Story image

ESET says Australia's mandatory breach disclosure doesn't go far enough

20 Mar 2017

MinterEllison found that 13% of Australian business boards have absolutely no briefing at all on understanding the risks and how to prevent cyber attacks; a telling statistic that complements findings that cyber incidents doubled to more than 40% in the last year.

Australia’s mandatory data breach disclosure scheme is now becoming law. Those laws don’t cover all organisations which means potential threats are left unmonitored, even in large businesses and other government institutions.

ESET senior research fellow Nick FitzGerald shares his insights into the Australian security market.

He believes that boards must put data breach risks and cyber attacks on their agenda.

“In 2017, the idea that boards of businesses exempt from the mandatory data breach disclosure laws still don’t need to have cybersecurity, cyberattack and data breach risks and plans on their agenda is very worrying,” he says.

He believes that criminals are using more sophisticated tools and going after confidential data, which could be disastrous for companies caught in the mess. 

“Businesses should prepare for attacks by understanding the risks and implementing comprehensive measures, including: discussing with the board and employees what risks the business might face, planning an emergency procedure in case of an attack or data breach, and making sure IT teams inform top executives and board members of threats and updates to the law,” he says.

ASIC has put a fresh focus on cyber preparedness, laying bare the fact that boards aren’t taking enough notice of cyber risk.

“I agree wholeheartedly with the ASIC Commissioner’s comments last year that there is one clearly incorrect response to board-level questions about cyber-risk, and that is to the effect of, ‘I’m not sure – ask the IT guy’. Sadly, that response is still all too common, as is reinforced by the latest MinterEllison Perspectives on Cyber Risk report.”

He believes the Privacy Amendment Bill is good for personal data, but it doesn’t really cover businesses. 

“Unfortunately, a very large group of organisations which Australians would hope and reasonably expect to have the highest standards of data privacy, are not covered,” he says.

“Specifically, state and territory Government agencies, public universities (except ANU) and public schools are not covered by the Privacy Act and hence will not be required to disclose data breaches when the new mandatory reporting requirements come into force, sometime in the next year,” he continues. 

This means those with less than $3 million in turnover aren’t covered either - but there are exceptions “Including organisations that handle health, tax and credit report data, or those whose main business involves the handling of personal data,” FitzGerald concludes.

Why 'right to repair' legislation could be a new lease on life for broken devices
“These companies are profiting at the expense of our environment and our pocketbooks as we become a throw-away society that discards over 6 million tonnes of electronics every year.”
Attacks targeting Cisco Webex extension explode in popularity - WatchGuard
WatchGuard's Internet Security Report for Q4 2018 also finds growing use of a new sextortion phishing malware customised to individual victims.
SAS partners with NVIDIA on deep learning and computer vision
“By partnering with NVIDIA, we combine our strengths to augment human intelligence and realise the true potential of AI.” 
Why businesses must embrace automation to ensure success
“For many younger workers, the traditional view of a steady job at one company, perhaps for life, simply doesn’t reflect reality."
Dropbox invests in hosting data inside Australia
Global collaboration platform Dropbox has announced it will now host Australian customer files onshore to support its growing base in the country.
TYAN unveils new inference-optimised GPU platforms with NVIDIA T4 accelerators
“TYAN servers with NVIDIA T4 GPUs are designed to excel at all accelerated workloads, including machine learning, deep learning, and virtual desktops.”
Worldwide spending on security to reach $103.1bil in 2019 - IDC
Managed security services will be the largest technology category in 2019.
How Cognata and NVIDIA enable autonomous vehicle simulation
“Cognata and NVIDIA are creating a robust solution that will efficiently and safely accelerate autonomous vehicles’ market entry."