Now's the time for Aussie firms to review their security, say vendors

There have been more calls from security vendors that Australians simply aren't prepared for the Notifiable Data Breaches scheme, even just with less than two weeks to go before the scheme takes effect.

Security firm Centrify says that Australian businesses may become targeted like 'sitting ducks' if they use perimeter controls to protect confidential data and a spokesperson from Splunk say it's a timely reminder that organisations should review their security infrastructure.

Under the scheme, Australian organisations who fail to report data breaches or lost data could face up to fines from $360,000 for individuals and $1.8 million for businesses.

According to Centrify's senior director for APAC sales Niall King, many businesses are 'security sitting ducks'.

"Today, businesses use a combination of cloud, on-premises and mobile services, which means traditional perimeter-based security is no longer effective," he explains.

He believes that businesses should adopt a zero trust security model. The model suggests that users inside a network are no more trustworthy than those outside it.

Splunk's Area VP for ANZ Simon Eid says that it's also a good time for organisations to re-evaluate their security infrastructure.

"Now is the time for the c-suite to consider whether they need to shift their approach to security within the business as a whole, in order to comply. By taking steps now to ensure data is secured and managed appropriately, organisations can decrease the likelihood of a data breach," Eid explains.

Niall King cites Centrify-sponsored Ponemon research that found data breaches damage corporate and customer trust.

""Ponemon found the stock value index of 113 randomly selected global companies declined by an average of five per cent on the day a data breach was disclosed and experienced a customer churn rate of as much as seven per cent. Also, one third of Australian consumers impacted by a data breach reported they had discontinued their relationship with the organisation that experienced the breach," he explains.

"This is a vital lesson for organisations to learn as Australia law mandates data breach disclosures.

King believes that organisations need to focus on protected identities rather than the network perimeter.

Eid takes a different approach and says that organisations need to have a data breach response plan.

"Australian organisations need to take the government's sharpened focus on cyber security as a warning that there's no guarantee their network will never be attacked. Having access to and analysing all data is integral to detecting where a data breach may have occurred. The next step is implementing a clear data breach response plan so the right people can take steps to mitigate the situation, which includes notifying individuals whose data has been exposed," Eid concludes.