Banking regulator warns major cyber breaches are 'probably inevitable'
By Clancy Yeates
March 7, 2018 — 5.24pm
A major cyber breach at an Australian financial institution is "probably inevitable", and such an attack could even wipe out an entire business in the "worst case scenario", the financial regulator has warned.
The Australian Prudential Regulation Authority on Wednesday urged banks, insurers and superannuation funds to be vigilant against the risk of cyber attacks, warning that online criminals viewed the local industry as a key target.
APRA's Geoff Summerhayes says cyber crime is a growing industry and the financial sector is a key target. Credit:Jessica Hromas
Despite the growing threat, APRA executive board member Geoff Summerhayes said some financial institutions had not tested how they would cope with a cyber attack, which could leave them exposed to serious reputational and other risks.
While he said cyber security was "generally well handled" in finance, Mr Summerhayes warned that with cyber crime growing, it was "easy to envisage" an attack with catastrophic effects for the business affected.
"Regrettably, cyber crime is an expanding industry; it's lucrative, perpetrators enjoy low barriers to entry and face little to no prospect of prosecution. Though governments and organisations are continually investing in their cyber security capabilities, criminals are also adapting and innovating their tradecraft to seek out new vulnerabilities and attack methods," Mr Summerhayes said in a speech in Sydney.
"Taking all of this into account, APRA views cyber risk as an increasingly serious prudential threat to Australian financial institutions. To put it bluntly, it is easy to envisage a scenario in which a cyber breach could potentially damage an entity so badly that it is forced out of business."
Mr Summerhayes stressed that the chances of a financial institution being put out of business by a cyber attack were "remote", especially for the large businesses that spend millions of dollars a year on cyber security.
Even so, he said such an outcome was "no longer beyond the realms of possibility".
Mr Summerhayes said APRA's surveys had shown growing awareness of cyber risk in the industry, but there was still room for improvement. One concern was that institutions' plans for how they would respond to an attack were often "untested" and not incorporated with disaster recovery plans.
"Just as it's often said that it's not the crime but the cover-up that gets you, the lack of a tested and effective response to a cyber security breach can be a bigger risk for entities than the related incident," he said.
In response to the threat, APRA on Wednesday released its first prudential standard on information security, which will set minimum standards for how the sector handles cyber risks.
Institutions will be required to take undertake regular testing of their cyber defences, have robust systems in place to detect threats, and set out which senior staff are responsible for cyber security.
"Implementing legally binding minimum standards on information security is aimed at increasing the safety of the data Australians entrust to their financial institutions and enhance overall system stability," Mr Summerhayes said.
Australia's financial institutions, including the nation's $2.6 trillion superannuation pool, are seen as particularly attractive targets to cyber criminals because of the country's wealth, and the high proportion of customers who manage their money digitally.
Mr Summerhayes said that no business regulated by APRA had suffered significant losses because of a cyber incident, "but that's not for want of trying by cyber criminals."
Australia was the top target of malicious software in the Asia Pacific region, he said.
Clancy Yeates
Clancy Yeates is a business reporter.