It’s open season for hackers as chinks show in Australia’s cybersecurity armour

Sydney — A swathe of hacks on some of Australia's biggest companies has made the country a target for copycat attacks just as a skills shortage leaves an understaffed, overworked cybersecurity workforce ill-equipped to stop it, technology experts said.

As Monday saw the disclosure of another potential breach of sensitive data — a ransomware attack on a communication platform for military personnel — cybersecurity experts put a wave of high-profile breaches down to a common factor: human error.

Between Australia's No 2 telecom company, Optus, which is owned by Singapore Telecommunications, and the country's biggest health insurer, Medibank, about 14-million customer accounts have had data hacked — equivalent to 56% of the population — since September 22 alone.

The workforce weakness assertion points to a problem with no quick fix.

After Covid-19 border closures,which ended in late 2021, Australian immigration officials say they are still working through 1-million visa applications from people seeking to work in the country, many in technology and cybersecurity jobs for employers looking to fill vacancies abroad.

“They don't have enough trained people to take it seriously and do what is needed,” said Sanjay Jha, chief scientist at the University of New South Wales institute for cybersecurity.

“Sometimes you're ticking a box in an Excel spreadsheet and you don't understand what you're doing, and then the outcome is not going to be great. You need people who are really skilled and trained properly.”

With hacking software easier to acquire online and the shift to working from home leaving more weak spots in company networks, the number of data breaches has tripled globally in two years, according to cybersecurity industry research. This week 37 countries, including Australia, will meet at the White House with the goal of tackling ransomware and other cybercrime.

Steady stream

The uptick has sent shock waves through corporate Australia in particular due to the high visibility of targets and the sensitivity of their data, including millions of medical records.

Experts said a steady stream of smaller breach notifications may be the result of hackers seeking to match others' success.

Government agency the Australian Cyber Security Centre (ACSC) said the number of breach notifications rose 13% to be worth a total A$33bn in the year to June 2021, the most recent available figures. The agency is expected to show another increase when it publishes 2022 figures in the coming weeks.

Australian cybersecurity insurance premiums rose by an average of 56% year on year in the second quarter, said insurer Marsh & McLennan Companies.

“It's a rich country, a first-world country that does a lot of business, that has a lot of data, so therefore it is targeted,” said Win-Li Toh, principal at actuary firm Taylor Fry, who specialises in cybersecurity risk.

“Trying to employ people to defend your assets is getting harder because there just aren't enough people coming out, and education will take one to two years.”

Companies are offering premiums of up to 50% on starting salary offers for cybersecurity workers due to a “deep talent deficit”, said Nicole Gorton, a director at specialist recruiter Robert Half. The average Australian cybersecurity base salary is A$105,000, according to jobs website Glassdoor.

Neil Curtis, an Australian cybersecurity executive of US technology contractor DXC Technology Co, who runs a programme retraining military veterans in cybersecurity, said he had requests for about 300 trained personnel in the next six months.

Curtis said an official at DXC Technology had recently relayed to him a private request for cybersecurity staff for one of Australia's biggest companies.

“I said, 'How many do you want?',” he told Reuters by phone. “They said, 'We'll take everybody you've got'.”

Reuters