Former NSA exec Phil Quade tips increase in state-led cyber attacks

Examples of state-based attacks are numerous. In 2015 the Ukraine energy grids was temporarily switched off after cyber criminals, suspected to be acting for Russia, compromised information systems of three energy distribution companies.

North Korean state-sponsored groups were also linked to the 2014 Sony hack and cybersecurity company FireEye has previously said to be monitoring 30 groups linked to nation state cyber attacks.

Mr Quade said he was in Australia to investigate why local clients were adopting the company’s broad range of cyber security products more quickly than other countries, which still invest mostly in its flagship firewall product.

Strategy

The former NSA leader joined Fortinet in January and is responsible for building alliances with external c-suite executives and advancing the national dialogue on cyber security, as well as internally ensuring Fortinet’s IT products and services are secure.

Mr Quade was also given permission to create a group dedicated to critical infrastructure protection, which he said would focus on community concerns around national assets, rather than business development.

Despite regular assurances from utility and telecommunications companies (considered critical infrastructure) that they have state-of-the-art cyber security defences, Mr Quade said that in his experience financial services companies were usually best in class for their approach to cyber security

“I don’t want to be too critical, because my knowledge of the US is better … but typically financial services does a nice job of communicating about shared risks. One man’s detection is another man’s prevention. But it goes mostly downhill from there,” he said.

“[To get to the leading edge] the first thing to recognise is that we need to better integrate the disciplines of security. Right now we often manage IT and OT (operational technology) separately and then have a third person in charge of physical security.

“We need to get better at integrating these approaches and that will close the seams the adversaries seem to exploit.”

Increasing threats

According to Fortinet’s latest quarterly threat landscape report, cyber attacks are increasing in volume, variety and velocity.

The report found cryptocurrency mining malware was on the rise in APAC and globally, with cyber criminals utilising a technique termed cryptojacking to mine cryptocurrencies by loading a script into a web browser without installing anything onto the computer.

In Australia specifically, it was also observed that attacks had been particularly concentrated on the healthcare and education sectors and this was attributed to the lower cyber knowledge of workers in these sectors, in conjunction with the bring-your-own-device trend.

Ransomware was also found to still be prevalent and three of the top 20 attacks identified by Fortinet had been targeted at internet of things devices.

In February the new mandatory data breach notification rules came into effect in Australia, meaning companies above a $3 million revenue threshold or that aresubject to the Privacy Act, must disclose data breaches that could result in “serious harm”.

Under the new laws, sea safety and support company Svitzer Australia was the first to publicly disclose that the email accounts of three Australian employees had been compromised between May 27, 2017 and March 1, 2018, with emails auto forwarded to two external accounts. After discovering the breach, the company stopped the theft within five hours.

Mr Quade said that internationally Europe’s GDPR regulations on data breaches were considered the most aggressive, with penalties including 4 per cent of a company’s revenue for failing to report a breach.

“It’s a toothy way of causing movement. But in my whole career I’ve found you don’t always have to use the stick, sometimes the carrot is the right approach,” he said.

“The NDB scheme doesn’t have the same toothiness as the GDPR, but that doesn’t mean it’s wrong, it’s just a different balance.”