Next Investors logo grey

Cyber attacks: we are all vulnerable


Published 25-MAR-2019 16:05 P.M.


3 minute read

Hey! Looks like you have stumbled on the section of our website where we have archived articles from our old business model.

In 2019 the original founding team returned to run Next Investors, we changed our business model to only write about stocks we carefully research and are invested in for the long term.

The below articles were written under our previous business model. We have kept these articles online here for your reference.

Our new mission is to build a high performing ASX micro cap investment portfolio and share our research, analysis and investment strategy with our readers.

Click Here to View Latest Articles

Rapid7, Inc. (Nasdaq: RPD) recently released its latest Industry Cyber-Exposure Report , an aggregated research paper examining the overall cyber-exposure and resiliency of ASX 200 organisations.

The report uncovered what we all know to be true: that ASX 200 organisations have trouble sufficiently deploying cybersecurity basics. It found, on average, ASX 200 organisations expose a public attack surface of 29 servers or devices, with many companies exposing 200 or more. The report also revealed that 67 percent of ASX 200 organisations have weak or non-existent anti-phishing email defences.

“This report demonstrates that even the most talented, best-resourced IT departments in Australia and New Zealand still face daily challenges in keeping their internet-facing assets up-to-date with supported versions of business-critical software and keeping up-to-date with the latest patches,” said Tod Beardsley, research director at Rapid7.

Rapid7 measured the internet-facing security profiles of the ASX 200 during Q4 2018 by examining: the number of exposed servers and devices; the presence of dangerous or insecure services; phishing defence posture; weak public service and metadata configurations; and joint third-party website dependency risks.

“Having an accurate view of the resiliency of organisations and industry sectors to withstand cyberattacks can focus efforts to reduce and manage exposure among those industries that need it most and enhance cooperative efforts between government and the private sector to better protect companies and their employees and customers,” Beardsley said. “Measurement of industry-level exposure can also inform industry-specific working groups that share cybersecurity information and threat intelligence. Business leaders that have an ongoing dialogue with their industry peers about cyber-exposure can be broadly beneficial to the digital ecosystem.”

Government is also exposed as evidenced by an attack on Australia's Parliament House computers. China was named as a possible source. It followed an attack in late 2018 on Perth-based Navy shipbuilder Austal. the Australian Cyber Security Centre suspected criminals based in Iran.

Back in 2017, WhiteHawk published a blog citing a report from the Joint Committee of Public Accounts and Audit (JCPAA) on cyber security compliance where they recommended cyber best practices to be followed by federal agencies that would help prevent malware and improve cyber security.

The article states: In their report, the JCPAA recommends that the Australian Government should mandate the Australian Signals Directorate’s (ASD) Essential Eight cyber security strategies specifically for entities that are covered under the Public Governance, Performance, and Accountability Act 2013. Entities included are Parliamentary departments, departments of state, and qualifying corporate and non-corporate bodies, which depends on how they were formed under Australian law.

You can read the full blog post here.

It is worth revisiting that blog post along with the the report as Cybersecurity expert Andrew Woodward from Edith Cowan University told the ABC, there is no question that cyberattacks are on the rise.

The problem, he says, is that barely anyone ever knows they are being attacked.

"There's some really sad stats out there that in the vast majority of cases an organisation only knows it's been attacked because an external third party has reported it to them because they've noticed before the company in question," Professor Woodward said.

He points to a lack of skilled cybersecurity professionals available to detect or even stop these attacks.

In that light, it's crucial that companies and government agencies get on top of their cyber security functions, hire professionals who can mitigate attacks or try to prevent them and take their data security seriously.

Cyber attacks will continue to occur, probably at a more rapid rate than ever, so it's time to up the vigilance.

Editor's note: To help you combat cyber attacks, better understand your security needs and help you put in place solutions that work for you, our friends at WhiteHawk will now be delivering a monthly column that details everything you need to know ... and more.

Stay tuned.

General Information Only

S3 Consortium Pty Ltd (S3, ‘we’, ‘us’, ‘our’) (CAR No. 433913) is a corporate authorised representative of LeMessurier Securities Pty Ltd (AFSL No. 296877). The information contained in this article is general information and is for informational purposes only. Any advice is general advice only. Any advice contained in this article does not constitute personal advice and S3 has not taken into consideration your personal objectives, financial situation or needs. Please seek your own independent professional advice before making any financial investment decision. Those persons acting upon information contained in this article do so entirely at their own risk.

Conflicts of Interest Notice

S3 and its associated entities may hold investments in companies featured in its articles, including through being paid in the securities of the companies we provide commentary on. We disclose the securities held in relation to a particular company that we provide commentary on. Refer to our Disclosure Policy for information on our self-imposed trading blackouts, hold conditions and de-risking (sell conditions) which seek to mitigate against any potential conflicts of interest.

Publication Notice and Disclaimer

The information contained in this article is current as at the publication date. At the time of publishing, the information contained in this article is based on sources which are available in the public domain that we consider to be reliable, and our own analysis of those sources. The views of the author may not reflect the views of the AFSL holder. Any decision by you to purchase securities in the companies featured in this article should be done so after you have sought your own independent professional advice regarding this information and made your own inquiries as to the validity of any information in this article.

Any forward-looking statements contained in this article are not guarantees or predictions of future performance, and involve known and unknown risks, uncertainties and other factors, many of which are beyond our control, and which may cause actual results or performance of companies featured to differ materially from those expressed in the statements contained in this article. S3 cannot and does not give any assurance that the results or performance expressed or implied by any forward-looking statements contained in this article will actually occur and readers are cautioned not to put undue reliance on forward-looking statements.

This article may include references to our past investing performance. Past performance is not a reliable indicator of our future investing performance.