CyberWatch: Australia

Insight on how cyber risk is being mitigated and managed in Australia and across the globe.

 

1
APRA raising the bar on Cybersecurity
2
Complex ModPOS Malware Infects Point-of-Sale Terminals in Lead up to Christmas Spend Frenzy
3
Hotel Industry Payment Systems Under Attack
4
10 Considerations for Developing a Data Breach Response Plan
5
Operation Resilient Shield
6
Victorian Racing Integrity Commissioner Seeks Access to Metadata
7
EU and U.S. Agree in Principle on New Trans-Atlantic Data-Transfer Agreement
8
Top Five Cybersecurity Insurance Tips
9
Cybersecurity Risk Management – Financial Services Entities Required to Act
10
Cyber Insurance is Only a (Small) Part of the Solution

APRA raising the bar on Cybersecurity

By Jim Bulling

At the Association of Superannuation Funds of Australia (ASFA) conference held in Brisbane in the last week of November, Stephen Glenfield, APRA’s General Manager of the South West region indicated that an area of significant interest for APRA during 2016 would be the extent to which superannuation funds were prepared for cybersecurity risks.

Mr Glenfield indicated that APRA would be conducting a thematic review of superannuation funds during 2016 which was designed to provide APRA with much more detailed information about the processes that superannuation fund trustees were putting in place to protect their funds and their members from cybersecurity breaches.

As thematic reviews carried out by APRA are usually precursors to further regulatory or prudential reform, this announcement should alert superannuation funds to expect more comprehensive regulatory requirements in relation to the cybersecurity risks in the near future.

It is expected that APRA will be particularly interested in understanding how superannuation fund risk management frameworks address cybersecurity risks and how trustee boards are involved in the oversight of cybersecurity risk management. A likely focus of the reviews will be investigating the measures which superannuation funds have established to:

  • identify critical assets and data
  • protect such assets and data
  • promptly detect when breaches have occurred
  • respond to breaches including communications and reporting
  • recover from breaches including reinstatement of systems and learnings from incidents.

This initiative comes on the back of ASIC’s release during March of this year of its Report 429 on Cyber Resilience and underlines how Australia’s financial system Regulators are becoming much more concerned about cybersecurity risks.

Complex ModPOS Malware Infects Point-of-Sale Terminals in Lead up to Christmas Spend Frenzy

By Cameron Abbott and Meg Aitken

While the festive season approaches and retailers prepare for their busiest time of the year, a sophisticated form of point-of-sale malware, known as ‘ModPOS’, has reared its ugly head and is targeting payment terminals in the U.S.

It is estimated that the first ModPOS data hacks occurred in 2013 and that millions of credit and debit cards used at a broad variety of U.S. retailers have since been compromised. The unique complexity of the code, which experts say has never been seen before in malware, made it tricky to decipher.

Cyber security experts have warned that ModPOS has the ability to not only “scrape” credit and debit card numbers from the memory of point-of-sale terminals, but that the multifaceted code also records keystrokes of computer operators and transmits stolen data. If that isn’t enough, the malware is particularly difficult to detect and is reportedly capable of infiltrating despite security software and data controls.

More details about ModPOS malware can be found here.

Hotel Industry Payment Systems Under Attack

By Cameron Abbott and Meg Aitken

Stayed at one of Hilton Worldwide Holdings’ (Hilton) hotels between 18 November – 5 December 2014 or 21 April – 27 July 2015? Check your bank statement.

Within the same week, both the Hilton and Starwood Hotels & Resorts Worldwide Inc. (Starwood) have discovered the point-of-sale terminals at a number of hotels across the globe have been infected with malware.

The malicious malware has enabled hackers to pinch the credit and debit card information of Starwood and Hilton customers, however there is apparently no evidence that personal contact information provided as part of the hotels’ guest-reservation system or loyalty rewards program was stolen.

While the attack on Starwood was confined to 54 of its hotels in North America, the Hilton attack affected the chain’s hotels globally, including Australian establishments. The number of cards compromised has not been revealed by either hotel.

Starwood and Hilton hotels are not the only luxury hotel chains to be affected by data hacks in 2015. The Mandarin Oriental and Trump International have also reported data security breaches involving intrusive malware this year. In the case of Starwood the hack occurred over eight months without detection showing how sophisticated some of these attacks are.

Starwood’s media release can be found here. Hilton’s media release can be accessed here.

10 Considerations for Developing a Data Breach Response Plan

By Jim Bulling and Michelle Chasser

A quick response to a data breach is key to mitigating its impact. The Office of the Australian Information Commissioner (OAIC) recommends that all entities have a data breach response plan in place and has recently released draft guidance on how to develop such a plan.

The guidance recommends that the plan include setting out the actions to be taken in the event of a breach and the team members involved in those actions. Here are some questions for your organisation to consider based on the OAIC’s draft guidance to developing a data breach response plan.

1. What constitutes a data breach?

2. What actions should your staff take?

3. Who is a member of the response team?

4. When does a breach needs to be escalated to senior management?

5. Who is responsible for contacting and managing any affected individuals?

6. Who decides whether to contact law enforcement or regulators?

7. How are records of data breaches kept?

8. How will you identify and address any weaknesses in data handling that contributed to a data breach?

9. Are there any steps your cybersecurity insurance policy requires you to follow?

10. How will you test your response plan?

The OAIC’s Guide to developing a data breach response plan Consultation draft can be found here.

Operation Resilient Shield

By Jim Bulling and Michelle Chasser

The US and UK are set to launch Operation Resilient Shield later this month. Operation Resilient Shield is a cybersecurity exercise to test each country’s readiness to withstand a serious attack designed to steal financial information and disrupt financial systems. Banks and government agencies in both countries will be involved.

As with the UK’s previous large scale cybersecurity exercise in 2013, Operation Waking Shark II, not a lot of detail about the operation has been released. The UK Computer Emergency Response Team (CERT) will be overseeing the operation and is thought to be focusing on communication between the two governments and the participating banks as well as amongst the participating banks themselves.

The joint UK US operation was originally announced in January 2015 by UK Prime Minister David Cameron and US President Barack Obama as part of an agreement between the two countries to develop cybersecurity cooperation principles.

EU and U.S. Agree in Principle on New Trans-Atlantic Data-Transfer Agreement

By Cameron Abbott and Melanie Long

On 26 October 2015, European Commissioner Vera Jourová, announced that the European Union had agreed in principle with the US on a new trans-Atlantic data-transfer agreement. Commissioner Jourová made the announcement in a speech, before the Committee on Civil Liberties, Justice and Home Affairs, which addressed the recent judgment of the European Court of Justice that invalidated the safe harbour scheme between the two countries (Schemes decision). Commissioner Jourvá said, “there is agreement…in principle, but we are still discussing how to ensure that these commitments are binding enough to fully meet the requirements of the Court.” She also added that she expected both sides to make progress on the remaining technical points of discussion by mid-November, when she is scheduled to visit the US. The European Commission is also planning on issuing an explanatory Communication on the consequences of the Schemes decision so that businesses and industry have ‘clear explanations and a uniform interpretation of the ruling.’ The European Commission are also working towards a pending deadline set by European data protection authorities who have said that if, by the end of January 2016, no appropriate solution is found with the U.S. authorities, they will take all necessary and appropriate steps (including enforcement action) to enable data transfers to the U.S. that respect fundamental rights.

The European Commission’s press release can be found here.

Top Five Cybersecurity Insurance Tips

By Jim Bulling and Roberta Anderson

The increased risks posed by cybersecurity breaches has meant that many organisation are looking to insurance to address some of the exposure. But cybersecurity insurance is still new and there are things which companies wishing to purchase cybersecurity insurance should look out for. Here are five tips if you are considering obtaining or renewing a cybersecurity insurance policy.

Read More

Cybersecurity Risk Management – Financial Services Entities Required to Act

By Jim Bulling

It seems clear following the release in March this year of ASIC Report 429 Cyber Resilience, that all Australian Financial Services Licensees and superannuation funds are currently required to include in their risk management framework measures aimed at addressing the risks posed by cybersecurity breaches.

In addressing the risks ASIC recommends that the U.S. National Institute for Standards and Technology (NIST) framework is a relevant risk management tool. The NIST standards set out the key objectives of an appropriate risk framework:

  • identify the critical assets and governance processes
  • protect critical assets
  • detect breaches and incidents
  • responses to breaches and incidents
  • recovery and reinstatement of systems.

You can download a copy of the framework here

These objectives will need to be merged into the existing financial services policy frameworks which financial services entities already have in place.

Cyber Insurance is Only a (Small) Part of the Solution

By Jim Bulling

Insurers in the U.S. and Europe are forecasting that the market for cyber insurance will grow exponentially in the next five years as more companies look to beef up protection against malicious cyber attacks.

While the insurers see a significant new market emerging, there are signs that they are wary of the risks and this is impacting on premiums and the limitations being placed on cover. There are a number of insurers offering cyber cover in the Australian market and companies looking for additional protection would be well served by closely examining the terms of the proposed cover to ensure it extends to the more significant cyber risks and does so in a way that complements rather than overlaps the existing insurance program which an organisation has in place (eg Public Indemnity , Directors and Officers Liability, Crime and Property).

It is also worth noting that insurance should only be seen as one component of an organisation’s risk management processes around cybersecurity. A leading insurance broker has suggested that investment in technology is the most important factor in reducing the risk profile while the contribution from insurance is much more modest and to be effective needs to be accompanied by investment in technology.

Copyright © 2018, K&L Gates LLP. All Rights Reserved.