Breaches are presenting challenges but fightback signs are promising

Chief information security officers and other cybersecurity professionals are the often forgotten individuals directly affected.

Cybercrime has become a mainstream business and consumer issue in Australia in recent years.

This year alone, breaches have occurred at banks, utility companies and telecommunications companies, prompting negative headlines and a backlash from concerned customers.

Chief information security officers and other cybersecurity professionals are the often forgotten individuals affected by these breaches. They are tasked with fixing the security problems and restoring order, usually in a pressure-cooker environment.

A recent report from the Information Systems Security Association and Enterprise Strategy Group shows CISOs and their teams are feeling stress in areas including keeping up with new digital initiatives, and handling new data privacy responsibilities and the Notifiable Data Breaches scheme.

Cybercriminals are increasingly sophisticated in their approach to compromising Australian organisations. Breaking in is challenging, depending on the security systems and operational technology in place, but once they’re in, it is relatively simple to inflict colossal damage.

The clean-up is not so simple — as sophistication increases, so does the time and effort needed to identify and rectify the damage done. As organisations’ digital footprint grows with new services and technologies such as the internet of things and artificial intelligence, this will become more challenging.

The industry is also experiencing a skills shortage. The Australian Computer Society’s 2019 Digital Pulse report highlights the need for increased digital training and an additional 100,000 technology workers by 2024. Training and preparation are essential to help cybersecurity professionals manage their work. Organisations need to run drills with various scenarios playing out in different ways to prioritise actions, build the right road map for breach response, and fully prepare for a real-life incident.

Teamwork is key. Organisations that take an all-hands-on-deck approach tend to emerge better from incidents, and the cybersecurity team will respond better knowing they are backed by the teams around them.

Education is also critical. There is great emphasis on science, technology, engineering and maths education, and tech skills generally, but cybersecurity requires specific attention. Schools and universities have the responsibility of incorporating cybersecurity into the curriculum and addressing the need for more cybersecurity-specific courses. In tandem, organisations need to partner with tertiary institutions as well as invest in the right industry training courses to ensure their team receives continuous professional development on the latest threats.

Despite the challenges there are positive signs that the new cybersecurity landscape is being addressed. Home Affairs Minister Peter Dutton launched a new cybersecurity strategy this month with investment in the right skills identified as a key pillar in its discussion paper. We’re starting to see more organisations partner with universities to improve cybersecurity training and research, such as National Australia Bank and La Trobe University’s strategic alliance and Cisco and Victoria University’s partnership on security skills training.

Cybersecurity is perhaps the greatest enabler for innovation and progress in the digital economy — without it, everything else fails. To ensure we hold our ground in the war on cybercrime, advance our digital economy and create a manageable working environment for our valued industry professionals, we must continue to build the right initiatives, make smart investments in IT and operational technology, and create a sustainable cybersecurity ecosystem in Australia.

Malcolm Bailie is senior solutions delivery and project engineer APAC for Nozomi Networks.