How boards can become cyber-vigilant

Being aware and being prepared are essential tools for directors in protecting their organisations against increasingly prevalent cyber threats.

Abigail Bradshaw CSC, head of the Australian Cyber Security Centre (ACSC), which is part of the Australian Signals Directorate — the nation’s largest intelligence agency — says reported cybercrime incidents occurred every six minutes in the past year, compared with every eight minutes three years ago.

“That equates to about 94,000 reports of cybercrime being reported through our cybercrime reporting tool on cyber.gov.au,” Bradshaw told a recent AICD webinar. “We actually think, while that headline figure sounds crazy, it’s probably just the tip of the iceberg. It is not the full scale of attacks that are actually impacting Australians.”

She says the average cost of cybercrime increased by 14 per cent in the past 12 months and the cost to a business whose email has been compromised was on average $39,000. Three years ago, there were 19,000 reports of vulnerabilities in software. In the past 12 months, that number rose to 29,000.

The ACSC works with organisations to make them aware of vulnerabilities and endeavours to apply pressure on companies to ensure patches, or fixes, are available. “The number of times we see companies being compromised because systems aren’t patched is astronomical,” says Bradshaw.

The ACSC is not a regulator. Its partnership program has more than 110,000 members, building an ecosystem of cyber threat intelligence on the platform. 

“It enables industry and government to share what we would call indicators of compromise, which can really empower businesses to defend their own networks,” says Bradshaw. “We prefer to prevent rather than respond.”

Planning is key

“We’re big supporters of having an incident-response plan that is regularly updated,” says Bradshaw. “If your systems are down, do you have access to all the contact information of people you might need to contact? If you have outsourced your ICT [information and communication technology] support, what are their response hours and their response timeframe? If you can’t pay people or invoices, that can lead to operational shutdown and can very rapidly bring the whole company to a great halt.”

Bradshaw advises that the incident response plan should be practised at least once a year. Then, when something happens, the organisation is prepared and decisions have been thought through at a time of calm, rather than a time of stress.