Navigating Cyber Risks in Australia: Key Insights and Proactive Measures

Australia has been ranked as the third most vulnerable nation, as per Statista, after India and the US, when it comes to cyber security related incidents. This is due to a combination of irresponsible user behaviour and lack of user training around best user policy.

As per the Australian Cyber Security Centre (ACSC), 76,000 cybercrimes were reported in the financial year 2022. This number has risen by 9,000 in comparison to the fiscal year 2021.

Why is the Australian Market Prone to Cyberattacks?

The total loss from investment and dating & romance scams in 2021 is over 177 million AUD and 56 million AUD, respectively. False billings, remote access scams, and threat to life followed this. Statistics like these pull out the primary question of ‘why exactly is the Australian market highly susceptible to so much loss?’.

There are multiple reasons owing to the evolution of cybersecurity vulnerabilities in the country. First, threat actors are becoming more sophisticated with their social engineering techniques, and unfortunately, the Australian market is severely failing to deploy effective cybersecurity awareness and protocols to combat them.

This is down to several reasons:

• Unstructured and unnecessary data-retention laws.
• Mediocre data-destruction policies and practices that make data prone to exploitation.
• Outdated privacy laws forbid Australian users from suing companies for weak data-protection norms.
• Poor cybersecurity awareness and training amongst employees and the general public.
• Poor security posture of organisations IT environment.
• Premium versions of secured software and services are quite expensive in Australia as compared to other countries/nations. Not many companies subscribe to premium software services.

Small business owners are at the maximum risk since they rely on younger family members or employees to manage their cybersecurity. The worst part is that almost 66% of the Australian market’s small business owners perceive tech-savviness as equivalent to cybersecurity skills.

With regards to industries, the Australian media and telecoms industry accounted for as many as 72% of the country’s 50 million stolen credentials in 2022. As per the industry experts, the shift to unprotected remote work culture was responsible for such a high number.

Common Attack Types to Be Aware Of

As per Australia’s Annual Cyber Threat Report 2021-2022, one cybercrime is reported every 7 minutes. Here are some common vulnerabilities and threat types you should be aware of.

• Brute Force Attacks

The frequency of automated attacks has doubled between July 2021 and June 2022. Brute force attacks and credential stuffing are among the top automated ways to crack passwords. Together they were involved in 28% of account takeovers in the country in the first half of 2022. 

• Remote Code Execution (RCE) attack.

RCE’s which enables bad actors to remotely execute malicious scripts on devices connected to the internet, was reported at a 60% rise across the board. 

• Attacks on 5G Devices

5G hardware used for routers, mobile devices, and PCs is highly prone to cyberattacks due to coded vulnerabilities. Building firmware security into their design and adding multi-factor authentication are helpful to stay shielded. However, threat actors can still bypass multi-factor authentication systems using the following exploitation methods:

• Reusing a Token: Coercing access to recent users OTPs and reusing them.
• Sharing Unused Tokens: Malicious actors use their own accounts to obtain OTPs and then use them on victims’ accounts.
• Leaked Token: Entering OTPs taken from leaked web applications.
• Password Reset Function: Phishing tricks are attempted to manipulate users into sharing OTPs via texts, emails, or phone calls.

• Ransomware Attacks

New ransomware strains are emerging at an alarming rate. Opportunistic attackers are using any change in circumstances, targeting all industries of any size, to launch effective campaigns and hold organisations to ransom.

The Australian National Plan to Combat Cybercrime

In responses to cyber security challenges, the Australian government has devised a plan, focussing on three key pillars:

1.    Pillar One: Prevent and Protect

The Commonwealth, state and territory governments prioritize prevention and protection by enabling early engagement and response to cybercrime threats. This also includes using academia and the nation’s cutting-edge research and development capacity to design optimum security and safety concepts.

2.    Pillar Two: Investigate, Disrupt, and Prosecute

The second pillar is based on the belief that criminal justice responses are vital to considering that the law enforcement has the right power to investigate, disrupt, and prosecute cybercrimes. The Commonwealth, state, and territory laws are working together to solidify the partnership between the public and private sectors while also giving access to electronic evidence belonging to foreign jurisdictions. 

3.    Pillar Three: Recover

The third pillar focuses on the impact of attacks on Australians’ business and personal lives, which include elements other than just financial losses. The government is ensuring quick and effective recovery by reviewing post-crime feedback mechanisms, building awareness on how to access resources on recovery, supporting companies with lawsuits, etc. 

Next Steps

The Australian market has become a hot target of cybercrime. The Commonwealth, state, and territory governments are working together to combat the prevailing cyber threats by creating a three-tier plan revolving around prevention, investigation, and response.

If you are an Australian based organisation, who wants to enhance their cyber security posture, reach out to a member of our SecurityHQ team, or speak to one of the local team members, for more information. Fill out this form, and we will get back to you.