Cyber attacks: we are all vulnerable

Rapid7, Inc. (Nasdaq: RPD) recently released its latest Industry Cyber-Exposure Report , an aggregated research paper examining the overall cyber-exposure and resiliency of ASX 200 organisations.

The report uncovered what we all know to be true: that ASX 200 organisations have trouble sufficiently deploying cybersecurity basics. It found, on average, ASX 200 organisations expose a public attack surface of 29 servers or devices, with many companies exposing 200 or more. The report also revealed that 67 percent of ASX 200 organisations have weak or non-existent anti-phishing email defences.

“This report demonstrates that even the most talented, best-resourced IT departments in Australia and New Zealand still face daily challenges in keeping their internet-facing assets up-to-date with supported versions of business-critical software and keeping up-to-date with the latest patches,” said Tod Beardsley, research director at Rapid7.

Rapid7 measured the internet-facing security profiles of the ASX 200 during Q4 2018 by examining: the number of exposed servers and devices; the presence of dangerous or insecure services; phishing defence posture; weak public service and metadata configurations; and joint third-party website dependency risks.

“Having an accurate view of the resiliency of organisations and industry sectors to withstand cyberattacks can focus efforts to reduce and manage exposure among those industries that need it most and enhance cooperative efforts between government and the private sector to better protect companies and their employees and customers,” Beardsley said. “Measurement of industry-level exposure can also inform industry-specific working groups that share cybersecurity information and threat intelligence. Business leaders that have an ongoing dialogue with their industry peers about cyber-exposure can be broadly beneficial to the digital ecosystem.”

Government is also exposed as evidenced by an attack on Australia's Parliament House computers. China was named as a possible source. It followed an attack in late 2018 on Perth-based Navy shipbuilder Austal. the Australian Cyber Security Centre suspected criminals based in Iran.

Back in 2017, WhiteHawk published a blog citing a report from the Joint Committee of Public Accounts and Audit (JCPAA) on cyber security compliance where they recommended cyber best practices to be followed by federal agencies that would help prevent malware and improve cyber security.

The article states: In their report, the JCPAA recommends that the Australian Government should mandate the Australian Signals Directorate’s (ASD) Essential Eight cyber security strategies specifically for entities that are covered under the Public Governance, Performance, and Accountability Act 2013. Entities included are Parliamentary departments, departments of state, and qualifying corporate and non-corporate bodies, which depends on how they were formed under Australian law.

You can read the full blog post here.

It is worth revisiting that blog post along with the the report as Cybersecurity expert Andrew Woodward from Edith Cowan University told the ABC, there is no question that cyberattacks are on the rise.

The problem, he says, is that barely anyone ever knows they are being attacked.

"There's some really sad stats out there that in the vast majority of cases an organisation only knows it's been attacked because an external third party has reported it to them because they've noticed before the company in question," Professor Woodward said.

He points to a lack of skilled cybersecurity professionals available to detect or even stop these attacks.

In that light, it's crucial that companies and government agencies get on top of their cyber security functions, hire professionals who can mitigate attacks or try to prevent them and take their data security seriously.

Cyber attacks will continue to occur, probably at a more rapid rate than ever, so it's time to up the vigilance.

Editor's note: To help you combat cyber attacks, better understand your security needs and help you put in place solutions that work for you, our friends at WhiteHawk will now be delivering a monthly column that details everything you need to know ... and more.

Stay tuned.