A STRATEGIC VIEW OF THE RAPIDLY CHANGING BATTLEFIELD

Written by Mick Lehmann and Ross Wehby

There is a military adage that also rings true for cyber security. A leader is always asking themselves: “What now? What next? What if?”

As the impacts of the Optus breach ripple out through the community, we’re reminded of that wisdom … and of the warning from the Government’s last Cyber Threat Report that Australia faces

“an unprecedented threat to (our) economic, political and security interests”.

Regardless of the nature of the Optus breach, there’s a lingering question: if this can happen to one of our largest telecommunication companies then who else is vulnerable? As the interrelationships between hardware, software, IT, OT, data, ML and people become more complex, the answer is likely to be shades of ‘everyone’.

For those whose information has been stolen, there’s uncertainty and fear over what might be done with their stolen data, and, for any company which touches personally Identifiable Information, there are lessons to be learned from those three simple questions.

What are those lessons? What Now?
First, the cyber threat facing Australia is aggressive, pervasive, and industrial in scale. To complicate things, cyber threats are holistic threats, with people central to both the threat AND the solution. Today’s cyber threats need an all-hazards approach to address them.

Second, the attack methods and tools being used range from ‘basic and noisy’ to ‘sophisticated and clandestine’. For example, unpatched vulnerabilities or configuration issues like unauthenticated API endpoints are a veritable gold mine to would-be attackers, and their identification and treatment need to be an integral part of an organisation’s cyber hygiene.

While the solution will vary from organisation to organisation, it’s hard to see how holistic protection does not include zero trust architecture, advanced identity and access management capability, and a truly modern SIEM, including Risk Based Alerting and automated responses. But cyber hygiene isn’t just about tools and specialists, it’s about ensuring that everyone in an organisation – it's human ‘firewall’ - is trained, aware, and always engaged.

Third, a hack is (almost always) the means and not the end itself. Organisations must know what their cyber security is protecting and what its ‘crown jewels’ are. Usually, this involves data in some way, shape or form. So, cyber security must be able to see where data is moving, particularly if it is moving outside the perimeter, regardless of whether data moves as a flood or dribbles out. More broadly, an organisation’s ICT ecosystem must know its operational patterns and, in as near to real-time as possible, identify and investigate any outliers to those patterns.