Story image

ESET says Australia's mandatory breach disclosure doesn't go far enough

20 Mar 2017

MinterEllison found that 13% of Australian business boards have absolutely no briefing at all on understanding the risks and how to prevent cyber attacks; a telling statistic that complements findings that cyber incidents doubled to more than 40% in the last year.

Australia’s mandatory data breach disclosure scheme is now becoming law. Those laws don’t cover all organisations which means potential threats are left unmonitored, even in large businesses and other government institutions.

ESET senior research fellow Nick FitzGerald shares his insights into the Australian security market.

He believes that boards must put data breach risks and cyber attacks on their agenda.

“In 2017, the idea that boards of businesses exempt from the mandatory data breach disclosure laws still don’t need to have cybersecurity, cyberattack and data breach risks and plans on their agenda is very worrying,” he says.

He believes that criminals are using more sophisticated tools and going after confidential data, which could be disastrous for companies caught in the mess. 

“Businesses should prepare for attacks by understanding the risks and implementing comprehensive measures, including: discussing with the board and employees what risks the business might face, planning an emergency procedure in case of an attack or data breach, and making sure IT teams inform top executives and board members of threats and updates to the law,” he says.

ASIC has put a fresh focus on cyber preparedness, laying bare the fact that boards aren’t taking enough notice of cyber risk.

“I agree wholeheartedly with the ASIC Commissioner’s comments last year that there is one clearly incorrect response to board-level questions about cyber-risk, and that is to the effect of, ‘I’m not sure – ask the IT guy’. Sadly, that response is still all too common, as is reinforced by the latest MinterEllison Perspectives on Cyber Risk report.”

He believes the Privacy Amendment Bill is good for personal data, but it doesn’t really cover businesses. 

“Unfortunately, a very large group of organisations which Australians would hope and reasonably expect to have the highest standards of data privacy, are not covered,” he says.

“Specifically, state and territory Government agencies, public universities (except ANU) and public schools are not covered by the Privacy Act and hence will not be required to disclose data breaches when the new mandatory reporting requirements come into force, sometime in the next year,” he continues. 

This means those with less than $3 million in turnover aren’t covered either - but there are exceptions “Including organisations that handle health, tax and credit report data, or those whose main business involves the handling of personal data,” FitzGerald concludes.

Cryptomining apps discovered on Microsoft’s app store
It is believed that the eight apps were likely developed by the same person or group.
WhatsApp users warned to change voicemail PINs
Attackers are allegedly gaining access to users’ WhatsApp accounts by using the default voicemail PIN to access voice authentication codes.
Swiss Post asks public to hack its e-voting system
Switzerland’s postal service Swiss Post is inviting keen-eyed security experts and white hats to hack its e-voting system.
Spoofs, forgeries, and impersonations plague inboxes
It pays to double check any email that lands in your inbox, because phishing attacks are so advanced that they can now literally originate from a genuine sender’s account – but those emails are far from genuine.
Flashpoint signs on emt Distribution as APAC partner
"Key use cases that we see greatly benefiting the region are bolstering cybersecurity, combating insider threats, confronting fraud, and addressing supply chain risk, to name a few."
The attack surface: 2019's biggest security threat
As businesses expand, so does their attack surface – and that may be the biggest cybersecurity risk of them all, according to Aon’s 2019 Cyber Security Risk Report.
Opinion: Cybersecurity as a service answer to urgent change
Alan Calder believes a CSaaS model can enable a company to build a cyber resilience strategy in a coherent and consistent manner.
Why SD-WAN is key for expanding businesses - SonicWall
One cost every organisation cannot compromise on is reliable and quick internet connection.