Australian organisations face heightened cyber attacks

Nearly three in four Australian organisations had experienced cyber attacks last year, of which 89% faced more attacks since more of their employees started work from home, a new VMware study has found.

The attacks resulted in 2.3 breaches on average per year, an increase from the two breaches reported on average in the last study, underscoring the security risks that Australian organisations are facing as they accelerate their digital transformation efforts.

The breaches were not minor, with eight in 10 cases deemed material enough to require reporting to regulators or the involvement of an incident response team. About 60% of chief information security officers now expect a material breach in the coming year.

“The race to adopt cloud technology since the start of the pandemic has created a once-in-a-generation chance for business leaders to rethink their approach to cyber security,” said Rick McElroy, principal cyber security strategist at VMware.

“Legacy security systems are no longer sufficient. Organisations need protection that extends beyond endpoints to workloads to better secure data and applications. As attacker sophistication and security threats become more prevalent, we must empower defenders to detect and stop attacks, as well as implement security stacks built for a cloud-first world,” he added.

Conducted by Opinion Matters, a research firm, on behalf of VMware in December 2020, the study polled 251 senior executives in Australia in a range of industries including financial services, healthcare, government, retail and manufacturing, among others.

Australia’s manufacturing industry was the hardest hit, with a staggering 91% of manufacturing sector respondents experiencing attack increases at an above average 40%. Respondents from the healthcare sector fared better than average, with 68% reporting attack volume increases.

Across industries, ransomware was the most common culprit (26%), followed closely by third-party apps (19%) process weaknesses (18%) and out-of-date security technology (16%).

According to McElroy, multistage campaigns involving penetration, persistence, data theft, and extortion are also ramping up pressure as attackers capitalise on the disruption faced by remote workers. In most ransomware attacks, e-mail continues to be used as the most common attack vector to gain initial access, he added.

With nearly all respondents already using or planning a cloud-first security strategy, more than half now agree on the need to view security differently to address the risks of a bigger attack surface, such as improving visibility over data and apps in order to pre-empt attacks.

Interestingly, while the next frontier for business innovation may be artificial intelligence (AI), almost half of respondents (48%) said security concerns were holding them back from embracing AI and machine learning.  

Earlier this week, the Australian government’s Attorney-General’s Department said it would mandate the adoption of the Essential Eight set of cyber security measures by all non-corporate Commonwealth entities.

The move was a response to a parliamentary committee report on cyber resilience that called for government agencies to implement the full suite of measures, beyond the Top Four mitigation strategies.