Australian boards urged to boost cybersecurity skills

A University of Queensland study has identified a need to prioritise cybersecurity training for board directors, to better protect Australian organisations from cyber-attacks.

Dr Ivano Bongiovanni from the UQ Business School says his research found board directors were not always sure about their duties and liability for cybersecurity, and often did not fully understand its importance.

"As the data breach at Optus this month demonstrates, no organisation is immune to cyber-crime," says Bongiovanni.

"We interviewed non-executive directors of 43 organisations about cybersecurity; a lot of uncertainty emerged in terms of current best practices or industry guidelines for cybersecurity strategies," he says.

"There is a misleading perception of cybersecurity being a purely technical topic and directors weren't engaged or confident talking about it," Bongiovanni says.

"Considering the responsibility to oversee cyber risk management in modern organisations lies with their board of directors, an uplift of cyber-skills at the board level is necessary."

Cybersecurity failure is considered one of the top threats facing Australian businesses, and with customer information accessed in an attack on Optus, the Australian Cyber Security Centre is warning companies to remain alert.

Study co-author and University of Queensland honours graduate Megan Gale says the potential impact of data breaches on Australian organisations was massive.

"A disruption to IT infrastructure could force a company to shut down, leading to financial loss or even more severe consequences," Gale says.

"In the Optus breach, sensitive, personal customer information along with identity documents have been accessed, putting people at risk of being victims of fraud," she expains.

The researchers have called for clearer regulations and reporting practices and for cybersecurity training to be made a priority for all board directors.

"It's not just boards of large companies that need to be better equipped in this area," says Gale.

"Boards of small to medium-sized organisations across all sectors in Australia, including not-for-profits and community-run organisations, need to be vigilant," she says.

Director of Cybersecurity at University of Queensland and the Australian cyber emergency response team AusCERT, Dr David Stockdale, says the study showed Australia has some work to do for boards to include cybersecurity in their enterprise risk management activities.

"As we've seen with Optus, cyber threats are a matter of 'not if, but when', and organisations must be prepared," he says.

"More cyber risk training and regular communication between executives and their security teams will ensure the best course of action and prevention."