Privacy and Cyber Risk – Turning uncertainty into opportunity

Introduction: Australia’s current technological landscape.

Australia’s technological landscape is ever evolving. Across sectors, digital technologies are constantly shifting business rules by facilitating new business models. Technology has not only been fundamental in assisting corporations in reducing cost and increasing productivity, digitalisation has substantially changed the business landscape promising increased opportunity and innovation. However, with this new opportunity comes new risks, particularly cyber risk and the risk of breach of privacy.

What is Cyber Risk?

Cyber risk is any risk relating to financial loss, disruption or damage to an organisation’s reputation due to some type of failure of its information technology systems either in the form of technical infrastructure networks or the use of technology inside an organisation.¹ This also encompasses risks connected to personal data storage. On conservative estimates, cybercrime currently costs Australians upwards of $1 billion per year.²  The instruments of cybercrime are many and varied and include:

1. ransomware;
2. credential-harvesting malware;
3. social engineering; and
4. spear phishing

Ransomware

Ransomware persists to be a threat to both Australia’s and the world’s current technological landscape. Ransomware is a program that is implanted in an organisation’s computer system and effectively encrypts or blocks access to a corporation’s data.³ Cybercriminals then typically demand a ransom payment via cryptocurrency (a digital currency where encryption techniques are utilised to regulate the generation of currency units) or bitcoin to restore data access.⁴ Moreover, even if an organisation pays the ransom, there is no assurance that their data will be unlocked.⁵ Ransomware is a growing threat to both individuals and corporations in Australia and globally, particularly when ransomware kits are becoming increasingly obtainable on the darknet.⁶ Supporting this, Dimension Data has found that ransomware attacks globally increased by 350% in 2017 over the previous year.⁷

Credential-harvesting malware

Credential harvesting malware refers to the stealing of legitimate credentials such as login details and passwords to gain access to target an organisation’s systems for unlawful or malevolent objectives.⁸ This form of malware poses a growing risk to Australian network systems, particularly the financial sector. ⁹ The Australian Cyber Security Centre (ACSC) has observed a recent change in cybercriminals targeting activities, particularly the development of expertise and malware to target Australia.¹⁰

Social engineering

Social engineering occurs when cybercriminals seize private and confidential information from companies by impersonating representatives of legitimate organisations, for example, the company’s bank.¹¹ Cybercriminals will characteristically make these information requests using an email that contains official letterhead to give a sense of legitimacy or by bogus phone calls.¹² Social media has developed an ideal platform for cybercriminals to acquire personal information to target victims.¹³ Cybercriminals are able to research businesses, use fake social media accounts, and compromise legitimate accounts, allowing them to impersonate business and government officials.¹⁴ The use of social engineering is particularly prominent in business email compromise that targets businesses for financial gain. ¹⁵

Spear phishing

Spear phishing is a form of phishing where fraudulent emails target particular organisations to obtain access to confidential information.¹⁶ Cyber criminals typically utilise techniques like email filters and antivirus, with the objective of tricking a targeted victim into opening an email containing a malicious link, file attachment or clicking on a malicious embedded link.¹⁷ Spear phishing emails continue to be a regular exploitation technique utilised to compromise Australian industry networks.¹⁸ Cybercriminals are targeting industry employees to obtain access to corporate networks and individuals with a great amount of personal or corporate information that is available online.¹⁹

An important question for directors: How cyber resilient is your organisation?²⁰

Cyber resilience is an organisation’s ability to resist or swiftly recover from cyber events that interrupt usual business operations.²¹ The ability to recognise and manage risk, and in this context cyber risk and risk of privacy breach, is embedded within the role of an organisation’s board of directors and senior management.²² To empower boards to do this, organisations must have an appropriate framework to identify and manage risk on a continuing basis.²³ Organisations must ensure they have implemented suitable safeguards against malicious cyber activities and that recovery capabilities in response to cybercrime and breach of privacy are adequate.²⁴

Consequences of cyber attacks

If organisations and their directors fail to implement appropriate safeguards so that their organisation can swiftly recover from cyber-attacks, the consequences of cyber-attacks include but are not limited to:

1. Loss of important or confidential data;
2. Loss of customers due to data breach;
3. Loss of an organisation’s reputation due to negative media attention;
4. Loss of share value;
5. Business interruption; and
6. Possibly, regulatory fines

When can a director be liable?

Generally, directors have a fiduciary duty and a civil obligation to exercise due care and diligence. More specifically, pursuant to s180(1) of the Corporations Act 2001 (Cth), ‘a director or other officer of a corporation must exercise their powers and discharge their duties’ with a degree of care and diligence. The degree of care and diligence is that what ‘a reasonable person would exercise if they were a director or officer of a corporation in the corporation’s circumstances’²⁵. In the event that a director neglects to exercise due care and diligence in recognising and managing cyber risk and risk of breach of privacy, by adopting safeguards to protect an organisation from these risk, they may be liable.

Moreover, a director may be liable for a privacy breach if they aid, abet, counsel or procure, or induce by threats, promises or otherwise, or be in any way, directly or indirectly, knowingly concerned in or are a party to, or conspire with others to occasion serious or recurrent privacy breaches.²⁶ This is pursuant to s 80V of the Privacy Act 1988 (Cth). There are civil penalties associated with a contravention of the Privacy Act 1988 (Cth).

Cyber risk and breach of privacy isn’t novel, but the stakes grow greater every day. An incident is no longer likely to be a single event but can have significant repercussions given the increasing interconnectedness of the digital Century. As an organisation, knowing the risks and how to manage them is more important now than ever, given the current digitalisation of Australia and the world.