Boards warned of growing cyber risks

Boards need to be able to show visible accountability to investors on cybersecurity risk issues.

Bob Mansfield. Picture: Dan Himbrechts

Boards need to be able to show visible accountability to investors on cybersecurity risk issues and government regulation alone will not be the answer to improving the nation’s cyber resilience, ­according to Vocus chairman and former Telstra chairman Bob Mansfield.

In a forum with the Trans-Tasman Business Circle on Wednesday that also featured Foreign Investment Review Board chairman David Irvine, Mr Mansfield said cybersecurity issues were ­becoming more prominent in boardroom discussions in the same way occupational health and safety issues had been elevated over the past 20 years.

“Boards need to have visible accountability. Boards need to know who is responsible for ­cybersecurity in their company, how often reports are relayed through to the audit and risk committee and how often is that relayed to the board and then discussed,’’ Mr Mansfield told the forum.

“It is more prominent than it was two years ago and in two years’ time I think it will be more prominent still.”

Mr Mansfield was a member of the federal government’s ­cybersecurity advisory panel, chaired by Telstra chairman Andy Penn, which was established last year to provide strategic advice on Australia’s 2020 cybersecurity strategy.

The advisory panel’s report ­released in July called on the government to empower industry to automatically block a greater proportion of known cybersecurity threats in real-time.

“We are all involved in this so let’s interact with each other, as opposed to having regulation from government,” Mr Mansfield said. “It is easy to put the rules in and apply regulation, but the more all of us can participate, making it as easy as possible, the better. And that ends up on every board table in the country.’’

A report by the Australian Securities & Investments Commission last year found that while awareness and management of cybersecurity risk were improving in Australia’s financial market, there was still room for improvement.

Last month ASIC announced it was taking financial advice company RI Advice Group to the Federal Court for failing to maintain a “reasonable standard” of cybersecurity.

ASIC alleged that RI Advice, which was previously owned by ANZ, did not do enough to ensure its representatives secured the sensitive personal and financial information of their clients, citing multiple incidents in which poor cyber risk management resulted in data breaches and fraud ­attempts.

Mr Irvine, who is also chairman of Cyber Security Co-operative Research Centre, said he had been talking to boards for 10 years on the cyber risk issue.

“Boards do now I think understand that cyber credibility and cyber reliability is absolutely key to most of their business models … But the problem is the lower you get out of the top 20 and the top 100 companies, it becomes more patchy,’’ Mr Irvine said.

“It is no accident that at this very moment ASIC is taking proceedings against an Australian company for having had an inappropriate or unnecessary number of breaches. So boards are beginning to understand credibility and trust in their company is absolutely dependant on that cyber performance.”

Last week, the Australian Cyber Security Centre, with the Australian Federal Police and Australian Criminal Intelligence Commission, released their annual cyber threat report showing they responded to 2266 cyber­security incidents and received 59,806 cyber crime reports, which translates to 164 cyber crime reports a day; one every 10 minutes.

“I see the cyber world representing a really significant opportunity for employment, skills development in the Australian workforce,” Mr Irvine said. “It is government and business working together to develop and employ what I would like to see as a new national industry, along with wool and iron ore. I would like to see many more Australian cybersecurity providers, perhaps linked up with international players.”