Digital Nation Australia ’s Post

Transcript

Cyber has burst into public awareness in recent years thanks to a number of high profile breaches. These incidents have helped take what was previously a backroom technical concern an elevated it to the top of organisations risk registers, forcing many to rethink how they approach cyber threats and the task of defending. Against them For company director Andrew Baxter, whose portfolio includes Australian Pork, the Sydney Symphony Orchestra and Oz Harvest, how a board approaches cybersecurity has become a key consideration among his colleagues. When I was in my corporate life and running a major, you know, communications groups and we're dealing with lots of clients data, I suppose it was always top of mind to make sure that we were managing that data well and ethically. But I would guess if I think back to my early board career, you know, possibly I was one of the only ones with that background that, you know, had a bit of a flag in my mind that we should be keeping an eye out on privacy or cyber or, or data. And I, I would say now that, you know, every board member. Five years on, knows exactly, you know, that they need to be looking after this. And you know, we've obviously had made major things like the Optus breach and, and Medibank and things like that have become very much top of mind for board directors. And, and I think board directors are much better at understanding the impact, not just brand reputation risk, but I mean, when I, you know, I mean the, the risk of, you know, the, the valuation of your business dropping your market cap, particularly if you're listed. Company is huge and the many bank one, you know, you're talking billions of dollars of market cap being lost off the back of a breach like that. So there, there, there. There's not only the brand reputation risk, there's not only personal information being leaked out, but there's also a financial implication that boards need to consider. For Baxter, heightened awareness is appearing at a practical level in the form of non-technical directors seeking more information and education and devoting more time to the topic. One thing that's definitely happening is more deep dives. I mean, many boards will have a deep dive section in each of their board papers and it, you know, usually, obviously depending on the board, it's around some of the key areas of the organisation where you might do a deep dive for an hour or an hour and a half into a certain area. Now all of a sudden cyber is one of those deep dives are most board agendas every year. I think the education piece has been terrific. I mean, probably at least half my boards have had a cyber expert come in. In one case it was. An expert that had that that was part of a, a larger organisation that had had a breach in one of their subsidiaries. And just just hearing the practical first hand experience of what they did, how they reacted and what they put in place since to ensure that these things don't happen again. Has certainly come to the fore in, in, in, in some of the board meetings, which has been terrific. Because I think, you know, if, if board directors are essentially, you know, governing strategy and then governing the execution of that strategy as well as the risk around it, then these are critical things they need to be worried about. Awareness does not always translate into action, however. Company director, investor and former Atlassian Seiso Craig Davies says that while the visibility of cyber is elevated, many have not changed their approach to cyber in response. I feel that there's a cut off point in the size of the organization where there's been no change. So if you were to take, I would say a typical ASX 100, it's very much up and visible, may not necessarily be working very well, but it's it's there. But as you kind of work down the stack and then when you get into small and medium business, it is nowhere. It is just noise. So that's why these people are still getting hit with the business e-mail compromise or the I got hacked, you know, all the stuff we see all the time. According to Davies, what is needed? Is a new approach to cyber that first considers the roles of the human within the organization rather than the technology, and that means ensuring that people are ready when something does go wrong. We do know the number one issue in the protecting an enterprise is the people element. And we do. We still learn engineering to control the blast radius if something goes wrong. So if you take the motor car analogy. You know #1 raising cars crashes because people make a mistake. But we've embedded multiple systems around them from seat belts, collapsible zones, airbags, pre warning, like we've embedded all this stuff around them. So if they do make a mistake. There's a possibility they could be OK. Yeah, for many organisations there's still have to deal with the probable fact. That a person in a function. Can click on a link. And can take out like the majority of the organization, like we just we don't have the ability to really break down that problem so well. Go through organisations who understand that this going bad could really, really start their businesses. They actually plan like all the scenarios, they workshop scenarios. They even workshop what the communication looks like and who comes from. The CEO and founder of the venture capital firm Dremora, Klaus Bartosh takes that analogy one step further into the realm of the airline industry. Pilots train virtually every. Possible circumstance so that when it finally happens. And not having to think on the fly for how they're going to respond and deal with stuff. And there's no different. I think here we we're cybersecurity. I mean, when was the last time you saw or heard of a company that ran a drill to manage the event of a cybersecurity breach? That don't happen. According to Bartosh, organizations with mature cyber defense programs start by having those programs put to the test by external experts. I think getting getting independent parties doing threat assessments of your environments and your business by essentially attempting to hack you is a good place to start. If you haven't had those kinds of independent external examinations performed, how can you possibly know where you think your real threats are? Second is. Have has an organisation developed its strategy for dealing with the range of different risks and threats that it may face? And that means not only what our systems, what are the data, what's the knock on impact of that to both internal customers and stakeholders, external customers and stakeholders? And then thirdly, it's it's. You know most companies use multiple third party software products to do what they do. And. How many companies have actually asked those same software companies to provide them with a detailed certification and plan? And you know what one of those organisations done to manage and protect their data? And then as a director of a company, have you considered properly the full implications of? Of of your exposure as a director and, or the organisation and have you taken put in place the right measures and plans to deal with that in the right way? I mean, it's a, it's a multifaceted problem. A recent addition to the cyber challenges faced by organizations is the growing regulatory compliance requirement. Despite good intentions, Bartosh says the imposition of regulation can also have negative consequences. The burden on companies for from the compliance obligations that government increasingly place on them has an anti competitive aspect to the way in which businesses operate and I think there's a balance that needs to be struck the more policy and compliance and regulations you provide. Effectively what you're doing is saying to companies, just meet those and we'll all believe you've done the best you can. You're giving them an excuse for not doing more. By simply just meeting those compliance requirements and those regulatory requirements rather than what they should be doing, which is focusing on properly protecting their business, their data, their people, their customers data, and the impact on their business from Michelle's perspective. And that should be the primary focus for every single company. So I think government has a role to play, but the balance is one that needs to be managed very, very carefully The the point is that. And it's what we don't know the represents the greatest threat. That was Andrew Baxter, Craig Davies and Klaus Bartosh discussing changing approaches to cybersecurity for digital nations. Digital as usual. Cyber security report.