NAB boss Ross McEwan calls for unity with government against cyber attacks

National Australia Bank CEO Ross McEwan is urging business to work more closely with government and infrastructure providers on cyber threats.

NAB Chief Executive Officer Ross McEwan: ‘We need to be incredibly vigilant but more importantly working together.’

National Australia Bank chief executive Ross McEwan is urging business to work more closely with government and infrastructure providers on cyber threats, to help prevent and respond to a spike in severe and “more ferocious” cyber attacks.

Mr McEwan said NAB was keeping its guard up in dealing with, and fending off, tens of millions of cyber attacks every month, some that were “very ­severe” seeking to hack data or bring systems down.

“We need to be incredibly vigilant but more importantly working together,” he told a webinar on Friday that delved into increased threats of attacks stemming from a shift to digital and working from home during COVID-19.

“It’s not just banks and governments, it’s also critical industries,” Mr McEwan added.

“We need to respond, resilience is vital … to protect our customers’ data and protect the infrastructure of this bank and it’s only going to get more ferocious as I’ve seen it.”

Earlier this month, Mr ­McEwan told a parliamentary committee NAB blocked 261 million cyber threats in the June quarter, up from 197 million in the previous three months.

The federal government has also been on the front foot on the threat of cyber attacks. Last month, it boosted the nation’s defences by outlining a $1.67bn cybersecurity strategy, following a mass assault on infrastructure operators and government agencies from state-­sponsored actors linked to China.

In 2019-20, 35.4 per cent of incidents reported to the Australian Cyber Security Centre were linked to attacks on governments and agencies, with 35 per cent targeting critical infrastructure ­operators across the banking, health, education, water, transport and energy sectors.

NAB is involved in a new industry grouping alongside the other major banks, and companies including Woodside and Telstra, working with the Australian Cyber Security Centre to step up investment to intercept criminal and malicious software.

Telstra chief executive Andy Penn said that, as the use of the digital economy ramped up and more people worked from home during the pandemic, there was an increase in the “attack surface area” targeted by cyber criminals and malicious actors.

Telstra chief executive Andy Penn. Picture: Aaron Francis

He said the priority was to protect customer data.

Microsoft CEO Satya Nadella agreed that there was a greater threat of cyber attacks due to ­people working from home.

“I think it’s one of the most important considerations … how do you operate in what is in the industry called a ‘zero trust environment’?” he said.

Mr Nadella said COVID-19 increased the focus on identify and device management and operational security.

“It’s not just the locks you have in front of your house, it’s the operational security,” he said.

Australian Energy Market Operator CEO Audrey Zibelman was asked about whether a tense relationship with China was leading to an increase in cyber attacks, but suggested the rise in threats was a broader issue.

“Sadly, whether it’s China or any other type of event that we are worried about … there is an increase in attack on the power system around the world, including in Australia,” she said. “The only way to manage that is to make sure we are in the best position possible to both detect the issue when we see it and then respond quickly, because we know we are going to get attacked, but we are going to do everything we can to prevent the attacks from penetrating our systems.”

Mr McEwan said the pandemic had accelerated by five years a move away from using cash and cited the bank’s data that showed an 800 per cent surge in e-commerce activity during the pandemic.

Mr Penn said that, against the backdrop of COVID-19, successful companies would offer the “greatest flexibility” for staff around remote working and the use of technology.