Q&A with Babette Bottin, Founder and Managing Director, DAS Insure and Annie Esposito, Senior Consultant, CreditorWatch

According to the latest annual cyber-threat report from the government cyber-security agency, the ACSC (Australian Cyber Security Centre), cybercrime increased 13% over the last financial year with a rise in the sophistication of cyber threats, making crimes like ransomware and fraud easier to replicate at a greater scale.

Since COVID we have changed the way we interact, e.g. hybrid work opportunities, an increase in online meetings versus in-house meetings are the new norm. And also the way we verify information; one of the biggest industry shifts in the verification process has happened in the real estate industry.

Annie

We know cyber-crime and online fraud are increasing, but to what extent are they on the rise?

Babette

The ACSC received over 76,000 cybercrime reports. This equates to one report every seven minutes.

The report shows a huge increase in online fraud. It is still the most common type of cyber crime (27%), followed by online shopping at 14% and online banking at 13%. But online fraud is certainly the biggest one.

Ransomware remains the most destructive cybercrime threat. Especially because businesses might experience a dual extortion impact: their business is disrupted by the encryption of their data. On top of that they might face reputational and financial damage if the stolen data contains personally identifiable information of their customers.

It’s medium-sized businesses that have the highest average loss per crime at $88,000, probably because they already have a sizeable operation, but not enough capacity to have the IT security in place that large organisations have.

In terms of industries (excluding government sectors), the healthcare industry, and social assistance sector in particular, is most vulnerable because it works in collaboration across industries. This is followed by information and media telecommunications, education and training, and then professional and technical services.

Annie

Apart from working across different industries, what else makes the healthcare industry the most vulnerable to online crime?

Babette

Medical information costs about nine times more than financial information sold on the dark web. That makes the healthcare industry an attractive target. Criminals use medical information gained for identity theft but also to exploit healthcare systems (Medicare fraud, Centrelink fraud).

Health Service Providers were the number one ranked sector for reportable data breaches, according to the latest OAIC report (Office of the Australian Information Commissioner). Personal information sent to the wrong recipient via email and unauthorised disclosures (unintended release or publication) are the two most common human error breaches. Healthcare providers often use different practice management systems and part of the patient onboarding process still requires the patient to manually fill out a form. Sharing medical information amongst service providers is common and in the patient’s interest yet often not as automised and technically secured as the data handling process in other industries.

Annie

Yeah, it really goes across multiple industries. When I speak to businesses, one of the biggest risk factors I come across, regarding security issues, is the lack of verification and automation which goes together with increased human error.

Our onboarding solution incorporates e-signatures and multifactor authentication. So, from the very first point of the credit application and supplier onboarding, you’re getting that electronic signature.

A lot of people think that the wet signature is actually better, but anyone can pick up a pen and forge someone’s signature. With electronic signatures there’s real traceability to it through IP address capture, envelope IDs and custom rules to whom can sign. So, you have that extra level of security built into them that you can track. With proof of transaction from the beginning, it helps reduce fraud and provides a surety that wouldn’t otherwise be recorded.

We also have SmartID, which has document verification services (DVS) built into it. It uses biometrics and liveness, where a person can verify their government issued ID with biometrics, so they must take a picture of their own face to make sure it matches the one on their government ID. If an ID has been stolen or marked as identity theft, it will pick that up and check that as well.

Babette

I think tools like SmartID, e-signatures and multifactor authentication are invaluable for helping businesses identify phishing attacks and business email scams, where people are tricked into believing the email/invoice/call for action came from a legitimate sender.

Also, these tools assist to safely access and handle personal information, especially for industries where you must go to that deeper level to actually work and establish, for example, a credit limit, or a 100-points check.

Annie

What would be the biggest challenges for a business in establishing proper fraud prevention processes?

Babette

First and foremost, know your organisation and your structure. And what are the crown jewels, meaning your core assets? For some it’s a process, for some it’s intellectual property, for some it’s money, for some it’s their client lists or the information they hold on their clients. So, then you know what you need to protect and what could be of value to the crooks.

So, first step for an organisation is to determine what they have that could be attractive to cyber crooks to onsell on the dark web.

Second – this is not just an IT problem, it is a business problem – management needs to be engaged. The ultimate responsibility lies with the board. It is also a people problem, so staff need to be included, and trained on an ongoing basis. Where are your potential weak spots? Where are your potential gaps?

I recommend starting with a cyber risk health check. When consulting businesses I often use cyber risk assessment tools applied to when preparing clients to get cyber insurance ready. The cyber.gov.au site has also some great assessment tools that provide a roadmap for businesses starting out on their cyber security journey.  

Also keeping in mind that nowadays there are even simple kits for sale on the dark web on how to hack into someone’s network without having the technical expertise. According to the ACSC the so called ‘cybercrime-as-a-service’ or CaaS tools continued to increase the overall cybercrime threat to Australia.

The other thing to be conscious of, particularly if you work with a large client, defence force or the government, is not being that ‘Trojan Horse’ or weak link that exposes them to risk.

This is where CreditorWatch’s products come in as well. To become a tier-one or tier-two supplier to these large organisations it is now often a requirement to have good cybersecurity processes in place.

And since the recent high-profile breaches, like Optus and Medibank, we do know that we will have new higher penalties imposed when data breaches are not reported properly and managed properly.

There was also an amendment to the Privacy Act in 2018 to include the Notifiable Data Breaches (NDB) Scheme. Any business with a turnover of more than $3 million must immediately notify the Office of the Australian Information Commissioner (OAIC) when a data breach occurs. Some industries, e.g. Healthcare Services, are exempt from this threshold. We are currently awaiting the amendments to the Privacy Act, with the PA Bill expecting to be passed after March 31^st. Australia will then have the largest maximum penalties for infringing privacy.

If you hold personal, identifiable information, you have that extra duty of care and you need to be vigilant. So, that could be your crown jewels, and then you start to map out how you collect that data, how you store it, where you store it, how you destroy it, back it up and that whole lifecycle of data needs to be mapped out.

The cybercrooks will always go for the easiest target. It comes down to those things that we mentioned like a strong onboarding process, automation, and multi factor authentication in place. You don’t have to outrun the bear; you just have to be running faster than your neighbour because hackers always go for the easiest target.

When you talk about credit applications; especially if a business manages this on a large scale, they will access and potentially hold quite a large amount of sensitive information about their customers to process those credit applications. So, they should focus on securing the whole process – of how to collect it, store it, destroy it and how to protect access from external, and internal sources.