Modern IT and communications systems are so complex that effective data security is possible only with a significant amount of collaboration between organisations.
That’s the theme of consultancy PwC’s latest annual ‘Global State of Information Security Survey’.
“Collaboration is fundamental to security,” says Steve Ingram, PwC’s Asia-Pacific Cyber Lead. “We live in a whole new ecosystem now, where major corporates invite customers and suppliers to be part of their electronic environment.
“Industrial control systems that once operated separately from IT platforms are now all interconnected. The systems are so interrelated that everyone is depending upon everybody else.
“But they’re not collaborating or cooperating as much as they should be. And, as has always been the case, our ecosystem is only as strong as our weakest link.”
Mr Ingram will deliver a keynote address at the InnovationAus.com event ‘Cyber Security – The Leadership Imperative’ on Wednesday May 3. The sold-out forum encourages a comprehensive debate on the role that education, government and businesses play in developing cyber-strategic leaders.
“We need to share, because the crooks are sharing,” says Mr Ingram. “You go onto the dark web and it’s a marketplace just like when you hire a car or make a hotel room booking.
“They even have their own ratings on customer satisfaction. They share information. They sell stuff. They give feedback to each other. They’re not bound by the same sense of secrecy that we are,” he told InnovationAus.com.
“That means they have an edge in the game at the moment. We have to change our thinking and understand that information sharing is fundamental.”
Mr Ingram says that PwC’s Information Security Survey shows that many people in Australia, aren’t aware of the need for collaboration in security systems.
“The survey shows that Australia is behind on the use of threat intelligence and the sharing of indicators of compromise. We are behind compared to China, compared to Asia, and compared to the world average.”
Less than half of Australian respondents to the survey share actionable security information with their peers (44 percent) or government agencies (43 percent).
“Even though the use of threat intelligence and sharing of data in Australia is behind the global trend, PwC has seen that when collaboration between organisations does happen it is an effective defence against industry-wide attacks,” says Mr Ingram.
“Collaboration is key to tackling cybercrime in Australia. The future growth of Australia’s economy depends on consumer and business trust in our nation’s digital systems and infrastructure to keep our information safe.
“As our adversaries are working together to break our defences, the only effective response is a collaborative solution where both the public and private sector join forces to combat these cyber threats.”
He says that the Government has a role to play, but that ultimately it is up to the private sector to take the lead.
“The private sector needs to take ownership here and not wait on government. Over the last few months PwC has brought together eight major corporates to implement a joint cyber threat intelligence program.
“We need to make Australia a better place to do business. We need to find a way for major corporates to share intelligence with each other, even down to the medical centre on the corner.”
He says there are five types of attackers: organised crime, state sponsored intelligence, terrorists, hackers and hacktivists, and insiders.
“It’s really hard to stop the state sponsored intelligence players. Even governments find it hard to stop or detect other governments. For most companies organised crime is the big one. I really do think if we can get this right. if we can share the right information with every company in Australia, we can make the country a much harder target for organised crime.
“We won’t be immune but it will be harder for them to do what they do, and they’ll go somewhere else. We’ll be a better place to do business, which means the whole economy benefits.”
He gives the example of Operation Cloud Hopper, a collaborative cyber security operation in Europe where PwC worked with BAE Systems and the UK’s National Cyber Security Centre (NCSC) to uncover and disrupt what he describes as one of the largest ever sustained global cyber espionage campaigns.
The threat actor was a group known as APT10 or Red Apollo. It was masquerading as legitimate Japanese government entities to target Managed Service Providers in an attempt to access to the intellectual property and sensitive data of the MSPs and their clients.
“The sheer scale of the operation was uncovered through collaboration amongst organisations in the public and private sectors. It’s a great example of what can be done when different organisations share information and cooperate to combat cyber threats.”
Mr Ingram told InnovationAus.com that Information sharing on cyber security is not a competitive advantage, it is a national imperative.
“Effective cyber security is not a technology issue. It is about people, it is about information and it is about coordination. In Australia, we need to increase the cybersecurity awareness in both the public and private sector with the view to establishing a layered approach for sharing information among different industries.”
‘Cyber Security – The Leadership Imperative’ will be held on the morning of Wednesday 3 May in Sydney. More information here.
The PwC Global State of Information Security Survey can be found here and the Australian addendum here.
PwC has partnered with InnovationAus.com as a sponsor of the Cyber Security – The Leadership Imperative 2017 forum