stop malicious actors.
Scammers targeting more countries in sextortion scam - ESET
The attacker in the email claims they have hacked the intended victim's device, and have recorded the person while watching pornographic content.
Cryptojacking and failure to patch still major threats - Ixia
Compromised enterprise networks from unpatched vulnerabilities and bad security hygiene continued to be fertile ground for hackers in 2018.
Why cybersecurity remains a top business priority
One in two Australian businesses estimated that they will receive fines for being in breach of new legislation.
Princeton study wants to know if you have a smart home - or a spy home
The IoT research team at Princeton University wants to know how your IoT devices send and receive data not only to each other, but also to any other third parties that may be involved.
AI helping businesses stay ahead of threats - LogRhythm
AI is being used to anticipate new threats and mediate and minimise the damage caused by breaches.