Australian Government Worries Businesses Don’t Focus Enough on Securing Commercial Secrets

Not taking security strategy and execution seriously enough to come up with a proper incident response program is a problem that is regularly noticed. Businesses large and small fear customer information, financial data or corporate secrets will fall to the wrong hands in an advanced malware attack. But they keep investing in the wrong projects, work with outdated software, don’t train employees about passwords and phishing to prevent human error and internal attacks, and don’t look into third-party vulnerability protection.

After a quarterly report by the Office of the Australian Information Commissioner (OAIC) revealed the countless prevention and mitigation issues companies struggle with, as well as a major surge in malicious activity, the Australian Cyber Security Centre (ACSC) is now pushing MSPs to focus on safeguarding their commercial secrets. According to the Australian Government’s Notifiable Data Breaches (NDB) scheme and Privacy Act, organizations must release information about data breaches “likely to result in serious harm.”

“This OAIC report is a further reminder that Australia’s commercial secrets are an attractive target for cyber criminals, and compromised credentials can be an easy way in,” said Alastair MacGibbon, Head of the ACSC. “Many cyber incidents in this quarter appear to have exploited vulnerabilities involving a human factor, such as clicking on a phishing email and disclosing passwords.”

The data breach report analyzed 262 notifications received between October 1 and December 31 2018, concluding 64% stemmed from malicious or criminal attacks, 33% from human error and 3% from system faults. Some 85% of the system intrusions focused on stealing contact information, while 47% sought financial details, 36% were after identity information and 27% focused on health information.

Human errors, such as downloading malicious software, mistakenly sending personal information to the wrong recipient or clicking on phishing links, remains the second-most prevalent cause of cyberattacks in organizations. They account for 54% of attacks in the healthcare sector and 27% in finance. The most common techniques deployed to infiltrate organizations are phishing, malware or ransomware, brute-force attacks, compromised or stolen credentials, and social engineering or impersonation. The five most-targeted sectors are health services, finance, legal, accounting and management services, education, and mining and manufacturing, cases in which hackers are mostly after stealing paperwork or a data storage device.

“There is no room for complacency, as we saw in December when the Australian Government confirmed the global hack of Manager Service Providers (MSPs), including Australian organizations. In response, we are rolling out a new information sharing program at our Joint Cyber Security Centres (JCSCs) around the country to help strengthen defenses,” MacGibbon said.