Business and individuals need help from government to reduce cyber risk

Cyber attacks have been the leading story in Australia for the past few weeks with the breaches at Medibank Private and Optus being two of the most high profile cases.

It is reported in Business News America that three-quarters of businesses in the UK and the US have been hit by a serious cyber attack at least once since 2019, according to the S-RM Cyber Security Insights Report 2022.

With both the UK and the US seeing a significant increase in attacks across all incident types in 2022, it would appear that it is not only Australia that is being targeted by cyber criminals.

The report states that “data exfiltration went up from 37% to 46%, ransomware from 30% to 40%, hacktivism from 32% to 39%, denial of service from 28% to 39%, fraud from 29% to 38% and cryptojacking from 27% to 33%“.

Sticking with the report, I agree with the section that states, “The true cost of a security breach lies in the indirect losses, which have become more costly than the cyber attack itself. Reputation damage and paid ransom averaged £1.5 million in 2022. Nearly half of these businesses also went into operational downtime, increased insurance premiums, experienced reputational damage, and paid legal costs following the cyber attack”.

Here in Australia, the Australian Competition and Consumer Commission’s (ACCC) fifth Digital Platform Services Inquiry Interim Report was released last Friday (11th November 2022). It outlines the ACCC’s recommendations to Treasury for reforms to competition and consumer law that it considers will address ‘significant consumer and competition harms’ it has identified in its inquiries over the past five years. These include scams, harmful apps and fake reviews, inadequate dispute resolution, increased market concentration and instances of anti-competitive conduct.

The ACCC has found that the current competition and consumer laws are not sufficient to address these harms, so has recommended a number of reforms.

Penalising businesses is one thing, but in many cases this is like having your home burglarised and then being fined for the burglary rather than punishing the burglar.

While it is clearly incumbent on all of us to have robust safeguards, processes and regular training of staff in place, at the same time, if major government institutions in developed countries have had cyber breaches after investing in many millions of dollars in cyber security there is only so much that Australian small and medium businesses can do.

For some time I have questioned why the Australian government has not put an end to robocalls and texts. I would strongly suspect that there has to be a telecommunications company that is making significant revenue by allowing voice and text over IP services to those who are making the robocalls and transmitting the text messages often with false mobile or land line numbers.

I am advised that robocalls have been shut down in the European Union. Please let me know in the comments section if you believe otherwise.

In the United States the government, through the FCC, has decided not to target the overseas robocall companies themselves – rather, they are going after the trunking providers who are allowing robocalls to terminate into the US public switched telephone network.

The popular YouTube channel Cross Talk Solutions recently posted a video explaining what the US is doing to combat the problem. You can watch it here.

I strongly urge the Australian Government to take a similar approach but include significant fines and jail time to the Australian Directors and Senior Management of any Australian company that is aiding and abetting the criminal behaviour.

There are a number of firms that can provide advice and testing on cyber security, including LMI, and of course I continue to strongly recommend sound risk management and cyber insurance coverage.