ASIC chair Joe Longo warns of cyber failures

Companies are under siege from cyberattacks, but many are failing to defend against a key threat, writes Australian Securities and Investments Commission chair Joe Longo. 

For nearly a millennium, the ancient city of Constantinople stood impenetrable. Its great Theodosian walls — towering rings of limestone and mortar — withstood siege after siege. It was only when Ottoman invaders overwhelmed the defences with sheer numbers that the mighty citadel fell.

In today’s world, this relentless onslaught is not coming over the walls, but from online and digitally connected networks. According to the Australian Signals Directorate’s Australian Cyber Security Centre, a new cyberattack is reported in Australia every seven minutes — and the pace of this incursion is intensifying. Globally, ransomware attacks are anticipated to occur every two seconds by 2031, an increase on every 11 seconds in 2021.

The recent incidents with Optus, Medibank and DP World should make it clear that cyber threats must be a priority at the highest levels.

Yet the recent Cyber Pulse Survey by the Australian Securities and Investments Commission (ASIC) found that organisations are more reactive than proactive when it comes to managing their cybersecurity. 

Of greatest concern, 44 per cent of participants revealed they are not managing third-party or supply chain risks. A further 58 per cent of respondents indicated that they do not test cybersecurity incident responses with critical suppliers. Supply chain risks were not even on the radar of many organisations. Survey respondents nominated their top cybersecurity threats as phishing (26 per cent), ransomware (17 per cent), and business email compromise (13 per cent).

However, supply chains pose a considerable financial, reputational and governance risk to your operations. Supply chain companies and vendors can become an entry point for attackers, enabling key systems to be infected, infiltrated and exploited. Consider how many vendors your company relies on. Most engage multiple third parties for an array of business-critical functions — from software

and infrastructure to call centres and payroll. Our survey shows organisations have well- developed capabilities when it comes to identity and access management, governance and risk management, and information asset management. While we can take heart from these results, it is futile to fortify and defend if supply chain companies and vendors have unrestricted access to business-critical systems.