Analysis: In Australia, a hacking frenzy spurred by an undersized cybersecurity workforce

Robert Half

31/10/2022 05:13

* 
      Number of accounts hit in Optus, Medibank hacks equivalent
to
56% of population
    

        * 
      Hackers seeking to match others' successes - experts
    

        * 
      Human error is common factor in under-strength workforce -
experts
    

        * 
      No quick fix in search for properly trained staff overseas
    

  
    By Byron Kaye and Lewis Jackson
       SYDNEY, Oct 31 (Reuters) - A swathe of hacks on some of
Australia's biggest companies has made the country a target for
copycat attacks just as a skills shortage leaves an
understaffed, overworked cybersecurity workforce ill-equipped to
stop it, technology experts said.
    As Monday saw the disclosure of another potential breach of
sensitive data - a ransomware attack on a communication platform
for military personnel - cybersecurity experts put a wave of
high-profile breaches down to a common factor: human error. 
    Between Australia's No. 2 telecoms company Optus, which is
owned by Singapore Telecommunications Ltd  STEL.SI , and the
country's biggest health insurer, Medibank Private Ltd  MPL.AX ,
some 14 million customer accounts have had data hacked -
equivalent to 56% of the population - since Sept. 22 alone.
    The workforce weakness assertion points to a problem with no
quick fix.
    After COVID-19 border closures which ended in late 2021,
Australian immigration officials say they are still working
through one million visa applications from people seeking to
work in the country, many in technology and cybersecurity jobs
for employers looking to fill vacancies abroad.  urn:newsml:reuters.com:*:nL4N30205Y
    "They don't have enough trained people to take it seriously
and do what is needed," said Sanjay Jha, chief scientist at the
University of New South Wales institute for cybersecurity.
    "Sometimes you're ticking a box in an Excel spreadsheet and
you don't understand what you're doing, and then the outcome is
not going to be great. You need people who are really skilled
and trained properly."
    With hacking software easier to acquire online and the shift
to working from home leaving more weak spots in company
networks, the number of data breaches has tripled globally in
two years, according to cybersecurity industry research. This
week 37 countries, including Australia, will meet at the White
House with the goal of tackling ransomware and other cyber
crime.  urn:newsml:reuters.com:*:nL1N31V0NX
    The uptick has sent shockwaves through corporate Australia
in particular due to the high visibility of targets and the
sensitivity of their data, including millions of medical
records.
    Experts said a steady stream of smaller breach notifications
may be the result of hackers seeking to match others' success.
    BIG TARGET
    Government agency the Australian Cyber Security Centre
(ACSC) said the number of breach notifications rose 13% to be
worth a total A$33 billion ($21 billion) in the year to June
2021, the most recent available figures. The agency is expected
to show another increase when it publishes 2022 figures in the
coming weeks.
    Australian cybersecurity insurance premiums rose by an
average of 56% year-on-year in the second quarter, said insurer
Marsh & McLennan Companies Inc  MMC.N .
    "It's a rich country, a first-world country that does a lot
of business, that has a lot of data, so therefore it is
targeted," said Win-Li Toh, principal at actuary firm Taylor
Fry, who specialises in cybersecurity risk.
    "Trying to employ people to defend your assets is getting
harder because there just aren't enough people coming out, and
education will take one to two years."
    Companies are offering premiums of up to 50% on starting
salary offers for cybersecurity workers due to a "deep talent
deficit", said Nicole Gorton, a director at specialist recruiter
Robert Half. The average Australian cybersecurity base salary is
A$105,000, according to jobs website Glassdoor.
    Neil Curtis, an Australian cybersecurity executive of U.S.
technology contractor DXC Technology Co  DXC.N , who runs a
programme retraining military veterans in cybersecurity, said he
had requests for about 300 trained personnel in the next six
months.
    Curtis said an official at DXC Technology had recently
relayed to him a private request for cybersecurity staff for one
of Australia's biggest companies.
    "I said, 'How many do you want?'," he told Reuters by phone.
    "They said, 'We'll take everybody you've got'."
($1 = 1.5584 Australian dollars)
 (Reporting by Byron Kaye and Lewis Jackson; Editing by Alasdair
Pal and Kenneth Maxwell)
 ((byron.kaye@thomsonreuters.com; +612 9171 7541; @byronkaye;))