Ransom ban likely to solve Australia’s cyber crisis, says WiseTech founder Richard White

WiseTech founder Richard White has told a Sydney conference he’ll never pay a cyber ransom demand and that a national ban on doing so would protect all private companies.

Wilsons Advisory head of tech Ross Barrows with WiseTech founder Richard White at the FutureTech conference on Wednesday. Picture: John Fotiadis

Ransom payments should be banned here, therefore making Australian companies less likely to be targeted by hackers.

That’s the view of billionaire WiseTech founder Richard White, who has told a technology conference he believed that a ban would make it pointless to go after private companies – and that the only problems left would be state actors going after critical infrastructure.

Giving the keynote speech on entrepreneurialism at Wilsons Advisory’s FutureTech Conference in Sydney on Wednesday, Mr White said he had been “pushing as loudly as I possibly can for the government, through the Tech Council of Australia and other places, to actually ban payment ransoms”.

“It wouldn’t solve the world’s cyber security problem but it would certainly solve Australia’s. These threat actors will go somewhere else because there’s no money to be made here,” he said.

“The only people that will stay are state actors and they would be targeting government infrastructure rather than private companies.”

There were other methods of protecting private companies which included increasing security measures. “You make yourself incredibly costly to do that to, and you can make it clear that you won’t be paying a ransom. And if you do those two things, you’re probably very, very safe,” he said.

WiseTech was in the first basket of companies that were too expensive to breach, he said, but he acknowledged the company also didn’t have the kind of data that was most appealing to hackers. “Luckily WiseTech doesn’t have the sort of information that an Optus or Medicare has,” he said.

If WiseTech were to be hacked, the company would be back up and online in about four hours. But breaching it was almost impossible thanks to a strategy the company had adapted from militaries known as defence in depth. That strategy involved having multiple layers to protect a single asset so that if one defence fails, it is still protected.

“(With our system) there’s not one place that you have to breach, you have to breach about four of them to get to the centre,” Mr White said.

Even if hackers had penetrated WiseTech’s systems, the company would not pay a ransom as it would be able to get up and running based off of its backups, which are made every 15 minutes.

“Assuming that a cyber attack was successful, and that’s a pretty big assumption, we have off-site immutable backups that can’t be corrupted,” he said. “Those are not held on our domain, they’re held in a separate repository that is disconnected from us and those backups can be retrieved quickly.”

WiseTech’s cyber defence system was not cheap but it was a worthy investment, particularly as logistics companies were increasingly being targeted by hackers.

The company had observed a new trend where hackers were targeting companies through the third party vendors they use.

“It’s happening in logistics a lot. There are a lot of very small systems that the older more legacy companies have bolted on all around them,” he said.

Mr White said once hackers had penetrated the vendor they would install their software and wait for an opportunity.