ChiefIT.me Magazine - Mar/Apr 2016

POWERED BY

AUSTRALIAN SECURITY MAGAZINE Feb/March 2016

Mar/Apr 2016

Safe Cities

Ring of defence tatics to reduce hacking

New frontier for the globalisation of terrorism

Cyber security at sea

CANALYS Special Feature

Cloud and internet hacking on the rise

INNOVATION & SECURITY VERSUS VERSUS

$8.95 INC. GST

1 | Chief IT

CYBER & TERROR ATTACKS

PLUS

TechTime l Cyber-TechTime Security Predictions 2016

CLIENT VIEWING Workstations/ Network Switches/ Service and Support

IP Video STORAGE solutions

THE DAWN OF A NEW ERA FOR SMALL PROJECTS

The Aurora Series are built to fill a void in the small project market: economically-driven, enterprise-class storage systems. They bring features never before seen in budget projects such as redundant power, multiple RAID sets, and server-grade CPU’s with 10000 PassMark ®ratings. High-end features, while maintaining the price points required for the small project market. The Aurora systems alter the landscape on video recorders - in price and performance.

For more info visit bcdvideo.com or email peaceofmind@bcdvideo.com

SCALABLE SOLUTIONS Solutions that fit every need, from small retail to airports and casinos

Global

Over 17,000 deployments worldwide partnered with global on-site support.

2 | Chief IT

Guaranteed Calculations Follow our journey around the globe

BCDVideo’s calculations are guaranteed, so you never have to worry about project accuracy.

From the War Room to the Board Room, Huntsman速 Defence Grade Cyber Security Platform delivers: Advanced Threat Detection and Incident Response Continuous Compliance Serious Cyber Security ROI

Proven in the most secure and sensitive environments within the intelligence, defence and criminal justice networks across the 5 Eyes community.

3 | Chief IT

LEARN MORE TODAY 1300 135 897 huntsmansecurity.com

Contents Contents

Executive Editor / Director Executive Editor / Director Chris Cubbage Chris Cubbage Director / Co-founder Director / Co-founder David Matrai David Matrai Art Director Art Director Stefan Babij Stefan Babij Correspondents Correspondents Sarosh Bana Sarosh Bana Naomi Oakley Kema Johnson Tony Campbell CISSP

MARKETING MARKETING AND AND ADVERTISING ADVERTISING promoteme@australiansecuritymagazine.com.au promoteme@australiansecuritymagazine.com.au SUBSCRIPTIONS SUBSCRIPTIONS

TT||+61 +61886361 63611786 1786

subscriptions@mysecurity.com.au subscriptions@mysecurity.com.au Copyright Copyright©©2015 2015--My MySecurity SecurityMedia MediaPty PtyLtd Ltd 286 286Alexander AlexanderDrive, Drive,Dianella, Dianella,WA WA6059, 6059,Australia Australia TT| |+61 +61886465 64654732 4732 EE| |info@mysecurity.com.au info@mysecurity.com.au E:E:editor@australiansecuritymagazine.com.au editor@australiansecuritymagazine.com.au

All AllMaterial Materialappearing appearingininAustralian AustralianSecurity SecurityMagazine Magazineisis copyright. copyright.Reproduction Reproductionininwhole wholeororpart partisisnot notpermitted permitted without withoutpermission permissionininwriting writingfrom fromthe thepublisher. publisher.The Theviews views ofofcontributors contributorsare arenot notnecessarily necessarilythose thoseofofthe thepublisher. publisher.

Professional Professionaladvice adviceshould shouldbe besought soughtbefore beforeapplying applyingthe the information informationtotoparticular particularcircumstances. circumstances.

Editor's Desk Editor’s Desk Frontline

3

Canalys Special Feature - Channels Forum Safe Cities

164

Training Predictions in security programs Security 2016 And the answer is 2010 - 2016 Cyber Attack Risk Vectors National Security Cyber Security We must speak up

286 7 30

Cyber at sea reflection on aviation security 2016 security - 2020 insider’s

329

Unmanned aerial surveillance forwill Australian border security Attacks on the internet and cloud continue

Terrorism The illusion of ‘real time’ and ‘intelligence’ collection.

A new frontier for the globalisation of terrorism Adopting “ring of defence” licensing strategy to reduce hacker theft Australia’s Jihadis

10 34

Protecting critical infrastructure from cyber attacks Canalys Special Feature - Channels Forum

40 16

Security Predictions 2016infoSec workforce How to build a world class 2010 - 2016 Cyber Attack Risk Vectors Protecting the enterprise in a world of hackers Cyber Security The every-day of Australian information security practitioners Cyber securitylife at sea

22 42 24 44

TechTime news products

Attacks on- the latest internet andand cloud will continue

49 28

The illusion ‘real time’ Editor’s BookofReview and ‘intelligence’ collection.

Adopting “ring of defence” licensing strategy to reduce hacker theft

30 54 32

Protecting critical infrastructure from cyber attacks

34

How to build a world class infoSec workforce

36

Protecting the enterprise in a world of hackers

38

The every-day life of Australian information security practitioners

40

TechTime - the latest news and products

43

Editor’s Book Review

48

8

36 12 38 15

Page 4 - Safe Cities Page 32

46 26

Page 12 - A new frontier for the Page 38 of terrorism globalisation

OUR NETWORK OUR NETWORK Like us on Facebook and follow us on Like us on Facebook and follow us on Twitter and LinkedIn. We post about new Twitter and LinkedIn. We post about new issue releases, feature interviews, issue releases, feature interviews,

CONNECT CONNECT WITH WITH US US

3

Page 32 - Protecting the enterprise Page 44 of hackers in a world

events and other topical discussions. events and other topical discussions.

www.facebook.com/apsmagazine www.facebook.com/apsmagazine www.twitter.com/apsmagazine www.twitter.com/apsmagazine www.linkedin.com/groups/Asia-Pacificwww.linkedin.com/groups/Asia-PacificSecurity-Magazine-3378566/about Security-Magazine-3378566/about

Correspondents* & Contributors

www.youtube.com/user/MySecurityAustralia www.youtube.com/user/MySecurityAustralia

www.asiapacificsecuritymagazine.com www.asiapacificsecuritymagazine.com

Eric Flis

Anooshe Aisha Mushtaq

John Kendall

Tony Campbell*

Also with:

www.drasticnews.com www.chiefit.me www.drasticnews.com www.asiapacificsecuritymagazine.com

Jane Embury Terry Flanders

|

Peter L. Lacey

|

www.youtube.com/user/ MySecurityAustralia www.youtube.com/user/ MySecurityAustralia |

|

www.cctvbuyersguide.com www.cctvbuyersguide.com

4 | Australian Security Magazine 4 | Chief IT

Benn Alp

Naomi Oakley*

Sarosh Bana*

Steve Beards

Shannon Sedgwick

Dr Jodie Siganto

Editor's Desk

New and complex non-geographic security threats in cyberspace and space will be an important part of our future security environment. The cyber threat to Australia is growing.

I

- Australia’s Defence White Paper 2016

t was only in 2011 that reforms and initiatives were promised in support of the National Digital Economy Strategy, which aimed for Australia to be a leading digital economy by 2020. This has hardly been achieved, with even the NBN reported to be two-thirds short of its benchmark construction timetable. The subsequent cyber and digital economy policy was to provide an integrated policy framework to enable Australia to realise the benefits of the digital age—including security, telework, skills and encouraging innovation.

Fast forward to 2016, the Defence White Paper ensures, “Maintaining Australia’s technological edge and capability superiority over potential adversaries is an essential element of our strategic planning. The capability superiority that Australia has traditionally maintained in the wider region will be challenged by military modernisation. Over the next 20 years a larger number of regional forces will be able to operate at greater range and with more precision than ever before. The growth in the capability of China’s military forces is the most significant example of regional military modernisation, but other countries are also undertaking extensive modernisation programs. Cyber attacks are a real and present threat to the ADF’s warfighting ability as well as to other government agencies and other sectors of Australia’s economy and critical infrastructure.

The Defence White Paper sets out a needed workforce of around 1,200 new positions in areas critical to Defence’s future capability, including intelligence, cyber security and space-based capabilities. Cyber threats also have impacts well beyond Defence, with the potential to

attack other Australian government agencies, all sectors of Australia’s economy and critical infrastructure and, in the case of state actors, conduct state-based espionage including against Australian defence industry. The Australian Signals Directorate detected over 1,200 cyber security incidents in 2015, including attacks on government agencies and non-government sectors.

Australian defence industry was one of the key non-government sectors targeted in that period, along with energy, banking and financial services, communications and transport. Cyber attacks also threaten Australia’s secure access to the global communications system which is critical to Australia’s prosperity.

State and non-state actors now have ready access to highly capable and technologically advanced tools to target others through internetconnected systems and we are seeing greater use of offensive cyber operations. This trend is likely to continue.

Tobias Feakin, director of the International Cyber Policy Centre at the Australian Strategic Policy Institute in Canberra has confirmed, “Whenever you see island-dispute issues flare up you also see cyber activities spike as well,” he said. “If it is being used in coordination with the prodding that the Chinese do in a physical way, it surely shows you see a strategic advantage in the use of that power.”

There is also an issue of dated networks with the smaller economies of Southeast Asia vulnerable to hacks, given a lack of spending on cyber defense by some countries that rely on remittances from thousands of their citizens working overseas to propel growth, and a reluctance to report breaches of government

security. A recent FireEye Inc. report claims that Southeast Asian governments and companies are 45 percent more likely to be targeted than the average for the rest of the world. While President Xi Jinping agreed last month with President Barack Obama to broad principles to stop the theft of corporate secrets, the yet-to-be-developed rules will only cover the U.S. and China and won’t extend to traditional intelligence collection.

Advanced persistent threat (APT) cyber actors are one of the biggest challenges for the region. Leading companies that do business in the energy, telecommunications, hightech, finance, and transportation sectors are targets of APT groups.

The FireEye Report describes malware is being detected at commercial and government entities across Singapore, Malaysia, Thailand, Vietnam, Philippines, Indonesia, and Brunei and advanced threat groups are behind many of these attacks and have unique motives in this region. As political and military tensions continue to increase, the cyber security domain is going to be tested like never before – so best to buckle up! And on that note, as always, we provide some thought provoking material and there is so much more to touch on.

Stay tuned with us as we continue to explore, educate, entertain and most importantly, engage.

Yours sincerely, Chris Cubbage CPP, RSecP, GAICD Executive Editor

....with David Shearer

CEO, (ISC)²‘s Global Information Security Workforce

Back in April 2015, (ISC)²‘s Global Information Security Workforce Study foretold of a massive shortfall in the global information security workforce, predicted to reach dire proportions by 2020. The deficit of over 1.5 million professionals is in addition to staff that will be hired at the forecast rate of recruitment, pitching this looming catastrophe as one that demands a global, unified solution. (ISC)² CEO, David Shearer, has big plans for his organisation over the coming years, strategies that he hopes will begin to address this untenable situation. His call to action is bigger than any individual company or country: for the sake of everyone, information security professionals the world over need to coordinate, communicate, collaborate and spread the word that security needs help. Only by bringing new people into the industry are we ever going to beat cybercrime and make the Internet a safe place to work and play.

(ISC)² (the abbreviation of International Information System Security Certification Consortium) is a global leader in cyber security education and certification, operating as a notfor-profit in 160 countries around the world. It is headquartered in the United States, with branch offices in Arlington, Virginia; London, Hong Kong, Tokyo and an authorised agency in Beijing.

The organisation of best known for running the professional certification known as CISSP, however, there is a lot more to (ISC)² than first meets the eye. Running seven of the most widely recognised and accepted professional certifications in the industry, (ISC)² is the single largest members’ community of information security professionals, with over 110,000 members.

The company was formed in 1989 as a collaboration between a collective of US companies wishing to standardise the way information security professionals were certified.

The approach was innovative and highly desirable to both the industry and individuals and set the standard for what has become an enormous success. After 6 ½ years steering the (ISC)² ship, CEO Hord Tipton decided to retire and hand the helm to his second in command, David Shearer.

Shearer had been Tipton’s COO for the previous two years, however, they’d been friends and colleagues for many years prior, so passing control to Shearer was an easy decision.

David believes his long service in the US public sector was the best preparation he could have had to ready him for the challenges of running the world’s biggest InfoSec certification

6 | Chief IT

organisation. His career spanned a variety of government agencies, working with diverse security environments such as maritime law enforcement, national critical infrastructure, and food safety. Throughout his tenure in government, each and every engagement came with its own InfoSec challenges, which is why Shearer believes the move into information security full time was such a natural progression.

Taking over as CEO was still a daunting prospect. He was replacing the visionary, Tipton, who as a retiring chief executive, was leaving a legacy where the, “vision and mission transcends the role of CEO,” Shearer admitted. Shearer’s goal is not to fundamentally change (ISC)², instead he plans to build on the solid foundation Tipton laid down and, “Add more value to the membership, delegate more responsibility to regional offices and interact better with individual members.”

Shearer sees the new services he is introducing for members, such as the innovative Threat Central, as the beginning of the transformation of (ISC)² into a more agile and comprehensive members’

organisation. “Members should expect to see many richer CPE opportunities and ways to interact with (ISC)² at the organisational level and individual level to further the professionalism of the information security marketplace.”

Shearer’s biggest challenge to date was making sure he hired the right COO to assist him. “It’s hard to find just the right person that will allow me to get out of the day-to-day detail of running a company.” Luckily the hunt is over and Shearer is extremely happy with his appointment in Wesley Simpson and the rest of his executive team.

Shearer suggested that an initial goal he set himself is to listen to members and industry and try and address some of the negative comments he’s heard or read about (ISC)² and CISSP over the past 12 months. He admits that the information security industry is one of the most forthright communities in speaking their mind, so he’s not surprised that within a body of 110,000 members, some are not entirely happy. However, he acknowledges that there are issues, such as industry generally using CISSP as a hiring

benchmark rather than making sure they select the most appropriate certification for the job role being advertised; more education is needed within the hiring community to help them understand what’s appropriate, when it’s appropriate and the best approach to hiring information security professionals. “When you look across your security program,” Shearer admitted, “not everyone needs to be CISSP.” (ISC)² developed a foundation certification in information security aimed at new entrants into the industry that is appropriate for those who don’t have the five years of experience needed to become a CISSP. Also, keeping the portfolio up-to-date with new and relevant courses, such as their recently launched certification in cloud services security, shows commitment to keeping the company relevant and up to date, “They [Cloud Security Alliance] do the research and we provide the certification.

It’s a perfect partnership,” said Shearer. Shearer is putting a lot of effort into promoting (ISC)²’s Associate Program and is also laying the foundation for a Global Academic Program that will create a pipeline from schools, through further education and into industry for information security professionals.

All that aside, Shearer admits that the challenge keeping him up at night is how he addresses the looming workforce deficit. He says, “The average age of an InfoSec worker is 42 years old, with only 10% of the workforce being women.

These are extremely concerning statistics, since a predominantly male, retiring workforce will see us all under even more pressure over the next ten years.” He says (ISC)² is committed through its community and social outreach programs, academic partnerships and associate program, to build the pipeline of people coming into the industry all the way from junior school through university and into industry. Only by developing an interest in cyber security at a young age can we expect to create the pipeline of new entrants coming into the industry that we need.

When asked about the state of information security in Australia, Shearer admitted that infosec readiness across the world has taken a hit over the past few years. This problem is much exacerbated by the skills shortage, since the existing information security professionals are continually fighting fires rather than having time to look strategically at how the business should secure its future. “We are burning our guys out, while the threat grows ever stronger. The time taken for businesses to recover from incidents is increasing,

7 | Chief IT

(ISC)² is committed through its community and social outreach programs, academic partnerships and associate program, to build the pipeline of people coming into the industry all the way from junior school through university and into industry. Only by developing an interest in cyber security at a young age can we expect to create the pipeline of new entrants coming into the industry that we need.

so we simply can’t ignore the fact that we need more people.” Australia has suffered some negative press recently related to our national cyber security readiness, however, Shearer suggests that we are seeing the same pattern at home that he’s seen in every other jurisdiction he’s travelled to in 2015.

Industry can’t keep up. Shearer admitted that he thinks Australia is very forward thinking and he’s been impressed with what he’s seen and heard on his two trips down under in the past 12 months.

He sees Australia as becoming a global leader in the InfoSec space in the not too distant future and (ISC)² will do everything it can, collaborating with government and professional bodies, such as the Australian Information Security Association

(AISA), to make this happen.

Shearer rounded up the conversation with a discussion about his own Big hairy audacious goal. He wants to empower local membership chapters to reach out to communities, via their social outreach programmes Safe and Secure Online (SSO) for the school children and SSO for Seniors, to raise more awareness of cyber issues.

Over the coming few years, members will see the launch of Discussion Central, a community forum that he envisages will become the most important online community for the global information security workforce. His call to action is for everyone in security today to help raise awareness of security issues with everyone we interact with, since the threats are growing and our parents, children, friends, family and livelihood will all depend on us getting better at defending ourselves.

2nd annual

SECUREaustralia 2016 15-17 March 2016 I Powerhouse Museum Sydney I Australia

Building organisational resilience to terrorism and critical security breaches Delivering key security experts including:

Johnnie Müller Head of Security Copenhagen International Airport

Darren Kane Chief Security Officer NBN Co

Dr. John Moss National Manager Operational Intelligence Australian Crime Commission

Neil Gaughan National Manager Counter Terrorism Australian Federal Police

Jason Brown National Security Director Thales

Frank Colley First Assistant Secretary Security and Vetting Service (CSO) Department of Defence

Sue Max Trent Burnard General Manager Event Security Lead & Venue Management Origin Energy ANZ Stadium

Mike Whitelaw General Manager, Critical Infrastructure & Security NSW Roads & Maritime Services

Craig Sheridan Former Superintendent Commander State Planning Unit, Major Events & Incidents Group NSW Police

Andre Bertrand Head of IT Risk and Security SEEK

Kate Drews Market Leader Property and Buildings - Defence, Aviation and Transport Security GHD

Claude Colasante Director Intelligence Australian Transaction Reports and Analysis Centre

Sean Haran National Security Manager Startrack

Dai Hockaday Business Continuity Manager Sydney Water

John Ferguson Assistant General Manager Operations and Sustainability Sydney Olympic Park Authority

Wayne Ronaldson, Co-owner, Riskoffensive Paul Burrow, Head of Customer eTrust and Change, The Information Security Office, ANZ Mathew Curtis, Chair, Australasian Council of Security Professionals Phil Kowalick, President, Australian Institute of Professional Intelligence Officers Michele Grossman, Director, Centre for Cultural Diversity and Wellbeing, Victoria University Mike Davies, Research Leader, Cyber Assurance and Operations, Defence Science and Technology Organisation

Luke Schibeci, Manager Safety Risk & Environment, Sydney Cricket & Sports Ground Trust Mark Stewart, Professor, University of Newcastle Julian Droogan, Senior Lecturer, Department of Policing, Intelligence and Counter Terrorism, Macquarie University Saso Virag, Security Architect, NEC Australia Don Williams, Advisory Board Member, Australia Security Research Centre Wayne Miller, Community Resilience Unit, VIC Department of Premier and Cabinet

Addressing the key challenges for today’s security leaders:

PLUS! Full day in-depth learning sessions on Thursday 17 March

Keeping up to date with the evolving threat environment and the challenges it brings Improving public – private cooperation to achieve better security outcomes for all Building cyber protection capabilities to detect and defend against cyber threats Creating risk mitigating strategies to improve security for critical infrastructure Developing a security culture and practices in an organisation in order to maximise resilience capabilities Reducing safety and security risks by improving community engagement strategies Addressing specific security approaches for complex mass gathering events and iconic buildings

In-depth Learning Session A:

Enhancing organisational security through technological innovation and strategic risk partnerships In-depth Learning Session B:

Tackling the enterprise cyber threat by developing information security strategies and capabilities

Download the conference brochure at www.questevents.com.au

Supporting bodies:

Media partners:

Register TODAY!

8 | Chief IT

+61 (0)2 9977 0565

Organised by:

+61 (0)2 9977 0567

info@questevents.com.au

www.questevents.com.au

PRESENTING THE 4TH ANNUAL

Police Technology Forum Innovation, Leadership, Design

22 – 23 March 2016 | Hyatt Hotel, Canberra PRESENTATIONS FROM: Assistant Commissioner Pierre Perron, Chief Information Officer, Royal Canadian Mounted Police Superintendent Jevon McSkimming, Director Mobility and Innovation, New Zealand Police Commissioner Ian Stewart, Queensland Police Assistant Commissioner Doug Fryer APM, Road Policing Command, Victoria Police Assistant Commissioner Richard Cowling, Planning and Development, Tasmania Police Greg Bouwmeester, General Manager Solutions, Motorola Solutions David Dennis, Senior Business Development Manager, Hexagon Safety and Infrastructure John Labou, Chief information Officer, Northern Territory Police, Fire and Emergency Services Lee Walton, Chief Information Officer, CrimTrac Professor Clive Williams MG, Visiting Fellow Strategic Defence Studies Centre, Australian National University Mark Skidmore AM, Director Aviation Safety, Civil Aviation Safety Authority

GOLD SPONSOR:

PLATINUM SPONSOR:

Dr Adam Molnar, Lecturer in Criminology, Deakin University, Board Member, Australian Privacy Foundation CONFERENCE SUPPORTERS:

MEDIA PARTNERS:

www.informa.com.au/ptech16 9 | Chief IT

LUNCH SPONSOR:

COFFEE CART SPONSOR:

DISASTER &

EMERGENCY

MANAGEMENT

Australian & New Zealand

Disaster and Emergency Management Conference 30 - 31 May 2016 I Jupiters Hotel, Gold Coast

anzdmc.com.au The Conference theme ‘EARTH, FIRE and RAIN’ will continue to examine issues that impact preparedness, resilience, response and capability.

The program will provide all participants with an opportunity to contribute, learn and network with peers. It will examine the lessons learnt from recent national and international events and provide a comprehensive forum to examine the expertise, competencies and systems relating to our preparedness and response.

The Conference Program will include an extensive range of topics with Keynotes, Concurrent Sessions, Case Studies, Panel Discussions and Poster Presentations.

TOPICS WILL INCLUDE:

• Consequence Management - from Preparation to Business Continuity

• International Response to Disasters

• Crisis Leadership

• The Recovery Process

• Psycho-Social Implications of Disaster Management

• Understanding and Enhancing Resilience

• Emerging Technology and Capability Needs

• Volunteers in Emergencies

• Urban Search and Rescue

bushfire&natural HAZARDS CRC

10 | Chief IT

Ju 1 pi Ju te n rs e 2 ,G 0 ol 16 d Co as t

The 2016 Australian & New Zealand Search and Rescue Conference (SAR16) will continue to provide a platform of discussion that began in 2015 for the Search and Rescue Community. The Conference aims to tackle the issues and challenges while continuing the support of professional development in new training, techniques and requirements of Search and Rescue.

The Committee will design the program to cover a range of topics varying from Water to Land to Air and Mining SAR missions. As the only trans-tasman multi-sector SAR Conference, this event allows the chance for all organisations and SAR workers to come together and continue our understanding of development in the SAR sector.

CONFERENCE FORUMS INCLUDE: 1. Technology and Operations How are advancements in technology changing the way SAR operations are conducted?

2. Training How do we ensure that people are appropriately trained and have the right skills for all different aspects of SAR? 3. Organisation How do we enhance the interconnectedness between multiple SAR agencies to coordinate the most effective SAR response?

4. Working with Stakeholders Lost Person Behaviour (Mental Health), Crisis Management and Communication Strategies

www.sar.anzdmc.com.au 11 | Chief IT

12 | Chief IT

13 | Chief IT

Channels Forum

SPECIAL FEATURE

By Chris Cubbage, Executive Editor

Security tops agenda for ‘Innovation & Technology’ channels Canalys Channel Partner’s Forum APAC, Bali Indonesia, Nov 2015

Canalys’ events have taken the Channel market by storm, quickly expanding to deliver countless opportunities for technology and certified channel professionals and senior Canalys analysts to participate in a variety of industry and vendor events. This includes trade shows, business strategy sessions, sales meetings and press conferences.

I met with senior executives from AMD, Cisco, HP, Dell, Zebra and Delta to learn about the latest in technology developments, business activities and what 2016 holds for each of these tech giants.

Canalys Market Review and Outlook Canalys CEO, Steve Brazier, opened the event with a broad market analysis, highlighting some

16 | Australian Security Magazine For 14 | Chief IT

of the big changes that are affecting the global workforce. In particular, Brazier explained that an increasingly younger workforce demographic is building over the next decade and changes are occurring in the workplace offering the capability for staff to work from anywhere and everywhere. These changes will pose their own issues and risks for tomorrow’s businesses, where the workforce doesn’t have the same level of collective experience it has today and is not collocated in one place, hence no face-toface communications.

In 2015 the titans of the commodity and consumer technology industry have war chests collectively totalling more than $500B in cash, with Apple holding about 40 percent, while Internet cloud services, Amazon and Salesforce, together lost over $3B. There were only 15

technology IPOs throughout the entire year, which is the lowest number of new companies floating on the stock market since 2009.

Software-as-a-service is the new reality for application provision and Infrastructure-as-aservice is forecast to reach an incredible $35B in 2016.

The significant drop in the oil price in 2015 (and continuing through to January 2016) has contributed to destabilised currencies and caused disparities in price controls throughout the international technology market. Canalys’ Shanghai 2014 forum had a distinct focus on China, however, this year’s forum had shifted focus to India as the strongest performing technology market and strongest performing economy. As regulation remains a barrier, the market is expected to remain very unstable

Information presented in Cyber TechTime is provided by the relevant

information on 2016 Channel Forums visit www.canalyschannelsforum.com advertiser and are not necessarily the views of My Security Media

Channels Forum

IT security Worldwide, share of units (%) by category, 2019

issue for business that it’s clear no one really yet understands what it means for the APAC region and the channel.

Shifting to Datacentres The storage and servers market has shifted from on-premise computing to being provisioned out of mega data centres. By the end of 2015, nearly half of the entire server and storage market had moved to datacentres, with reports of component shortages due to the speed of data centre growth, appearing at the tail end of

the year. The ‘Open compute’ project, run by Facebook, is a prime example of this shift to innovative new way of operating, with pressure increasingly coming from end users rather than suppliers. Trends into 2016/2017 are for growth in hyper-scale data centres and hyperconverged infrastructure. Though still relatively nascent, this market is growing quickly, offering data centre scalability.

throughout 2016, with India or China (or both) having the greatest influence in the APAC region.

APAC is an extremely complex market and, as such, the channel network is critical to success. For example, in 2015, Lenovo invested $760M across all of its channels, including the distribution of 90 million units per quarter in China alone. As Lenovo’s CEO, Roderick Lappin, explained, “[it is] not uncommon for some individuals to be carrying up to four devices when mobile” and “with Cloud mobility analytics and big data, business is going to see more disruption in the next 5 years than it has in the last 50 years.”

Valerie Beaulieu, Microsoft’s General Manager SMS&P APAC, outlined the company’s mission is getting back to their core values, allowing Microsoft to remain in a unique position to link individuals to organisations and organisations to organisations across the globe.

Beaulieu suggested developing wearables, sensors, mobile devices and investing in the subsequent user experience is key to market success, with Microsoft’s own strategy of ‘mobile first, cloud first’, driving their own strategy. Attesting to their success, Beaulieu said that Microsoft’s own cloud computing platform, Microsoft Azure, is growing by 250% per year.

Security Focus The forum’s primary theme was security. Across the channel network, security was a top issue for all businesses, with strong buying behaviour for security infrastructure reported for APAC across all sectors. There is a clear shortage of cyber security skills, especially in our “connect it - hack it” environment, and this trend is set to continue. Cyber warfare is also an issue that was mooted, however, this is such a nascent

15 | Chief IT

Australian Security Magazine For information on 2016 Channel Forums visit www.canalyschannelsforum.com

| 17

Channels Forum - latest news and products Cyber TechTime

DELL’S doing the heavy lifting Cheryl Cook, VP Global Channels & Alliances The Canalys event came hot on the heels of Dell’s fifth annual customer conference, Dell World, in Austin, Texas, where Dell executives made a number of important program and investment announcements.

Cheryl Cook, VP Global Channels & Alliances briefed me on the latest developments. “Our Channel partner program, globally, continues to experience strong growth and geographically balanced across the market, so all regions and all lines of business. We measure our PC core appliance business, as well as our enterprise datacentre business, which includes our servers, storage and networking, as well as our software business. We are experiencing record levels of engagement, as measured by deal registration – which, for me, is a proxy to the market activity level. In our most recent quarter, we continued to set the bar on record levels of deal registration, with over 200,000. That feels very positive and, as a consequence, when growth rates are that positive, we are continuing to pay record level rebates and incentives to the channel partners. The global revenues for the channel business with Dell exceed well over 40% and just two years ago that was 30%.

Channel partners are a now major part of Dell’s growth strategy.

Another area of expansion is Tier 2 distribution that allows greater stock and sell capabilities to partners around the region, opening access to new partners that otherwise may not have been within reach. The Future Ready Channel is aimed at delivering enablement and capabilities of our partners while keeping it relatively simple and straightforward. Our channel program is still young, only eight years old, and a lot of the feedback is about training, certification and competition around our products.

For software, we have expanded and delivered more in the form of data protection, network security, and big data analytics. We also announced, for the first time, a solutions track for competencies. Everyone wants to have much higher, more relevant discussions around workloads and business outcomes than merely just integrating silos of information and infrastructure together. We worked jointly with our enterprise product team, who worked with partners, like Microsoft, VMware and took an approach for an endgame basis, encompassing blueprints and reference architectures. There are now over 1,300 engineered systems and appliances with over 21 reference architectures

18 | Australian SecurityFor Magazine information 16 | Chief IT

and whitepapers that can be activated for their market or client.

We set up labs to test and certify configurations against known use cases and user levels so that, levels. So with confidence, we can deliver to our partners configurations and reference architectures that are inclusive of software management, and deployment services, in addition to the infrastructure and the software, so that time to revenue can be shortened for them to focus on working with the customers. So, the OEM (Original Equipment Manufacturer) between Dell and Microsoft or Dell and VMware has already done a lot of the heavy lifting in meeting performance levels, whether it be to a small population of 50 or less, or up to into the hundreds and thousands, certifying the channel partners against those user cases. Whether it is unified communications and collaboration, virtual desktop, virtualisation or big data analytics, we are driving to a ‘solutions’ conversation.

Like with cloud certifications, our partners are able to drive private, on-premise and hybrid deployments in Microsoft Cloud and cloud platform systems that are tailored for very highend enterprise workloads, as well as smaller enterprise workloads.

We have also announced new incentives and rebates, as of February 2016, and to be supported by new branding for our partners. We have enjoyed 11 consecutive quarters of shared gains, globally, in the PC market, and we see the market consolidating between Dell, Lenovo and HP and we want to maintain our dominant position. However, we recognise this growth is going to have to come from our customers and we want to reward our partners more handsomely because we know it is expensive to operate in this business, but reward them when aligned to our own strategy for growth. We are doing the same in our datacentre offerings and

approaching number one in the server business in Asia, and already number one in North and Latin America. It is about maintaining momentum and keeping the incentives driving growth.

We have had, for many years, a financing capability with Dell Financial Services, which assists with end-customer leasing options. In the last 12 months, we have introduced Dell Global Financial Solutions, aimed at partners and smaller companies to give them access to capital and increased credit and extended payment terms that reduce the burden of cash flow to allow growth. It has been phenomenally successful and in the first year of operation we financed over US$5 billion, with over 2,000 partners. We will be continuing this program as it seems to be meeting a solid business need.

Included are flexible payment alternatives, such that you can pay as you grow, or a utility billing model offering other flexible options. Many partners are feeling the pressure of business model changes, with this flexibility suiting these changing needs to resource cash flow. As well as enablement around our solutions, we are providing the servicing and financing which are key pillars.

Finally, we have introduced a ‘services competency before deployment’ model for partners who want to deliver some of our services, which traditionally have only been delivered by Dell. So, we have opened up a certification program, launched in over 120 countries, which creates the opportunity to manage an entire end-to-end solution for customers and co-deliver and compliment our services. There is a lot of energy and excitement in the business and despite the pressures and fluctuation in the market, we are all feeling it is creating its own set of opportunities for our partners too, by adapting and modifying their business models, they will continue to meet customer needs across multiple facets.

Information presented in Cyber TechTime is provided by the relevant

on 2016 Channel Forums visit www.canalyschannelsforum.com advertiser and are not necessarily the views of My Security Media

Channels Forum National

Hewlett Packard’s customers have become sensitive to security Chris Ogburn, Vice President Worldwide Channel Marketing Chris Ogburn has channel marketing responsibilities for Hewlett Packard Enterprise (HPE). “Part of the portfolio we are focused on is around the infrastructure side of the business, servers, storage, networking, converging systems and devices and services in supporting cloud and hybrid cloud. We have also picked up responsibility with the restructure for software.

So, we’re fresh in building competencies in our team for IT management, big data and security.

With so many elements, it is a multipronged approach. For example, with a data centre build out, it isn’t new but has become more pronounced over time and this is reflected in changes in product sets. There is an entire organisation within HP that is solely focused on developing and building scale-out server architectures, specifically for the increasingly high demand for data centres, which is a change from a few years ago. Alongside, we have had a need to build the capacity of our service providers through our channel programs. We are not only selling them the infrastructure they’re using to host and support and drive workloads, but also, at a country level, we’re partnering and working with customers to look at opportunities where they want public cloud capability using a local service provider – especially so, with growing data concerns in country and not wanting to have data moving outside of the jurisdiction.

Looking at HPE, over 70 percent of our revenues come from our channel partners and in Asia Pacific it is well over 80 percent. So, the vast majority of what we do is going through our channel partners, with the remainder being typically large-scale global service providers, or large footprints within government, financial services or telecommunications, who prefer to deal with us directly.

In 2015, HPE signed a definitive agreement to divest the network security business, TippingPoint, to Trend Micro. TippingPoint was an important component of HPE’s security offering, however, we decided to partner in network security as opposed to own it, so they can invest in other areas of their security portfolio. The final deal is expected in early 2016.

“From our discussions and round tables with customers, security has become the top most priority they have in business today, managing the data security element from the device to the datacentre. Customers have become sensitive to security-by-design in

17 | Chief IT

our innovations, because they recognise its importance. We have also improved, as a result, with major strides in device-level security and the way we think about managing security from a datacentre perspective. Security is so broad and extends right across our portfolio, so it’s an excellent tie-in when we think about the way our teams do product design and engineering, tying back to the investments made in security – it is now much better integrated.

For our big data analytics portfolio, the focus is on enabling decision making using the information you already have available, pulling it together and driving insight and action out of that insight. The theory is to have the ability to make very fast business decisions based not only on your internal information, but what else may be happening in real-time, such as social media. There are incredible tools that allow governments and companies to understand what is happening from a social perspective across myriad platforms, searching words and expressions and taking into account neutral, negative and positive sentiment. This analysis is used in conjunction with internal data to evaluate and surface business insight. Other aspects of the analytics portfolio include Vertica and Autonomy, so the source can be internal, supplier, or customer, as well as a wide range of private and social media databases. HP Vertica is a next-generation high-performance SQL analytics engine, available on-premise, in the cloud, or running on Hadoop. Queries will

“Looking at HPE, over 70 percent of our revenues come from our channel partners and in Asia Pacific it is well over 80 percent.” reportedly run 50-1,000 x faster than any data warehouse or database technology, running at petabyte-scale, with openness to using any BI or ETL tool, run as SQL on Hadoop, while leveraging scalable predictive analytics and a comprehensive library of built-in analytical functions.

Australian Security Magazine For information on 2016 Channel Forums visit www.canalyschannelsforum.com

| 19

Channels Forum

Cisco has security everywhere Pramodh Menon, Managing Director, Sales, Cisco Systems, India Pramodh Menon highlighted the architectural approach to Cisco’s ‘security everywhere’ theme. “Building on what Cisco has always believed: the network is a centre point of coordination for all security, as opposed to the conventional way we used to build and look at security, which was to build an endpoint product and fortify the perimeter. Those concepts are not valid anymore since, especially due to cloud, mobility and virtualisation, the definition of the perimeter has become void because you don’t know where the device is connected to the network” So, we have the concept of the network as a sensor, with some of that capability enabled in our products, such as TrustSec and NetFlow.

We also look at the network as a security enforcer, so once you see a breach, you can shut down the ports, offer segmentation, confining malware to one segment so that it can’t traverse the rest of the network. You can then determine who has been compromised and institute management so we can know how to deal with it. This was the initial role of

TrustSec, however, we now have a lot more added to it to ensure we have a very robust end-to-end architectural solution. It’s not just antivirus, malware protection or firewalls; it’s more of an overall architectural approach.

This plays to our strengths as most customers have a Cisco network, along with those other capabilities, therefore we can turn them on with most of our existing installations.

Overall, we are seeing a significant amount of customer spend, related to their security position being strengthened, which is a very important conversation to have with every enterprise customer. With the recent acquisition of Sourcefire we now have advanced malware detection, threat defence and the recently announced Lancope acquisition. The Lancope team will join the Cisco Security Business Group, led by David Goeckeler, senior vice president and general manager. Under the terms of this agreement, Cisco pays $452.5 million in cash and assumed equity awards, plus additional retention-based incentives, for Lancope employees who join Cisco. The

acquisition is expected to close in mid-2016, subject to customary closing conditions including regulatory review.

Anthony Stitt, Cisco Systems’ General Manager Security in Australia, highlights that Cisco offers the breadth and depth of a “security everywhere” approach, be it the endpoint or in the cloud. “Cisco changed its attitude to security a number of years ago and, seeing the way technology will be used by digital transformation, security could no longer be an add-on or afterthought. It needs to be far more central. What you’ve seen Cisco do over the years, is acquiring a number of organisations to fill or improve and develop the integrated products across the broader spectrum, such as the Cisco data centre and data collaboration strategy.”

The new AMD has more Commercial focus Vinay Sinha, Regional Director Enterprise Business, Asia Pacific Japan (APJ) Vinay Sinha enthusiastically introduced the new AMD. “We have a more commercial focus and over the last year, we achieved some key milestones. With a dedicated commercial organisation, AMD Pro is only for commercial enterprises, due to its longevity and increased warranty. We are now only certifying OEMs for AMD Pro.” “In terms of security, we have ARM Trust Zone, which is hard wired into the system at the CPU level.”

In contrast to fixed-function TPMs (Trusted Platform Module), TrustZone is a vastly more versatile mechanism and are freely programmable using a powerful generalpurpose CPU architecture. (Source: An Exploration of ARM TrustZone Technology) “Overall, you are seeing the market not as repeat as we’d want it to be, even, it is said, India is doing well but we are finding it is holding steady. There is some consolidation happening, so that means the pie is about 500,000 units (devices) a quarter and it has remained at that number, without deceleration, a trend that seems consistent across the APJ. However, the number of players has decreased, so there is more available from the same sized pie.

20 | Australian SecurityFor Magazine information 18 | Chief IT

“...over 500 customers over the last year across the APJ and 90-95 percent have welcomed us and stated they needed us back.”

With the currency markets as unstable as they have been, there has definitely been challenges, with some markets slumping and others spiking. Overall though, I would say it has been rather static. In the short term, that means we just need to be smart enough to grab the opportunities we are seeing in Thailand, the Philippines, India, Australia and New Zealand.

The other aspect that has changed for AMD is that we now have OEM backing and the commercial skillset to take these opportunities – the market has always welcomed competition and choice. The support and endorsement from customers has been overwhelming for

us and I met over 500 customers over the last year across the APJ and 90-95 percent have welcomed us and stated they needed us back.

There have been huge margins and little price pressure for competitors. The fact we have been so welcomed back also includes our performance, therefore the days of perceiving you have to pay for performance is being challenged. We can match the performance of leading brands at a lower price. When there is a monopolistic market, you will naturally see higher profit margins and we are near a third of some of our competitor’s margins. For example, we will match the performance of the HP A10 or A12 system and Dell or Lenovo i5 or i7, so you can compare the price and there is a saving of about $400 with zero compromise on performance, allowing customers to use that saving on other aspects of the system.”

on 2016 Channel Forums visit www.canalyschannelsforum.com

Channels Forum National

Digitalisation and supply chain intelligence Ryan Goh, Vice President of Sales and General Manager, Zebra Technologies APAC “Zebra was established in 1965, starting as a barcode printing company and manufacturer of specialised barcode printers. In 2014, Ryan Goh explains, “we acquired the enterprise business from Motorola (valued at $2B) and that part of the business consists of mobile computer handheld products, wireless LAN infrastructure and RFID computer and scanning devices.

So, it has been a year since we completed the transaction and it complimented our strategy in building a business model of enterprise asset intelligence or EAI. EAI is about reclassifying the three categories of sensing, analysing and action.

It is what we call ‘giving a digital voice to the physical world’. We provide the ability for assets to be tracked, converting them to a digital voice. In terms of parcel delivery, it allows the entire supply chain process to be optimised and the fastest route(s) to be selected, allowing an operational director to make decisions on the best way to get products to the consumer or customer.

We don’t use random serialisation, instead using barcodes to achieve the same thing, such as in tracking animal products. From the time an animal is born to the time when the meat is

delivered and displayed in the supermarket, it is tracked using a barcode. This barcode is tagged on the animal’s ear and its history is tracked, logged and analysed at every stage of delivery.

The key objective is food security, so we know and can immediately trace any food product back to its source. This provides intelligence into the entire supply chain and avoids a costly review if something goes wrong, allowing for an immediate response.

Increasingly, there are more and more customers using this technology. Using a cloud-based ring scanner, you can track assets in real time from anywhere. One major aspect is security and how 60% of enterprises are yet to step up into using cloud services: this is the major limitation perceived around security. What we do at Zebra is offer a mobility extension on our mobile devices, using Android as an operating platform.

The last two quarters in 2015 saw doubledigit growth and we think EAI is now at the point of crossing the chasm.

If you can create meaning from the data and show an impact, such as in a shopping mall, we can start to afford meaning to foot traffic, buying behaviour and effectiveness of promotions,

signage and product displays. Another example is our real-time location system, as used with the NFL in tracking players throughout the game with an RFID inserted in the back of the player’s jumpers. We can track where each player is, the speed they are running, including acceleration rates and total distance, offering quarter-to-quarter comparisons while making this all available for display on a tablet in real time. As the player moves, you see the outcome on screen, and can determine how each of the players is competing and working together. We are now tracking all of the NRL players, allowing far more insight into game assessments, review and team analysis.

Naturally, this technology is not limited only to sport science, as it has applications across all sectors. When our customers come to us, they ask how canwe help them transform their business, often most interested in how they can apply technology for better business outcomes.

Retail is our leading market and, in terms of countries, I would say Singapore is our leading country in deployments. We are quite bullish for 2016.

Zebra is listed on the US stock exchange.

R&D focus is on efficiencies Max Perez, Delta Energy Systems

“Delta was founded in 1971 and has grown to revenues of $7.5 billion in 2014 with R&D centres in Taiwan, China, Thailand, Japan, USA and Europe, with over 30,000 staff. Delta is the world’s largest vendor of power supplies and has three main pillars of business: power and electronics, energy management and smart green life.

The Mission Critical Infrastructure Solutions (MCIS) provides highly-reliable and efficient power management products and datacentre infrastructure solutions for continuity of mission critical operations. One solution is called InfraSuite, consisting of power systems, racks and accessories, as well as environmental management systems.

The R&D focus is on building energy efficient solutions for datacentres and we’re seeing gradual growth with operations in Australia over the last two years, having established a strong distribution channel partner with Avnet, one our largest channel partners. Our key target markets also include education and the security industry, such as CCTV systems.

About Canalys Canalys is an independent analyst company that strives to guide clients on the future of the technology industry and to think beyond the business models of the past. Canalys delivers smart market insights to IT, channel and service

19 | Chief IT

provider professionals around the world.

Canalys or their customer-driven analysis and consulting services empower businesses to make informed decisions and generate sales.

“We stake our reputation on the quality of our data, our innovative use of technology and our high level of customer service.”

SPECIAL MENTIONS Canalys Channel Partner Awards • Channel Partner of the Year 2015, Accel Frontline, India • Revenue growth partner 2015 - BIT Group, Malaysia • Innovation and Transformation Partner 2015 ACPL Systems, India • Cloud Software Partner 2015 Data3, Australia • Cloud: Managed Services Partner 2015, Microwear alignment, Hong Kong • Infrastructure Growth Partner 2015 ProNet, Philippines

Australian Security Magazine For information on 2016 Channel Forums visit www.canalyschannelsforum.com

| 21

2016 Cyber Security Predictions

Palo Alto Networks’ 6 cybersecurity predictions for Asia Pacific in 2016 1. Ransomware Ransomware will continue to evolve its methods of propagation, evasion techniques and continue to hide its communication and the targets it seeks. As reported by the Cyber Threat Alliance, ransomware has been very lucrative for cyber criminals to launch campaigns and in a short period of time derive large revenue streams. Today, the value of credit card data is so low compared to ransomware, where higher value can be extracted from more victims.

Research by the Cyber Treat Alliance reported that CryptoWall v3, generated more than $325 million for the group behind it. This will drive further versions of ransomware style attacks to be released allowing more cyber criminals to extort users to pay the ransom to get the decryption key for their data. We predict to see this crossing over to other platforms, such as OS X and mobile operating systems.

2. Sharing of threat intelligence Efforts have been around for years to share threat intelligence in some verticals and we predict that 2016 will mark a year where the private sector and security vendors look to share more of this than they ever have in Asia Pacific. Today, many adversaries often write one piece of malware and send it to multiple organisations, with only minor changes made to make it undetectable. However, if we, as a community, can force cyber adversaries to create multiple unique attacks each time, it will force their costs to go up. And if we can share the information, the defender costs go down. The benefits grow exponentially if we automate this process whereby organisations do this in real time, whilst preventing the attacks. By knowing what kinds of actors are targeting you, the tools that they have available and the tactics they employ allows organisations to defend their networks more effectively.

Although the debate continues on how effective these regulations will be, Asian governments should look to foster the sharing of threat intelligence and organisations should think about how they can share in their vertical and go cross vertical in their efforts. We should ensure

22 | Australian Security Magazine 20 | Chief IT

that there are responsible privacy protections in place, for the purpose of identifying, preventing, mitigating and responding to cyber threats, vulnerabilities, and malicious campaigns. The faster organisations can share this information, the better we can serve to protect each other and push the cost back to the attackers.

We expect this trend to continue, as more organisations begin to realise the benefits of sharing knowledge as a means to unify efforts to fight against cyber intrusions in Asia Pacific.

3. Secondary victim attacks More and more we are seeing that when we know the motive of an attack, there is usually a secondary victim. The 2015 Verizon Data Breach Report, highlighted that adversaries are using third-party websites to deliver their attacks. This often can mean that the person or organisation that experiences the initial breach isn’t the real target, but rather a pawn in a bigger attack.

From the perspective of an attacker, this allows them to take advantage of trust and use the resources of another company for their gain.

The most common method seen in Asia Pacific has been “watering hole attacks”, where an organisation’s website is infected with exploit code to try and infect visitors of their site. We predict that this will continue to rise with more reported incidents coming to light in 2016.

4. Trust in our security models Over the past few years, cyber attacks have escalated and gotten more aggressive and successful. Not only have we seen it become easier and cheaper to launch successful attacks, it has eroded our digital trust in online systems. That trust also extends itself to the failure of legacy security architectures, due not only to an outdated assumption that everything on the inside of an organisation’s network can be trusted, but also the inability of legacy countermeasures to provide adequate visibility, control, and protection.

We expect to see more organisations adopting new security models, such as “Zero Trust” where it is intended to remedy the deficiencies with perimeter-centric strategies and the legacy devices and technologies used to implement them. It does this by promoting “never trust, always verify” as its guiding principle.

This differs substantially from conventional security models that operate on the basis of “trust but verify.” essential security capabilities are deployed in a way that provides policy enforcement and protection for all users, devices,

* For more information on these articles in Security Survey Summary check out our website at www.australiansecuritymagazine.com.au

applications and the communications traffic between them, regardless of their location. We expect this will continue across Asia Pacific in 2016.

5. Attacking the Internet of Things Whole new categories of digital device are getting connected to the Internet, from domestic appliances to home security and the list goes on. Gartner predicts the number of connected things will rise from 6.5 billion in 2015 to almost 21 billion by 2020, growing by a staggering 5.5 million “things” each day. This will continue to accelerate in 2016 but sadly we see no reason why these things won’t become a target for cybercrime.

During this year we have seen some evidence of this emerging trend, like attacks on cars, smart rifles and many more shown at Blackhat USA in August this year. We don’t expect to see millions of devices compromised in 2016 across Asia Pacific, but we should be prepared to see more attacks and proofs of concepts trying to exploit these types of devices.

6. Cyber crime legislation Asia Pacific has often operated under very lax regulations when it comes to cybersecurity. It is a global issue, however regulations to safeguard businesses and consumers are still evolving across the world. It’s unsurprising that the USA is taking the lead on this front, given the number of high profile attacks reported to have targeted US firms in recent years. This has resulted in cybersecurity becoming a focus for policy, most recently seeing the introduction of The Cybersecurity Information Sharing Act (CISA), which aims to help US companies to work with their government to combat hackers. Similarly, the European Union has also laid out 14 actions to improve cyber security readiness, along with a policy on Critical Information Infrastructure Protection (CIIP), which aims to strengthen the security and resilience of vital ICT infrastructure by supporting high level of preparedness, security and resilience capabilities, at a national and EU level.

We expect that will see a significant shift in the mindset of governments and regulators in Asia Pacific to take on an even more active role in protecting the Internet and safeguarding its users.

Cybercrime laws will be in discussion, and changes to out-dated cyber security standards will be mandated to bolster an improved stance on security.

Unisys predicts entirely new classes of cyberthreats will require fresh countermeasures in 2016.

Rogue intelligence officers, machinecontrolled physical attacks, and the rise of quantum computing will demand new approaches such as micro-segmentation and quantum encryption Following a year of damaging security incidents at organisations ranging from the U.S. Office of Personnel Management to the Ashley Madison web site, security experts at Unisys Corporation predict that leading security professionals around the world will adopt a new mindset in 2016, embracing advanced approaches such as microsegmentation to counter increasingly sophisticated attacks by cyber criminals.

“Corporate and government leaders understand that as their enterprises have grown beyond their four walls and threats have moved from concept to reality, their whole approach to security must change now,” said Tom Patterson, vice president of global security, Unisys. “In 2016, corporate leaders will take the actions needed to protect themselves in this new reality.”

Consequently, Patterson predicted the rise of a new security approach that embraces microsegmentation, which allows enterprises to easily and economically divide their physical networks into hundreds or thousands of logical micronetworks, or microsegments. Such an approach understands that adversaries will ultimately infiltrate an organization, but limits the damage they can do once they’re in, making the difference between a routine cyber incident and a business catastrophe.

Patterson predicted additional new developments in 2016, including new security threats from rogue intelligence officers; cyberattacks that result in physical destruction; and the rise of quantum computing threatening encryption-based defences.

21 | Chief IT

HID Global Looks Ahead at Top Trends for Secure Identity in 2016 •

•

•

Mobility and a growing focus on the user experience will be a strong focus for organisations Trusted digital identities will proliferate across increasingly connected environments for greater convenience, fueling opportunities to enhance productivity and drive compliance to security policies.

Privacy protection will continue to grow in importance, forcing organisations to improve best practices for preventing breaches and safeguarding identities, even after they’re stolen.

HID Global’s broad industry perspective has positioned the company to pinpoint five key developments that it believes will have the greatest impact during this year on identity and access management, citizen identification and the Internet of Things (IoT). “We’re watching several developing trends in the new year, including growing demand for a more mobilecentric and satisfying user experience that HID Global believes will be the primary driver for security technology innovation in 2016,” said Stefan Widing, HID Global President and CEO. “Customers will increasingly aspire to a comprehensive secure identity experience for their users that can provide the foundation for more flexible, adaptable solutions in a new era of interconnected digital identities and the Internet of Things.”

HID Global’s 2016 trends point to a more mobile and connected experience, ongoing advancements in privacy protection and broader adoption of best practices for solution deployment.

Allied Telesis Unveils Industry Trends and Predictions for 2016. The three key trending topics unveiled include Secure Enterprise SDN,Wireless and Security and the Internet of Things (IoT).

Software-Defined Networking – New methods of operating Enterprise networks will be seen in the market to deal with the increasingly diverse demands that are placed upon them. SoftwareDefined Networks, or SDN, which have largely been deployed in carrier networks and data centres, will begin to see increasing relevance in the Enterprise as application vendors begin to leverage the capabilities of SDN to simplify business processes and deliver value to the Enterprise.

C-level executives and technology managers will need to develop strategies for integrating SDN into their Enterprise networks, and with a strong emphasis on security.

Wireless – While 802.11ac technology may still be in the early stages of adoption and deployment, the focus on wireless will move away from technology and performance and increasingly focus on unified management using a cloudbased platform of an organisation’s infrastructure.

Application awareness and the ability to manage traffic on a per-flow basis will become increasingly important as organisations take a unified approach to connectivity. This is particularly relevant as the growth in mobile devices continues to increase while the deployment of fixed devices stagnates.

Security and IoT – The ever-increasing number of devices or “things” being connected throughout Smart Cities and across the “Internet of Things” will make embedded devices and machine-to-machine networks more attractive targets. Next-generation security for organisations that operate and manage embedded networks will become as important as, if not more important than, the security of the organisation’s Enterprise network.

Australian Security Magazine | 23

2016 - 2020 Cyber Attack Methods

Centrify’s Country Manager for Australia and New Zealand Lachlan McKenzie said 2015 breaches globally included high profile criminal and state-sponsored attacks. “Breaches involved millions of personnel records of government employees, tens of millions of records of insurance customers, and hundreds of millions of customer records from various other companies,” he said.

“Last year we even heard of a billion-dollar bank heist! Many of these companies had implemented advanced malware protection, next generation firewalls and delivered regular security training sessions for their employees. Yet the breaches continue.

“Australia and New Zealand are not protected from these sort of assaults by our remote locations in the world. In fact, we are more at risk than ever before because of our increasingly online economies.

Check Point software technologies is predicting that attacks on point of sale (PoS) terminals will increase in 2016.

With over seven billion credit cards in circulation worldwide, fraud in the retail sector is also likely to continue to rise, as cyber attackers bid to steal millions of identity and credit card records as well as other data and merchandise.

A 2015 report from digital security firm, Gemalto, estimates that one billion data records were compromised across 1,500 attacks last year.

More than half of these attacks involved the retail industry, with much of the focus on point-of-sale (PoS) systems.

Larger breaches in 2016 will be the result of custom malware that is designed to bypass even the most sophisticated security defenses. Giant retail corporations will be targeted, but startup companies will also be vulnerable to attacks because they don’t have as many resources to strengthen their defenses.

Methods of payment are also becoming more digital as consumers are increasingly using mobile devices to make purchases. Mobile PoS systems are beneficial for retailers, but can also put customer data at risk. Digital currencies like PayPal, Apple Pay, and Google Wallet can provide new attack surfaces for hackers to exploit.

24 | Australian Security Magazine 22 | Chief IT

Check Point advises retailers to add layers of security for stronger protection while also taking the time to teach their employees about proper use of PoS systems and learn the signs that tell when security might have been breached.

Consumers can also take precautions in order to minimise the impact of a data breach. In addition to staying aware of phishing attempts and malware-installing websites, shoppers should regularly monitor their accounts to flag any suspicious activity.

ATTACK TYPE 1

FireEye finds chinese APT group attacked Hong Kong media outlets.

FireEye has released the results of its research into a recent campaign carried out by a Chinese cyber threat group – referred to as “admin@338″ – targeting Hong Kong-based media organisations.

In August, the group sent spear phishing emails about newsworthy developments with malicious attachments to Hong Kong-based media organisations, including newspapers, radio, and television outlets. One email referenced the creation of a Christian civil society organization to coincide with the anniversary of the 2014 protests in Hong Kong known as the Umbrella Movement.

Another email referenced a Hong Kong University alumni organization that fears votes in a referendum to appoint a Vice-Chancellor will be co-opted by pro-Beijing interests.

The group employed malware called LOWBALL which abuses Dropbox, a legitimate cloud storage service, for command and control purposes. When FireEye researchers alerted Dropbox to the group’s activities, Dropbox promptly blocked the access token used by LOWBALL. In doing so, Dropbox disrupted the group’s command and control capabilities in all observed versions of the malware.

FireEye has observed targeted attacks by multiple Chinese threat groups on journalists at international and domestic media organisations in Asia. These attacks have often focused on Hong Kong-based media, particularly those that publish pro-democracy material. Journalists located in Taiwan, Southeast Asia, and elsewhere in the region have also been targeted.

“Journalists in Asia are routinely subject to these targeted cyber attacks. They are dependent on

information from many different sources, which makes them easy to target. The information journalists have and the identity of their sources can be valuable intelligence. Without adequate technological defenses, they make easy victims,” said Bryce Boland, chief technology officer for Asia Pacific at FireEye. FireEye has tracked admin@338’s activity since 2013. The group has largely targeted organisations involved in financial, economic, and trade policy. FireEye first observed the group targeting media outlets in April 2015.

ATTACK TYPE 2

Android.Bankosy gets updated to steal passwords sent through voice calls generated by 2FA systems.

In the last quarter of 2015, we observed an emerging trend among financial Trojans. An information-stealing Android threat (detected

by Symantec as Android.Bankosy) added functionality to its code to enable it to deceive two-factor authorization (2FA) systems that use voice calls.

What does two-factor authorization using voice calls involve? In a typical 2FA system, the second factor—normally a generated one-time passcode (OTP)—is sent to the user’s registered mobile number through SMS. In the past, we have seen several cases where the malware installed on the victim’s device snooped on or intercepted the incoming SMS containing the OTP. To improve the security of OTP delivery, some financial organisations started delivering OTP through voice calls instead of SMS. Of course, malware creators have already devised ways to take advantage of this development.

So how does Android.Bankosy take advantage of voice-based 2FA? Once the malware is installed on the victim’s device, it opens a back door, collects a list of system-specific information, and sends it to the command and control (C&C) server to register the device and then get a unique identifier for the infected device. If the registration is successful, it uses the received unique identifier to further communicate with the C&C server and receive commands.

ATTACK TYPE 3 Influx of fake Instagram profiles luring users to adult dating sites. Three fake Instagram profile variations used to earn scammers money through affiliate programs.

In recent months, Symantec Security Response has observed a steady influx of fake profiles on the social photo-sharing service Instagram.

These fake profiles, which use photographs stolen from legitimate profiles, feature three variations to follow users and like photos. Through these interactions, they lure users to their profiles in order to earn a commission through affiliate links to adult dating websites.

•

•

applications containing these malicious links.

Attacks manipulated search engine results – when searching for a combination of common words such as “cheat” and “story”, it was apparent that the “cheating stories” application appeared on the first page of the leading search engines.

Analytics showcased impact of attacks– Threat Research looked at Alexa analytics and the ranking of the “cheating stories” application dramatically increased during the three month span.

criminals using creative ways to the exploit the cracks of a more connected world,” said Oded Vanunu, security research group manager, Check Point. “The Internet of Things trend will continue to grow, and it will be important for consumers and businesses to think about how to protect their smart devices and prepare for the wider adoption of IoT.”

ATTACK TYPE 5

ATTACK TYPE 4 New Check Point Report Reveals How Hackers Can Outsmart Smart TVs Research on vulnerability with EZCast dongle highlights unique security challenges for consumers and businesses in an Internet of Things ecosystem Akamai Identifies SEO Web Application Attack Campaign. Attackers use SQL injections to manipulate search engine rankings, impacting an organisation’s revenue and reputation

Akamai Technologies has issued a new Web security threat advisory from the company’s Threat Research Division. Threat Research has identified a sophisticated search engine optimisation (SEO) campaign that uses SQL injections to attack targeted websites. Affected websites will distribute hidden Hypertext Markup Language (HTML) links that confuse search engine bots and erroneously impact page rankings. A full report detailing the attack is available for download here: http://www.stateoftheinternet.com/seo-attacks Overview

Over the course of a two week period in Q3 2015, Threat Research analysed data gathered from the Akamai Intelligent Platform and observed attacks on more than 3,800 websites and 348 unique IP addresses participating in the various campaigns, revealing the following key findings: • Evidence of mass defacement – when searching the Internet for the HTML links that were used as part of this campaign, Threat Research identified hundreds of web

23 | Chief IT

Check Point Software Technologies has published a report identifying network security vulnerabilities with EZCast, an HDMI donglebased TV streamer that converts non-connected TVs into smart TVs. The findings show a hacker’s ability to gain full, unauthorised access to an EZCast subscriber’s home network, thereby compromising personal information and taking control of home devices. Currently used by approximately 5 million users, the EZCast dongle runs on its own Wi-Fi network and is controlled through a smartphone device or PC. The device represents a growing trend of connecting devices to the Internet – known as the Internet of Things (IoT) – and further introduces unique security challenges for both consumers and business. The latest Check Point research report highlights significant risks: • Attackers can enter through the Wi-Fi system, allowing easy access into both the EZCast and home networks.

• Once in, the attackers can move around the networks undetected, providing the ability to view confidential information and infect home devices.

• The attacks can be initiated remotely; hackers can execute malicious code anywhere.

“This research provides a glimpse of what will be the new normal in 2016 and beyond – cyber

Australian Security Magazine | 25

Cyber Security

Cyber security at sea

A By Tony Campbell CISSP

26 | Australian Security Magazine 24 | Chief IT

side from the big cyber stories of 2015, where traditional hacking saw criminals make off with millions upon millions of sensitive customer records, we also saw coverage of a new breed of cyber threat. Cars were cyber-jacked, aircraft were shown to be susceptible to remote takeover and children’s’ toy manufacturers were shown to have vulnerable toys that could expose them to cyber hacking and stalking. Across a multitude of these market sectors and industry verticals, security professionals are seeing a trend whereby industry bodies and regulators are waking up to the fact that cyber-attack is a real problem, especially in markets where this has never been a problem before.

Regulators are now publishing guidelines for these industries, with the intention of helping their charges understand these risks, in a world where cyber has never even entered their daily lexicon.

The shipping industry is the latest market to jump on board (no pun intended), which is why in January 2016, BIMCO released, “The Guidelines on Cyber Security Onboard Ships.” This publication is aimed at ship owners, operators, managers, brokers and agents, and offers some excellent advice on assessing the cybersecurity risks related to shipping.

“The safety, environmental and commercial consequences of not being prepared for a cyber incident may be significant. Responding to the increased cyber threat, a group of international shipping organisations, with support from a wide range of stakeholders, have

developed these guidelines, which are designed to assist companies in developing resilient approaches to cyber security onboard ships.”- BIMCO: The Guidelines on Cyber Security Onboard Ships BIMCO has coauthored a set of cybersecurity guidelines to help the global shipping industry prevent major safety, environmental and commercial issues that can result from cyber security incidents on board a ship. The focus of the report is that of risk management, which, naturally, the best approach is for anyone wanting to start the processing of maturing in response to cyber security. What’s great about this report is that it focuses not only on the standard information technology aspects of shipping, but it also pays attention to the often underserviced aspects of operational technology (OT) that also affect many large-scale heavy industries, such as resources, utilities and construction.

BIMCO’s approach fully aligns with the steps taken by the majority of organisations that already have an established process for information security management. The report suggests that shipping companies should introduce a fundamental programme of security awareness training that underpins the introduction of the full risk management lifecycle. The process offered up by BIMCO aligns perfectly with international standards, whereby shipping companies begin by identifying threats that may affect their systems and information, identify the vulnerabilities they may be subject to, then move into a process of risk assessment and

Cyber Security

risk management. Companies are shown the means by which they can include security controls within their security architecture as well as being offered help on establishing the contingency and remediation plans for dealing with an attack, should one occur.

What are the threats?

It’s interesting to see that the range of threats faced by the shipping industry is actually no different to the threats faced by any other business. BIMCO suggests that companies should be concerned about activists, including disgruntled employees, who would be motivated by causing reputational damage against the shipping line, or possible disruption of operations. They may try to destroy information, physical assets, media, expose sensitive data on the Internet or to the press, or incite negative media attention, all of which could be critical to operations and profitability. Criminal gangs, opportunists the usual swathe of nation-states, statesponsored and terrorist organisations are also cited as threat actors in this paper. Interesting, though, competitors and the media are not listed as threat actors, where those are often represented as specific callouts in threat assessments in other industry verticals. Nevertheless, the paper represents the concept of threats well and is a good first publication.

Types of Attacks The BIMCO report lists two categories of attack: targeted and untargeted. An untargeted attack occurs when, “a company or a ship’s systems and data are one of many potential targets.” In effect, this means the ship is attacked as a result of a vulnerability scan across numerous IP ranges and the ship just happens to be one of the identified targets identified. On the other hand, a targeted attack, not surprisingly, is when the company or ship is directly in the sights of the attacker and the attacker is motivated by something related to that company or vessel.

What’s nice to see is the footnote that suggests the list of common cyber-attacks shown has been lifted from a CESG publication, entitled “Common Cyber Attacks: Reducing the Impact.” BIMCO has clearly consulted with the UK government and is using the best collateral to build its awareness campaign.

Who or What is CESG? CESG is the UK’s National Technical Authority for all things cyber security related, and more information can be found here: www.gov.uk/government/uploads/system/ uploads/attachment_data/file/400106/Common_Cyber_ Attacks-Reducing_The_Impact.pdf

Managing Onboard Systems Threats Aside from the traditional information security risks that IT systems are subject to, the interesting perspective that the shipping industry faces, as do the other sectors, such as utilities, resources and construction, is that they have so-

25 | Chief IT

called Operational Technology (OT). OT refers to control systems and specialist systems that are often bespoke and run on specialist hardware, where the logic runs as programmable firmware rather than easily managed software. Furthermore, even some of the modern OT systems that do rely on modern software models and operating systems, are so critical to a business operation that they cannot be taken offline to patch and upgrade, so they end up being vulnerable to attacks that have been all but eradicated in the enterprise world. BIMCO calls out cargo management systems interfacing with onshore controllers, especially when the ship is littoral, as well as bridge systems that interface with specialist navigation control systems and the ship’s propulsion systems, as being particularly high risk. Passenger and crew services systems can also be attacked, especially on cruise liners, as they can contain vast amounts of PII and potentially credit card information. All of these systems need to be protected and should be incorporated into the risk assessment, along with all of the more traditional security models that the Infosec world is used to, relating to secure network designs, reducing the effects of malware, application and OS patching, use of administrative privileges, etc.

What is BIMCO? BIMCO has over 2,200 members and claims to be the world’s largest global shipping association, providing a wide range of services to ship owners, operators, managers, brokers and agents. They operate as an advisory body across the entire shipping industry, offering standard contracts for members to make use of in business engagements, as well as providing information, advice and education, such as the guidelines we’ve looked at here on ‘Cyber Security Onboard Ships’.

For more information on BIMCO’s products, services and membership, check out the website at: www.bimco.org

Contingency and Resilience BIMCO’s contingency planning advice includes the shipping company ensuring it has fully documented who has decisionmaking authority, especially in a crisis situation, and explains when to call in the experts (such as third-party incident responders or law enforcement) and who those experts are, by name. It’s advisable as part of the planning to already have interviewed and contracted with the relevant third parties so that it’s not yet another issue to consider during the incident management or contingency management phase.

Recovery plans and all associated documentation (forms, communications lists, etc.) should all be accessible to officers on board ships and they should be educated in how to use them and when to escalate an issue to the littoral support.

Responsibilities should be well-defined in the plans and the purpose and scope of each individual or specific plan should be defined and understood by the officers as well as all external IT personnel who provide support to the company or the ship.

Conclusion This is a very good document and certainly great advice for an industry that has before been underserviced by the information security community. BIMCO has done a great job in offering standard-based advice and guidelines in the context of the shipping industry, which I’d argue needs be adopted by everyone involved in shipping. However, until there is widespread regulation and legislation that enforces some semblance of compliance with cybersecurity guidelines, the chances of companies doing this properly and calling in the expensive experts is remote. If it comes down to cost, then there needs to be a compelling motivator to invest before anyone will jump to make the necessary changes and improvements.

Australian Security Magazine | 27

Cyber Security

Attacks on the internet and cloud will continue

F By Sarosh Bana ASM Correspondent

28 | Australian Security Magazine 26 | Chief IT

ortinet, the global leader in high performance cybersecurity solutions that is based in Sunnyvale, California, foresees the emergence of increasingly sophisticated evasion techniques that will push the boundaries of detection and forensic investigation as hackers seek to counter increasing pressure from law enforcement.

In their report titled, New Rules: the Evolving Threat Landscape in 2016, Fortinet and its threat research division, FortiGuard Labs, anticipate attacks on the known vulnerabilities of the Internet of Things (IoT) and cloud to continue in the coming year, with new malicious tactics and strategies creating unique challenges for vendors and organisations alike. “Threats on these new platforms will continue to rise as these technologies continue to be used more pervasively, including by Indian enterprises,” the report notes.

NASDAQ-listed Fortinet was founded in 2000 by brothers Ken Xie, who is Chairman and Chief Executive Officer (CEO), and Michael Xie, who is President and Chief Technology Officer (CTO). Ken Xie was previously President and CEO of NetScreen, where his brother held positions as Software Director and Architect. Led by a management team with deep experience in networking and security, Fortinet provides network security appliances and security subscription services for telecom carriers, data centres, enterprises, and government entities through its 100-plus offices around the world. Its revenues totalled $770 million in 2014, and were $260 million in Q3 2015.

Fortinet established FortiGuard Labs over 10 years back as its dedicated security research arm, staffed by over 200 researchers, analysts, engineers and forensic specialists located globally. They deliver security updates round-the-clock, with

industry-leading response times to new and emerging threats targeting customers’ networks, content and mobile devices.

FortiGuard Labs is capable of rapid response to emerging threats and can every minute intercept 72,000 spam emails, resist 210,000 network intrusion attempts, neutralise 68,000 malware programmes and block 310,000 malicious website access attempts, in addition to thawing 67,000 botnet C&C (command and control) attempts.

In India, Fortinet is headquartered in the country’s IT capital of Bengaluru (formerly Bangalore) where it has a large technical support centre. Apart from offices in seven cities in India where it employs over 250 technically skilled professionals, Fortinet also has offices in Sri Lanka and Bangladesh that serve the SAARC region, the South Asian Association for Regional Cooperation constituted of Afghanistan, Bangladesh, Bhutan, India, Maldives, Nepal, Pakistan and Sri Lanka. The company has long-term plans to heighten its profile in the Asian region and believes that in the near future, it can achieve growth better through enhancing quality headcount rather than mere quantitative expansion.

Montana-based research firm IDC (International Data Corporation) ranks Fortinet third in India’s security appliance segment, with a market share of 11.2%. The market size in India was estimated at $88.1 million for H1 2015. Rajesh Maurya, Fortinet’s Country Manager for India & SAARC, attributes this gain to several key initiatives his company has implemented, such as establishing direct touch teams for key accounts, aggressively expanding its partner base to cover new technologies and geographies, and enabling and enforcing stricter service standards. “Various solutions launched in 2014 are running on Fortinet’s latest NP6 processor that has

Cyber Security

broken all performance records,” he asserts. “The company has been gaining both revenue and shipment market share in the data centre, enterprise and SMB (small and medium business) market segments.”

Maurya says that Fortinet has also boosted investment in R&D, and rolled out products and services to help enterprises cope with new requirements like advanced persistent threat (APT) defence and secure application delivery. An R&D centre has been set up by FortiGuard Labs in the south Indian city of Hyderabad that works very closely with its parent R&D centre in Sunnyvale. Its primary focus is on building the hardware logic for FortiDDoS appliances used for mitigation of Distributed Denial of Service (DDoS) attacks. Such attacks are typically targeted at blocking legitimate traffic to a website by sending a large number of simultaneous service requests to the web server of that site, with the intention of bringing down that site or for some other malicious purpose. The engineers at Hyderabad also specialise in digital design for high-speed Internet security applications. The team works on developing hardware logic for TCP/IP, HTTP, DNS, SIP and other networking protocols.

Fortinet’s research team has observed an increase in Microsoft Remote Desktop Protocol (RDP) brute force login attempts, as detected from its threat intelligence in India.

“There was almost a ten-fold increase in RDP brute force login attempts in the second quarter of 2015 as compared to the first,” remarks Maurya. “A further 33% increase in RDP brute force login attempts was seen in the third quarter as compared to the second, categorising it as the top attack detected in India for Q3 2015.”

Referring to the enterprise security threats and trends in India, Fortinet’s threat intelligence report indicates ZeroAccess as the top botnet observed in India in the first three quarters of 2015. It maintains that though incidents detected have decreased by almost 34% in Q2 2015 over the previous quarter, there was a 7% increase again when comparing Q3 2015 to Q2 2015. “The decrease in Q2 2015 may be attributed to more effective security measures taken by the Indian security industry and enterprises to mitigate ZeroAccess malware propagation, and also to the efforts to take down the ZeroAccess command and control (C&C) server infrastructures,” it adds.

Nevertheless, the slight increase in Q3 2015 shows that the botnet is still capable of re-establishing its foothold, and Fortinet counsels organisations to continuously strengthen the security of their networks to mitigate cyber security threats. The company protects more than 15,000 customers in India, including the leading telecommunications companies, government and PSUs, banks, educational institutes, manufacturing units and hospitals.

While ZeroAccess was the top botnet, the Mydoom virus was the top malware observed in India, with security incidents involving it rising 32% in Q3 2015 over Q2 2015.

Though this virus was first observed a few years back, the statistics show that older malware are yet capable of infecting systems. Disturbingly, while the technique of propagating malware like Mydoom via email has been used for many years, inadequate cyber security awareness and measures motivate hackers and cyber criminals to use the same methods over and over again to infect the victims’ systems.

27 | Chief IT

Highlighting Fortinet’s “very successful year 2014”, where it experienced immense revenue growth of 51.9% in the Network Security Market in India, Benoy CS, Director, ICT Practice, Frost & Sullivan, says the vendor has created an ecosystem in India with large service providers to give customers a broad choice of solutions for protecting their infrastructures. “Its high-end appliances and hardware engineering capability enable an exceptional level of performance, deployment flexibility, and security for large- as well as mid-sized networks,” he observes. “The underlying philosophy behind Fortinet’s growth is attributed to its continuous pace of innovation, delivery of new features and products, and ease of deployment and management of its appliances onsite.”

IDC’s Worldwide Quarterly Security Appliance Tracker, 4Q14, released in March 2015, indicates that Fortinet’s security appliance shipments and worldwide revenue continued to grow in the fourth quarter of 2014, the 21st consecutive quarter of revenue growth. “Fortinet remains the largest security appliance vendor in terms of shipments globally, with 18.8% share of total unit shipments in 4Q14,” it notes. According to the report, Fortinet has globally shipped more than 2 million security appliances since its inception and has shipped more security appliances each year than any other vendor since 2013. The company has also had the largest market share of combined appliance shipments since 2012.

In the security world, it has been a long tradition to share information on new malware and botnets, and newly discovered threats and vulnerabilities. Ken Xie was in February invited to the White House Summit on Cybersecurity and Consumer Protection to provide industry insight and commentary on public-private collaboration on cybersecurity. “Security vendors see responsibility in sharing threat findings with each other and other agencies and enduser advocacy groups, because the best way to combat the creativity and negative impact of malware and adversaries is to build security solutions based on data from wide and diverse sources,” he notes. The Washington event brought together stakeholders from across the US who collaborated and explored partnerships to help develop the best ways to bolster cybersecurity.

FortiGuard Labs collaborates with other network and security vendors, and threat monitoring and law enforcement agencies. Its partnership with Exodus Intelligence combines its broad threat research coverage and Exodus’s unique expertise on emerging zero-day threats that helps gain advance notice of attacks before they infiltrate an organisation’s network. The two partners are additionally developing new customer-facing threat mitigation and incident response services.

In the first move of its kind for sharing threat information in the interest of their collective customers, Fortinet has co-founded the Cyber Threat Alliance (CTA) with Intel Security (formerly McAfee), Palo Alto Networks and Symantec. The end goal for the information sharing is to raise the situational awareness about advanced cyberthreats and enable members and organisations worldwide to use the latest threat intelligence information to improve defences against advanced cyber adversaries.

‘FortiGuard Labs is capable of rapid response to emerging threats and can every minute intercept 72,000 spam emails, resist 210,000 network intrusion attempts, neutralise 68,000 malware programmes and block 310,000 malicious website access attempts, in addition to thawing 67,000 botnet C&C (command and control) attempts.’

Australian Security Magazine | 29

Cyber Security

The illusion of ‘real time’ & ‘intelligence’ collection” By Eric Flis

O

ver the past year there has been an explosion of services being offered in the threat intelligence space.

These services for the most part focus on the cyber security market.

Over this time WorldStack has noticed a growing trend with services claiming to offer “real time” cyber threat intelligence and products and/or services that provide “intelligence collection”. The use of the terms “real time” and “intelligence collection” in these contexts as we see it are being used as nothing more than a marketing ploys by companies claiming to offer such services using these as buzz words.

This is doing real intelligence and the benefits it can provide to clients a great disservice.

The Issues The terms real time and intelligence do not go together.

By its nature intelligence is a product, and the creation of intelligence product takes time. The length of time depends on a number of factors such as the level of detail required by the end user and whether you are looking at Strategic, Operational or Tactical intelligence.

Even at its simplest form the intelligence cycle consists of steps, generally these steps would be Planning, Collection, Collation, Analysis and Dissemination. By its nature it is a process that takes time, as can be seen there are three steps that need to be undertaken before you can actually provide a client with an intelligence product.

Likewise stating that you collect intelligence or you have a product that collects intelligence is a great misuse of the

30 | Australian Security Magazine 28 | Chief IT

term intelligence.

At the collection stage in the intelligence cycle what is actually being collected is raw data or information. That is unless you are accessing already finished intelligence products.

The raw data collected then needs to be assessed, information verified and validated and analysed to determine what that actually means, if anything for a client. Without this process the raw information provides little if any value to an end user.

What constitutes intelligence?

There are many services and products that claim to provide threat intelligence. But what constitutes threat intelligence?

Many products and services provide information such as known bad IP addresses or URLs, to be blacklisted by a client’s network to protect the network against infection from malware and other forms of attacks and intrusions.

However, is a bad IP address or URL Intelligence? We would argue it is not. At least not on its own. On its own it is a piece of information, granted it is a piece of information that can help protect a network, however it is not intelligence, not in the true sense.

In order for a known bad IP address or URL to be called intelligence there needs to be some insight into why it is bad, what that means for the client it is being provided to.

This means the who, what when, where and why need to be analysed in relation to the IP address or URL. In a lot of cases this type of technical based intelligence is also reactive, not proactive. As an example, a network is

Cyber Security

such as counter terrorism. This comes

capabilities and are after the clients crown jewels?

All of these are important questions that need answering when providing threat intelligence to a client, be it in cyber security of more physical realms such as counter terrorism.

This comes from investigating the who, what, when, where and why in relation to such technical information.

Granted this information may just not be available,. however every effort in answering these questions for a client should be made and be the main focus of anyone provided threat intelligence services or products.

from investigating the who, what, when,

Conclusion

where and why in relation to such

So what can be done to not dilute the power of what true intelligence product can provide?

Firstly, it is highly unlikely that companies will change their marketing tactics and will continue to try and capitalise on using buzz words such as “real time” and “intelligence collection”. Therefore clients need to become more sophisticated in their understanding of what intelligence is and more importantly what their intelligence requirements are.

The first step a company selling threat intelligence services should do for a client is help them identify what their intelligence gaps are, if they have not already done so. Then work with the client to define what is they hope to get from your service or product.

If a client determines they require an IP blacklisting service then so be it, as long as it is what they require to fill their needs. However they should not be sold this as an intelligence product as it is not intelligence in the true sense of the word, it is merely a piece of information. The term intelligence for many holds the expectation that there will be insight and understanding attached to a product or service using this term. This can lead to clients being disappointed as their expectations have been let down as the reality of the service they receive does not meet with their expectations.

This is where the watering down of real threat intelligence occurs, when clients do not see value in it. When in fact what they may have been getting was not intelligence product at all.

‘All of these are important questions that need answering when providing threat intelligence to a client, be it in cyber security of more physical realms

technical information.’

Figure 1 – Intelligence cycle

observed being scanned by system operators and the IP address is subsequently blacklisted on the network. This is reactive rather than proactive. Other services provide lists of known bad IP addresses and URLs, which are subsequently blacklisted on the network, this scenario is at least a more proactive approach.

From our perspective the who, what, when, where and why in relation to a piece of information is extremely important. This is what will determine whether a client is being provided an intelligence product or just a piece of information.

If that information is coupled with analysis and insight it can become quite powerful for a client. Not only can it protect them in the short term by blocking that IP address, knowing who may be using that IP address and their motivations allows the client to become more proactive in their security planning. This stems from knowing who the threat actor is and what their motivations for attack are. For example is it a one off low level attack by a script kiddie? Is it a threat actor motivated to some social or political issue to which they see the client being linked to in some way, indicating they may be a repeat offender? Or is it a threat actor with known ties to a nation state, who have advanced

29 | Chief IT

About the Author Eric is a Director and Chief Operating Officer of WorldStack Pty. Ltd. Eric holds a Masters in Policing, Intelligence and CounterTerrorism from Macquarie University and his professional career spans both cyber security, intelligence and physical security arenas.

Australian Security Magazine | 31

Cyber Security

Adopting “Ring of Defense” licensing strategy to reduce hacker theft By Steve Beards VP APAC and Japan, Flexera Software

A

ccording to a study from IDC and Flexera Software, a significant proportion of software companies feel their licensing and pricing strategies are not effective in capturing the real value their software provides. As a result, their bottom line is suffering, and increasingly they’re subject to software piracy. While automated software licensing tools exists to ensure vendors receive adequate compensation for their products, many are yet to employ this technology.

The consequences of falling behind in software licensing are abundantly clear. The amount of revenue illegally being siphoned away from software companies due to unauthorised software use is staggering. A recent BSA Global Software survey notes that 43 percent of the software installed on PCs around the world, totalling more than $62 billion in value, was not properly licensed. This, combined with evermore sophisticated and relentless hackers is leaving software companies who fail to implement the latest security measures, very vulnerable.

Gaps in Traditional Hacker Protection As a result of revenue leakage from hackers, software companies are re-assessing their traditional licensing

32 | Australian Security Magazine 30 | Chief IT

security approaches and noting gaps that must be closed.

One area of particular vulnerability in software protection is the binary attack. This is a term used to describe how hackers inject malicious code into the application to circumvent licensing. A binary attack can occur in disk with a disassembler or in memory while an application is running. The hacker typically applies a patch that changes the application storage location and its behavior. The code requiring license validation before performing an action is modified, so the application doesn’t check for licenses or, even worse, it looks for the hacker’s licenses.

Typical approaches to fighting these hacker modifications include encrypt ion, dongle protection, secure boots, and more. While effective in less sophisticated times or in only certain specific situations, gaps exist which can expose software companies to hacker risk: • Encryption gap: Offers only one level of protect ion.

Hackers can find the decryption keys hidden in the application, which then removes all protection. There’s also a rework impact of the encryption gap, as software companies then have to rewrite application code when protect ion is compromised. Finally, encryption can significantly impact performance.

Cyber Security

“Software licensing is complex and ever-evolving. The rise in hacker threat and the revenue leakage experienced by many software companies is evidence that better licensing strategies are needed to monetize and properly protect intellectual property.”

•

•

Dongle gap: Dongle protection does not address binary patching, and determined hackers know how to use dongle emulators to break dongle protection.

Secure boots gap: This method protects devices, not software. Exposure is increasing since the Internet of Things (IoT) means putting more and more software on devices.

The gaps in these typical protection strategies has meant that software companies are beginning to fight back more aggressively. Enhanced tamper-resistant application capabilities provide additional security layers to fortify and protect the software application from piracy and thereby reduce revenue leakage.

Software licensing is complex and ever-evolving. The rise in hacker threat and the revenue leakage experienced by many software companies is evidence that better licensing strategies are needed to monetize and properly protect intellectual property. Implementing tamper-resistant licensing is a case in point. Software companies unable to devote the significant time, money and staffing necessary to build and maintain best-in-class tamper resistant licensing systems should look to third-party automation that will deliver significant protections.

Ring of Defense: Resistance, Obfuscation and Detection Increasingly, software companies are adopting a “Ring of Defense,” tamper-resistance strategy to protect their intellectual property and eliminate revenue leakage. The Ring of Defense strategy is analogous to fortifying a home against burglary by making it significantly more difficult to gain entry and steal what’s inside: • Resistance – Adding a “Moat” Around Software: Tamper resistant licensing establishes a secure barrier around the software – a moat – making illegal entry by hackers significantly more difficult by preventing debugging and application signature spoofing – techniques hackers undertake to reverse engineer the application and gain illegal entry.

• Obfuscation – Hiding the “Front Door”: Enhanced code-obfuscation tamper resistance makes it harder for hackers to conduct static analysis on the application to find an entry point – the “front door.” Using this strategy, the strings, variables and functions that control the flow of software and application data, which may contain sensitive information, are hidden – making it significantly more difficult for hackers to find the code logic and gain illegal entry.

• Detection – Adding “Motion Sensors” and “Alarms” Signaling Intrusion: Ring of Defense licensing also helps ensure application integrity and maximises protection against binary tampering through innovative techniques that detect when hackers try to modify the application in memory and on disk. It also provides “call-home” notification alerts – effectively detecting unauthorised intrusion within the application and sounding the alarm to notify the software company of the illegal intrusion.

31 | Chief IT

Australian Security Magazine | 33

Critical Infrastructure

Protecting critical infrastructure from cyber attacks

C By John Kendall Public Sector & Security Program Director, Unisys Asia Pacific

ritical infrastructure providers are becoming acutely aware of how dependence on IT systems and connectivity make them increasingly vulnerable to cyber-threats. However John Kendall, Public Sector & Security Program Director, Unisys Asia Pacific, warns that physical system segregation will not keep up with the expectation to adopt new technologies in their business and the resulting evolving security threats.

The Internet of Things (IoT) can be a terrifying prospect for organisations responsible for building, operating and maintaining critical infrastructure such as power grids and telecommunication networks. While some critical infrastructure providers are embracing IoT as the path to business success, others have opted to reject integration with the Internet to better protect their IT systems.

Recently, AusNet, the largest energy delivery service in the state of Victoria, Australia, declared it has segregated its network into information technology and operational technology, with either an air gap or segregation, so that its networks and operational SCADA systems are “caged off ” from the rest of the company’s IT infrastructure. 1 AusNet’s motivation is understandable, but physical segregation is not a viable long term strategy to protect IT systems as people will inevitably find a way around the air gap.

What threats?

Cyber-attacks on critical infrastructure are not restricted to big budget movies and popular fiction. The US Department of Homeland Security Industrial Control System Cyber Emergency Response Team (ICS-CERT) reported 2 an eight-fold increase in the number of reported attacks in the US over a four year period – with the largest percentage (32

34 | Australian Security Magazine 32 | Chief IT

per cent) targeting organisations in the energy sector.

A survey of critical infrastructure organisations by the Ponemon Institute 3 in 2014 found that 86 per cent of the respondents in Australia and New Zealand reported at least one significant security breach in the previous 12 months.

In addition, 79 per cent felt that an attack on an Industrial Control Systems (ICS) or Supervisory Control and Data Acquisition (SCADA) system was at least somewhat likely in the next 12 months.

From whom?

“Hactivists” wishing to create havoc to make a political or social statement can download cyber weapons and get suggested targets, strategies and current success rates thanks to online networks like Anonymous. Criminal elements also use cyber-attacks to demand ransom payments or steal valuable corporate or customer data. And there is the simple issue of human error by employees.

However, the most insidious attacks on critical infrastructure display the characteristics of major state players who are probing critical infrastructure weaknesses and testing sophisticated cyber weapons that could potentially be used to cripple an economy.

Isn’t ring fencing a logical response?

Some organisations have adopted a policy of physically isolating critical power infrastructure assets by separating information technology from operational technology like SCADA-based ICS via an “air gap”.

In the past, “ring fencing” ICS systems in this way was seen as a simple solution that allowed organisations to meet business goals while reducing the risk of cyber exploitation.

However more recent experience shows “ring fencing”

Critical Infrastructure

official logo, the “success rate” for it being

5 by the US Department of Homeland Security highlighted a glaring weakness that keeps security professionals up at night. DHS staff deliberately dropped data disks and USB flash drives in federal agency and contractor parking lots.

Sixty per cent of those planted data devices, which could easily hold malicious code, were subsequently inserted into company or agency computers. The research went on to reveal that if the data device had an official logo, the “success rate” for it being inserted into an organisation’s network rose to 90 per cent.

The fact is that as long as the human factor still exists, ring fencing and air gaps don’t address the vulnerabilities most responsible for successful cyber attacks on critical infrastructure.

inserted into an organisation’s network

So what steps should be taken?

rose to 90 per cent. ’

Unisys recommends a holistic four-step approach to securing critical infrastructure against cyber threats.

Step 1: Educate - Clearly more needs to be done to educate the workforce on cybersecurity threats and the specific actions they are responsible for taking (or forsaking) to thwart such attacks. It’s also important for them to understand the implications of not doing so.

Step 2: Assess and evaluate - Conduct cyber vulnerability assessments of all systems and procedures, not just those that fall under the jurisdiction of the IT department.

In particular, ensure aging ICS operating systems are updated with the latest security patches, passwords are hard to guess, access controls are adequate and that cybersecurity technologies are agile enough to respond to evolving regulatory requirements and threats.

Step 3: Prepare and share - Behave as though your systems (IT and ICS) are under cyber-attack – because the chances are they are. Engage with organisations such as the Trusted Information Sharing Network (TISN) and Critical Infrastructure Advisory Council (CIAG) as well as industry segment user groups to access early cyber warnings and suggested countermeasures.

Step 4: Trust no one and deploy defence-in-depth Treat your own internal environment as “hostile” by going beyond merely segregating ICS operational systems from business IT systems. Grant access to critical systems based on approved applications, functions and roles – not just a user ID and password.

Use cloaking technologies to render critical assets invisible to unauthorised individuals and high level encryption to make it unreadable even if it is accessed.

Achieve defence-in-depth by assessing the various attack vectors in the ICS network and implement a defence strategy as layered network architecture.

‘Sixty per cent of those planted data devices, which could easily hold malicious code, were subsequently inserted into company or agency computers. The research went on to reveal that if the data device had an

ICS systems is not sustainable and also fails to address key vulnerabilities: Fencing is not sustainable.

As recently as a few years ago, some government and business organisations worried about the cyber threat posed by the Internet and implemented policies to segregate the corporate networks from the Internet. But ultimately they couldn’t hold back the tide; employees simply found ways to circumvent corporate restrictions.

The same pattern was repeated with the advent of mobility, and later BYO (bring your own) technologies, in the workplace. Today those same organisations readily admit that they depend on the Internet and mobile workforces for their core business functions. The bottom line is that new technologies offering enhanced productivity and reduced operational expenses are forcing organisations to evolve towards increased network connectivity.

In the same way, as core components for power generation and transmission become increasingly intelligent and dependent on the Internet for control, maintenance and monitoring – such as smart metres that automatically report power consumption back to energy providers - it will be difficult for organisations to compete against more technologically agile energy providers.

Fences are still vulnerable.

Frighteningly, the Ponemon Institute study also found that those critical infrastructure providers who had suffered a data breach in the past year attributed 71 per cent of the breaches to insider negligence, accident or mistake.

Despite this finding, only 10 per cent of respondents felt that their IT security program is mature, less than one in five felt that security is one of their organisation’s top five strategic priorities, and only 6 per cent offered cybersecurity training for their employees.

In 2012, a major power plant in the US was shut down for three days after a technician unknowingly inserted a virus infected USB memory stick into an ICS terminal 4. In case you think this is a one-off example, a recent penetration test

33 | Chief IT

Bottom Line With a holistic security approach and security technologies that secure and hide the data itself, organisations that provide, operate or maintain critical infrastructure are able to take full advantage of the Internet of Things without falling victim to crippling cyber-attacks.

Australian Security Magazine | 35

Cyber Security

Protecting the enterprise in a world of hackers By Benn Alp F5 Networks

36 | Australian Security Magazine 34 | Chief IT

A

s technology evolves, it is no surprise that information systems and the data they hold are relied upon by today’s enterprises on an unprecedented scale. Today’s enterprises gain significant efficiency and productivity through the use of technology. A byproduct of these benefits is that the organsiations are exposed to technology risks that are challenging to control. As evidenced by the steady stream of cyber security breach headlines emerging from well-known brands like Sony, JPMorgan, Home Depot, Anthem and eBay. Despite the heightened awareness of cyber security attacks, Australian businesses are still being faced with increasing threats and breaches to their organisations. In fact, according to PwC’s Global State of Information Security Survey, Australia is leading the world in cyber security incidents increasing by 109 per cent to 9,434 over the past 12 months . Hence, it is no surprise that CIOs here have, for the first time, cited security as their top concern across big data, mobility, cloud and social for business . As data security becomes front of mind, Australian companies will need to familiarise themselves with the various types of threats

affecting their organisations and look to heavily invest in protecting their intellectual property and other online assets.

Burdening organisations In Australia, financially motivated attacks on consumers and organisations from a banking perspective are becoming more frequent. We have seen a significant increase in the sophistication of malware that targets banks’ online services and their customers in order to commit fraud. Additionally, DDoS attacks are another method cyber criminals are employing to attack their victims, for example the recent DD4B DDoS for BitCoin extorsion attacks . Hence, having systems in place that can identify and stop malicious actions, while still prioritising legitimate traffic, should help mitigate against DDoS attacks and keep systems and applications running.

Hacktivism motivated attacks are becoming more prevalent using vulnerabilities in web applications as a political stage to send out a message. Organisations are also under threats of industrial espionage, information leakage

Cyber Security

of $2.82 million particularly affecting

to the information within an enterprise’s applications is critical. There are common sets of information security controls that can be activated within the enterprise both from a vulnerability management perspective, and authentication and access control perspective.

Aligning an organisation’s security strategy across all online assets is extremely critical to keep its intellectual property, assets and users safe and free from financial burdens.

the financial services sector. With the

True privacy without the worry

knowledge that each security breach can

Cyber criminals are constantly identifying vulnerabilities and causing disruption to Australian government organisations and businesses. There is a broad spectrum of attacker motivations, from individuals who are in it for entertainment to those who are financially motivated. Hacktivists and criminal syndicates who are involved in other types of crimes are becoming increasingly more tech savvy with a huge number being financially motivated attacks. Every business needs to look at the spectrum of potential threat actors and unique threats to their information otherwise be prepared for the costs associated with an attack.

Hence, having a multi-layered approach to online security that controls risks to the information, applications and supporting infrastructure will give businesses the best chance of stopping attacks and preventing unauthorised access while ensuring that genuine workers can still access and use the applications they want, when they want.

‘...according to the Ponemon Institute, the average cost of a data breach to an Australian business averages a total

cost a business approximately $144 per stolen record containing sensitive and confidential information’

related to the corporate operations and it’s intellectual property or assets.

No matter the type of attack, an increasing number of organisations are facing serious security threats that are socially, politically and economically motivated to gain an illegal control or access to a digital device. Conventional firewalls are no longer enough to prevent complex and frequent cyber attacks.

As these ever-changing threats continue to affect organisations, they’ll also continue to drive major financial burdens for the organisation and its employees. In fact, according to the Ponemon Institute, the average cost of a data breach to an Australian business averages a total of $2.82 million particularly affecting the financial services sector. With the knowledge that each security breach can cost a business approximately $144 per stolen record containing sensitive and confidential information, the financial ramifications of a cyber attack on a business is exceedingly clear.

Today, there is still a large number of data breaches and security incidents that go unpublished as Australia doesn’t (yet) have mandatory data breach notifications in place.

Australia still waits, but with more visibility to come, it is imperative organisations revisit their existing security plans.

A top priority for all Organsiations need to have plans in place to help mitigate the risks surrounding hacking, malware, espionage, and financially motivated attacks. The best approach to control the risks involves a multi-layered approach across people process and technology covering applications, devices, users and access and identity and much more.

A critical security discipline for any enterprise is identity and access management, which ensures only the right people can access the right data and helps meet the meticulous compliance requirements. It can also govern which devices are allowed to access networks and applications and which locations they can be accessed from - all vital features.

Similarly, understanding the risks and potential threats

35 | Chief IT

About the Author Benn Alp is a Solution Architect for F5 Networks focused on banking and financial services customers. Based in Melbourne, Australia, Benn focus on enterprise technology and has responsibility to work with BFSI customers across APAC to evangelize F5 solutions and maximize their investments in F5 solutions.

Benn brings 20 years of extensive knowledge in security to F5. Prior to F5, he was with National Australia Bank where he was a Principal Infrastructure Security Architect responsible for security architecture governance across NAB’s infrastructure programs of work. Prior to that, he was an Enterprise Infrastructure Security Architect at MMG, where he was responsible for developing the overall ICT infrastructure and information security strategy and roadmap for MMG. Additionally Benn has held security architecture and security consulting roles at Carlton and United Breweries and Sinclair Knight Merz and Optus Business/Alphawest.

Benn holds many industry certifications including ISC2 CISSP.

Australian Security Magazine | 37

International Cyber Security Skills Development

How to build a world class infoSec workforce

T By Tony Campbell CISO Correspondent

38 | Australian Security Magazine 36 | Chief IT

he global proliferation of Cyber security threats has caused major problems within the Australian economy. Just last year, identity theft cost Australians over one billion dollars, and experts predict this problem is only going to get worse. Industry and government rely on Information Security professionals to find ways to address these issues, but within Australia the distinct lack of recognised job roles and security-related job descriptions is causing confusion and leaving customers underserviced and underwhelmed. The lack of a concise skills and competency framework means that the Industry has no way of determining how to go about hiring people with the required skills and HR teams have no idea how to go about writing the job description for the resources needed to address these issues.

“The lack of professional standards in the IT sector was the primary reason for founding GCI,” says Peter Cross, CEO of the Melbourne based independent certification company.

“We [Australia] need to establish the rules of engagement and the regulations or benchmarks that we can use to test the readiness of individuals to meet the needs of the market.

Imagine, if you will, a kite mark that can apply to specific job roles within each of the different IT verticals, be it service management, governance or information security.”

Peter is a true entrepreneur who has devoted his professional career to his cause. He is striving to create a structured framework for accrediting IT Professionals that is not unlike the way other professional industries operate, such as the financial sector, legal practice and the medical profession. “Take Doctors,” explains Peter. “They study in college to get their grounding in medicine. But this does not make them doctors. It gets them ready for the real world. To become the highly respected consultant brain surgeon you might have set out to be will take years of working in many

different departments under many different teachers and mentors, and only when you’ve proven yourself as the expert would you dare to call yourself one. With experience and skills comes status, not the other way round.”

GCI was founded in 2008 with the aspirations in mind, to do for the IT sector what regulation and professionalism has done for these other benchmark industries. He initially focused on IT service management and IT governance, providing independent examination services for the IT Infrastructure Library (ITIL) suite of courses being taught across Australia. “ITIL had taken the Australian IT sector by storm, becoming a benchmark for both IT outsourcing companies and individuals to allow them to prove to clients they knew what they were doing. GCI was remarkably successful in achieving what it set out to achieve and the Australian market as a whole benefited from the true independence of what we provided.”

As part of business development GCI has now developed its own certifications, based on international standards such as ISO/IEC 20000 for IT Service Management and ISO 38500 for Governance of IT. Additionally, GCI has also worked within the IT and Health sector to develop a suite of suitable examinations for those industries based on his consulting with specialist teams and tailoring his service to match their needs.

Peter also prides himself on his consulting services where his team has supported training organisations and professional associations in developing the syllabi for accredited training courses and then independently building the examination to test students after their participation in a course.

Most recently, Peter expanded his portfolio of partnerships to include global information security training providers, InfoSec Skills and Assist KD for Business Analysis.

Cyber Security Skills Development

‘This CPDE scheme provides services to individuals, employers and recruitment agencies, offering a structured approach to development and guidance to the educational and vocational qualifications that are relevant to job roles and career paths within that profession. ’ When asked why he has taken on the challenge of working in the complex world of Information Security, Peter explained where he sees the role of GCI being incredibly important, especially in the development of the Australian security scene. Independent examination and certification services provided through industry bodies such as AISA or the ACS can allow information security training providers to build courses against certified standards and have their courses certified as fit for purpose by the local industry body.

By providing independent examination and certification services against, for example, AISA’s accredited syllabi, training companies have a benchmark to meet before a course is deemed fit for purpose for the Australian consumer. Courses will need to deliver the outcomes needed by the skills and competency framework, allowing students to get the best courses, and exams will prove that the students have the knowledge needed to do the job as well as regulate the quality of the training.

By aligning the skills and competency framework with one that is recognised internationally, the Australian information security workforce can mature into one that rivals the US, UK, Europe and New Zealand. Given the Australian government is revitalising our stance on cyber security through the government’s forthcoming cyber security policy review, GCI hopes the focus on professionalism will be enough to bridge the skills gap and build a pipeline of professionals coming into the security workforce. “We’ll be able to retain the local talent we develop as well as entice much needed overseas talent into our local workforce,” said Peter. “If security professionals are training overseas, having their skills assessed by an equivalent professional body, such as the UK’s IISP, should put us in a position to accept their accreditation and understand the job roles they have worked on, in their CVs.” Participation in a continuing professional development scheme means ensuring that the person maintains and improve their skills and knowledge for their lifetime as an information security professional. This allows hiring companies to value professional certifications and view them, as well as the status in the professional body, as a professional license to operate. The value proposition for professional certification is then in its recognition and endorsement by the relevant professional association, sitting alongside a Continuing Professional Development and Education (CPDE) programme.

37 | Chief IT

This CPDE scheme provides services to individuals, employers and recruitment agencies, offering a structured approach to development and guidance to the educational and vocational qualifications that are relevant to job roles and career paths within that profession. The medical and finance sectors both have equivalent CPDE schemes that provide an appropriate hierarchy of membership levels based on skills, competencies and education needed to participate in engagements at that level. Professionals are required to attend conferences and seminars, publish articles and white papers and work as volunteers at events that contribute to the development of the association’s members.

“After attending AISA’s 2015 national conference in Melbourne,” Peter remarked, “it seems the logical next step is to develop on the theme of “Trust in Information Security” by establishing a security CPDE scheme that can accredit suitably qualified and experienced InfoSec professionals, build trust in the certification scheme for the industry and build trust in the education and examination sector that monitors and regulates individuals with their licence to work.

Australian Security Magazine | 39

Cyber Security Skills Development

The every-day life of Australian information security practitioners: Who are they?

By Dr Jodie Siganto AISA Policy Committee

40 | Australian Security Magazine 38 | Chief IT

W

hat do information security practitioners do every day? Who do they communicate with?

How do they define information security? What are there major challenges and concerns? What are their most important relationships? While a lot of research has focused on the operation of technical controls and information security management approaches, little consideration has been given to the every-day life of information security practitioners. Recently the Australian Information Security Association (AISA) co-funded an Australia pilot study as part of the EU funded Cyber Securities Cartography project,1 which examines the complex world of the information security practitioner. A focus on the social and human aspects of information security, particularly as they relate to information security practitioners, may help identify the additional skills that may be required by practitioners to help address the current cyber security skills shortage and also high light areas where current practice may need to be re-examined.

As part of the study, researchers interviewed nine Australian information security practitioners working in three different cities and with a range of different titles. The analysis of the transcripts from those interviews produced some interesting results. Broadly two general themes emerged: ″ The every-day life of information security practitioners is diverse, complicated and contested; and ″ The information security community is one in flux.

The idea that information security is a contested space is not entirely consistent with traditional security management approaches based on the premise that the ‘right’ level of information security can be achieved through the application of a rationalisation process based on risk assessments. At the same time, concerns with the changing world and doubts about the continued applicability of core tenets such as the definition of “information security” suggest that a new approach to information security might be required.

A diverse, complicated and contested life The interviewees included a PCI DSS expert, an IT security manager in a health service provider, a risk manager from a local government authority and a security team lead from a large financial institution. All described very different ‘every-day’ roles. There was a great diversity in responsibilities and tasks, even for those participants with

similar titles. However, all (except one) identified themselves as information security practitioners. All of the participants had started off in IT, although was no uniform career path to becoming an information security practitioner. Only one 1 Cyber Security Cartographies is a project run by the Research Institute in Science of Cyber Security (RISC).

RISC is one of three Research Institutes formed as part of the UK National Cyber Security Strategy. <http://cyseca.isg. rhul.ac.uk/; http://www.riscs.org.uk/?page_id=21>. of the participants, who had pursued advanced qualification in cryptography, wanted to be an information security practitioner at an early stage in his career.

The fact that the information security practitioner group is so broad raises questions as to whether information security practitioners should be treated as a single group or profession. For example, do references to the ‘cyber security skills shortage,’ overly simplify the differing roles of information security practitioners, obscuring the differences between them and making it difficult to identify the skills required for each of the different areas of competency?

Despite the differences, there were some commonalities between the participants. Very generally, the main activities of the group interviewed included attending meetings, reviewing documents, prioritising activities, influencing decisions and writing reports. There were few references to technology related tasks or activities that required detailed technical knowledge.

The primary relationships referred to by most of the participants as part of their every-days were the relationships developed with their own teams. Interactions with other parts of the business are to raise awareness of the security function; to overcome the perception of information security as a road block and to re-position the information security team as helpful enablers. In most cases the relationship between the information security function and other parts of the business seemed to be based on ‘selling’ security to the business. For some participants, the main difficulty in selling security is making it real or tangible to the business. One of the ways to make security ‘real’ to the business is to use risk and to have conversations with the business about the security controls needed to address risks. Although almost all of the participants referred to risk, and the use of risk in their different roles, reliance on risk to ‘sell’ security seemed to be

Cyber Security Skills Development

problematic for a number of the participants.

The heavy focus by practitioners on “selling” security and talking to the business about risk may indicate that information security practitioners are not identifying the fundamental organisational and human security issues at work in their environment. Mapping and understanding social networks is a fundamental part of security practitioner work and yet few practitioners have the background, skills or tools to achieve this.

The 21st century information security practitioner: A community in flux When talking about definitions of information security and the broader security community, the practitioners described a community in flux.

For most participants, information is no longer about confidentiality, integrity and availability (CI&A) or about protecting assets: it is about information, services and infrastructure. This extended theatre for information security is consistent with the view that information security has changed over the last 20 to 30 years, moving from a technical solution, largely involving organisational information technology systems and security measures that could be implemented in a controlled space, to something much broader. In the current context the traditional constructs of information security, including that information security is about ensuring CI&A of assets, may no longer be adequate.

A number of the interviewees talked about information security in a way which suggested that information security may have two meanings: in addition to the practice of securing assets, services and people, information security, may also regarded as supporting a set of values. Used in this way, information security may be about ‘doing the right thing’ or doing good.

The proposition that information security may be a value laden concept resonated with findings from the narratives of the every-day. The experience of many of the practitioners suggests that, in many cases, information security decisions may involve a contest between different parts of the organisation that requires a much deeper understanding by information security practitioners of the competing values that may underpin both information security and organisational decision-making which in turn might support a more meaningful way to prioritise information security in management’s agenda than the risk and threat scenarios typically relied on.

However, while practitioners seem to be moving towards a more nuanced and value-laden concept of ‘information security’ it seems that the business perception of information security may still be rooted in technology, with a number of participants stating that, within their organisations, information security is still regarded by some as a technology problem with a technical solution. This is notwithstanding the efforts of information security practitioners to ‘sell’ information security to the business in a more meaningful way and a general appreciation of the need to communicate the value of information security.

39 | Chief IT

Opportunities The findings from this research suggest that it may be time to re-look at some of the core premises that support accepted information security management practice.

It is clear that a deeper understanding of the world of the information security practitioner, the environments in which they operate, the challenges faced and the skills required in the changing world would be of enormous benefit to the community at a time when the information security space could be regarded as being at a crossroads.

Such an understanding will, among other things, enable organisations like AISA to develop and deliver innovative skills development and training programs to equip a broad range of practitioners to meet the challenges of security in the 21st century.

Another aspect of the findings that may be of interest to other researchers is the proposition that information security may be based on values, and as a consequence that information security cannot be properly supported and operationalised without identifying the values that information security is seeking to protect. An improved understanding of information security values may support a more meaningful way of prioritising information security within the wider organisation agenda, rather than via the traditional techniques which rely on the language of risk and threat scenarios.

Conclusion The pilot study supported by AISA provides a uniquely valuable perspective of the every-day life of Australian information security practitioners. For the first time we understand a little about what practitioners do, giving form to the challenges faced by them and the contested, uncertain and changing environment in which they operate.

Whilst in some ways unsettling, the results of the study allow a new conversation to take place going beyond technical controls and focusing on how best to support information security practitioners in the new paradigm of the 21st century. AISA is delighted to have been associated with this important piece of research.

About the Author – Dr Jodie Siganto Jodie Siganto graduated as a lawyer from the University of Queensland and after 8 years in private practice became in-house counsel for Tandem Computers followed by roles with Unisys Asia and Dell based in Singapore.

She returned to Australia in 2000 and co-founded Bridge Point Communications (specialists in data networking and security). She is currently a director of IT Security Training Aus-tralia, an (ISC)² educational affiliate, specializing in the delivery and development of privacy, IT secu-rity and network related training courses around Australia. Jodie has completed a PhD at QUT which examined the Privacy Commissioner’s exercise of powers in relation to NPP 4 and the extent to which that is supportive of industry practice.

Jodie is the Chair of the AISA Policy Committee and a mem-ber of the AISA Education workgroup.

Australian Security Magazine | 41

Available online!

See our website for details

1 YEAR SUBSCRIPTION TO THE AUSTRALIAN SECURITY MAGAZINE

Get each print issue per year for only $88.00 SUBSCRIBE TODAY... DON’T MISS AN ISSUE Yes! I wish to subscribe to the Australian Security Magazine, (1 year). ☐

AUSTRALIA

A$

88.00

(inc GST)

1 YEAR

☐

INTERNATIONAL

A$

158.00

(inc GST)

1 YEAR

Yes! As an additional bonus I wish to receive direct to my inbox the Asia Pacific Security Magazine (emag)

No business or government organisation survives in a vacuum. Sharing knowledge is fundamental to the development of successful security planning and implementation.

That is the role of our magazine: sharing knowledge of developments in security management for public and private sector organisations, both for internal management and for external obligations in public safety and security.

Go to

www.australiansecuritymagazine.com.au/subscribe and fill in our subscription form online. Dont miss an issue!

Phone: +61 (8) 6465 4732 during business hours AWST (Australia Only)

42 | Australian Security Magazine 40 | Chief IT

PRIORITY FAX Credit Card Details Australia +61 (8) 9467 9155

FREE POST My Security Media 286 Alexander Drive, Dianella. W.A. 6059

Email subscriptions@mysecurity.com.au

GST This document will become a TAX INVOICE for GST when payment is made. My Security Media Pty Ltd ABN 54 145 849 056

Within TechTime you will find the very latest information, news and products from a wide variety of security industries, ranging from cameras, computers, software and hardware.

Illustra Pro 2 megapixel 30x PTZ camera,

To have your company news or latest products featured in our TechTime section, please email promoteme@australiansecuritymagazine.com.au 41 | Chief IT

Latest News and Products Australian Security Magazine | 43

TechTime - latest news and products

Astute Smart Locks launches Noke – the world’s smartest bluetooth padlock Astute Smart Locks, a thought leader and pioneer of smart lock & smart access technology, is excited to announce the launch of Noke into the Australian market.

Noke is a bluetooth enabled smart padlock that you unlock with your smartphone eliminating the hassle of keys and combinations forever! All Noke locks are compatible with iOS, Android and Windows smartphones, and work in conjunction with the Noke app for smart, convenient security.

Features Designed to be the simplest electronic device you own, Noke automatically finds and connects to your Bluetooth 4.0 enabled smartphone.

Instead of fumbling for keys, simply walk up to your Noke, press the shackle, and instantly access your possessions.

Noke’s app even lets you share guest access with friends and family, so they can unlock your Noke with their own smartphone.

You can allow a guest unlimited access, onetime access, or create a custom schedule of specific times and days of the week.

For added control and peace of mind, Noke lets you monitor its history so you know where, when, and by whom your lock was accessed.

In case your smartphone battery dies, Noke has a back-up plan called ‘Quick-Click,’ so you’re never left stranded. Noke’s QuickClick technology allows you to create a custom access code of short and long clicks on the shackle so you have the option to open it manually if necessary.

Security Noke uses the latest in anti-shim technology so security is not compromised. It also uses the latest in PKI technology and cryptographic key exchange protocol to stand up to hackers.

Product Quality Made of boron-hardened steel, Noke is not only attractive, but also incredibly strong.

It’s designed to stand up to the toughest environments and weather conditions so Noke can go where you go.

Battery Noke locks are packed with a long lasting battery, giving you over a year’s worth of use before needing to be replaced or recharged.

Fleet Management

44 | Australian Security Magazine 42 | Chief IT

With Noke, it’s easy to take the benefits of a smart lock—ease, convenience, control, security, durability—and scaling that to work for an entire enterprise. It will help professionals better manage their fleet by allowing them to be the administrator over an unlimited amount of locks.

They can issue locks to individual employees, while still having the power to revoke access as well as monitor where and when the locks are used. No more giving up control and no more changing locks and combinations again.

Bluetooth: 4.0 Battery: 2032 coin cell battery For more information, please visit: www. astutesmartlocks.com or email: info@ astutesmartlocks.com

Customers Noke locks are wildly popular among all ages and demographics. Kids tend to use Noke on bikes and school lockers, while adults use Noke for locking up their back gate, gym locker, storage units, shed, cabin, trailer and more. Noke also accommodates business professionals by adding control to everyday security needs ranging from enterprise shipping containers to individual employee lockers.

The use cases are endless and the benefits unparalleled.

Noke Padlock Specs Material: Zinc alloy body with boron-hardened steel shackle Colors: Silver, Black Water Resistant Strength Rating: IP66 Operating Temperature Range: -23degC to 65degC Security: PKI technology and cryptographic key exchange protocol

Information presented in TechTime is provided by the relevant advertiser and are not necessarily the views of My Security Media

TechTime - latest news and products

Improving forensic searching & identification at greater distances Tyco Security Products introduces the new Illustra Pro 2 megapixel 30x PTZ camera, offering a powerful 30x optical zoom to deliver better forensic detail over greater distances.

The new Illustra Pro PTZ camera offers 30x optical zoom and 12x digital zoom, compared with the 20x zoom of the previous Illustra PTZ model. The combination of the PTZ’s advanced optical capability and high quality HD resolution video allows users to identify critical details such as reading license plate characters at distances of more than 1,000 away from the camera.

To improve operator control with better precision and control accuracy, the Illustra PTZ uses zoom adjusted program (ZAP) technology to automatically control the pan and tilt speed in proportion to the amount of zoom used.

The Illustra Pro 2MP 30x PTZ helps reduce the costs in network overheads and storage costs with improved low light performance and noise reduction.

Available in indoor and outdoor models, the new Illustra Pro PTZ delivers a greatly improved true wide dynamic range performance ensuring premium quality surveillance is maintained in the most challenging of lighting conditions.

These camera’s clear video quality is maintained during rain, fog or snow through the advanced auto defog feature, while the whiteout highlight reduction feature ensures that car headlights or street lamps do not compromise the image during nighttime surveillance. The 30x PTZ also supports electronic image stabilization for lower effects of vibrations from wind and other sources when using long range optical magnification.

This Illustra Pro 30x PTZ introduces a new

intelligent guard tour feature using embedded intelligence to autonomously track, zoom in and record events or suspicious activities, allowing the operator to concentrate on other priorities without missing any vital activities.

This feature unites motion detection, auto tracking and preset sequences to allow the PTZ to perform independent of a control room operator. While moving through a preset tour without an operator present, the intelligent

guard tour feature enables the camera to deliver the video evidence needed to identify key details necessary, often making the difference in forensic investigations.

Milestone appoints Hikvision as elite partner Milestone Systems, the open platform company in networked video management software (VMS), has elevated Hikvision to the status of Elite Partner in the Milestone Camera Partner Program (CaPP).

To be named a Milestone Elite partner, companies must demonstrate outstanding sales, implementation, consulting and support for Milestone Systems solutions and consistently show excellence in business initiatives and marketing. Both companies have dedicated targeted efforts to elevate the mutual technical and commercial engagement to a new level, resulting in the Elite Partner status for Hikvision.

Information presented in TechTime is provided by the relevant advertiser and are not necessarily the views of My Security Media

43 | Chief IT

“To achieve Milestone Elite level status a camera partner must demonstrate commitment in achieving maximum return on investment for our joint customers through superior product knowledge and a focus on long-term customer satisfaction,” says Henrik Sydbo Hansen, Head of the Camera Partner Program at Milestone Systems. “From this increased partnership our channel partners and customers will receive an exclusive level of engagement and commitment with the advantage of cost-effective camera technology fully supported by Milestone software.”

The ongoing relationship between Hikvision

and Milestone Systems has been evolving over the past several years, and the announcement of Elite status demonstrates the solidity of an already close partnership.

Australian Security Magazine | 45

TechTime - latest news and products

New compact external drive provides highcapacity storage.

Seagate Technology has announced the launch of the Seagate Backup Plus Ultra Slim, the world’s thinnest 2TB mobile hard drive. This new product builds on the award-winning Backup Plus Slim drive, delivering a stunning new design with the same leading capacity in an even slimmer profile. The Backup Plus Ultra Slim also includes 200GB of Microsoft OneDrive cloud storage and Lyve software compatibility, so users can back up, access and share their favourite files from any device or location.

“The launch of the Backup Plus Ultra Slim builds on Seagate’s rich history of awardwinning innovation to give users even more capacity in an incredibly small form factor,” said Tim Bucher, vice president for Seagate’s Consumer Group. “Based on our breakthrough ultra-mobile hard drive technology, this new

storage solution gives them a better way to manage the increase in both data volumes and number of devices.”

At just 9.6mm, the Backup Plus Ultra Slim external drive employs Seagate’s latest 2.5-inch HDD technology, making it more than 50 percent thinner than other 2TB drives on the market.

Thanks to its low-profile, high-capacity design, users can keep more than 500,000 songs, 320,000 photos or 240 hours of high definition video in their pocket*. Available in gorgeous golden or platinum metal finish, this sleek new product is designed to complement the looks of stylish computers, tablets and phones.

Thales nShield hardware security modules secure Vormetric data security manager Thales and Vormetric have announced that the Vormetric Data Security Manager (DSM) is now secured with Thales nShield hardware security modules (HSMs). Customers in highly regulated and security conscious industries such as finance and banking can now benefit from the heightened levels of trust and security provided

by Thales HSMs. Vormetric DSM centralizes control of dataat-rest security enabling organisations to protect their sensitive data and meet new security

mandates and compliance requirements. Where high levels of trust and security are demanded Thales HSMs provide FIPS 140-2 certified protection and key management.

To meet the demands of customers with deployments distributed across multiple data centres, Thales HSMs offer Vormetric a superior approach to HSM initialization and ongoing administration. By utilizing the unique Thales Security World architecture customers can increase their security posture without the

operational difficulties often associated with alternative solutions.

Thales recently signed a definitive agreement to acquire Vormetric which, when completed, will extend Thales’ data protection and key management solutions to further protect enterprises against cybersecurity threats.

Secure Identity Alliance (SIA) publishes ‘Civil Registry Consolidation’ With identity a key priority on the United Nations’ 2030 Agenda for Sustainable Development, the Secure Identity Alliance (SIA) has published a report outlining a best practice approach for consolidating civil registries through national electronic identity (ID) schemes.

The SIA’s ‘Civil Registry Consolidation through Digital Identity Management’ report provides the deep sector insight necessary to support the development of government registration and identity programs across the world – particularly in the developing world

46 | Australian Security Magazine 44 | Chief IT

where many citizens lack official documentation to prove their identity.

For those countries that have implemented an electronic identity program, but whose civil registry is incomplete, the existence of an eID database is a chance to rebuild a comprehensive registration process. When national ID systems and civil registration are not at the same level of development, a circular and dynamic approach between civil registration and eID systems can be used to complete them both.

This report should be of particular interest

to international organisations and government agencies involved in the establishment or reorganization of civil registration and identity systems across the world.

With a global population set to reach 11.2 billion by the end of the century, the ongoing European and MiddleEast refugee crisis and growing population mobility, identity is a key geopolitical issue.

Information presented in TechTime is provided by the relevant advertiser and are not necessarily the views of My Security Media

TechTime - latest news and products

Senstar Announces FiberPatrol-PL for pipeline integrity monitoring Senstar has announced FiberPatrol-PL, an advanced security system for buried pipelines, optimized to detect third-party interference (TPI).

FiberPatrol-PL is the latest addition to Senstar’s renowned FiberPatrol intrusion detection systems, which have been protecting critical infrastructure around the world since 2009.

FiberPatrol-PL uses fiber optic cable buried along the pipeline to detect and locate ground vibrations and acoustic signatures associated with TPI activity. A single FiberPatrol-PL processor can detect and locate TPI over a distance of up to 72 km (45 mi) and within 10 m (33 ft) accuracy.

“FiberPatrol-PL provides the longest protection per single processor currently on the market, addressing one of the biggest issues to effectively securing pipelines – covering long distances between above-ground infrastructure

locations where electronic equipment can be installed,” said Senstar’s Product Manager Stewart Dewar. “No electronics, power, communications infrastructure or grounding points are required for spans of up to 72 km (fiber distance), making FiberPatrol-PL a costeffective solution for long pipelines.”

FiberPatrol-PL detects TPI activity that threatens pipeline integrity: machine or manual digging, heavy machinery operating nearby, and even people walking in the vicinity of the pipeline. The system’s advanced detection algorithms optimize the detection of TPI activity while rejecting nuisance alarms. It can also reject vibrations caused by traffic on roads and railways running parallel or perpendicular to the pipeline.

About Senstar Corporation Senstar, the trusted innovator safeguarding people, places and property, has been manufacturing, selling and supporting the world’s largest portfolio of perimeter intrusion detection sensor technologies for more than 30 years. Senstar is also a leading provider of life safety / emergency call solutions, cyber solutions that protect security networks against threats, and a cellular detection and location solution. Senstar’s products and solutions can be found around the world in more than 80 countries, in tens of thousands of sites including borders, ports, military and government, correctional facilities, and other critical sites.

Pelco by Schneider Electric announces integration of Optera and Spectra camera ranges.

Pelco by Schneider Electric has announced that its Optera range of panoramic cameras as well as Spectra Enhanced high-speed PTZ domes are now compatible with the latest version of the Genetec, Inc. Security Center, 5.3 (SR3).

This collaboration reflects Pelco’s continuing commitment to provide fully integrated, robust solutions.

“This certification and integration gives our joint customers two more options for clear, state-of-the-art video images,” said Jonathan Lewit, Director of Business Application at Pelco

by Schneider Electric. “These integrations provide security professionals with better situational awareness by leveraging the panomersive experience and the full analytics capabilities in both Optera and Spectra Enhanced cameras.”

In this suite, the new version of Security Center will benefit those with a need for improved motion detection responses, with motion indicator bars now visible in the Security Desk timeline. Security Center 5.3 also features simplified tools for security investigations that promote collaboration between operators and external organisations, such as support of presets, the ability to display multiple cameras simultaneously, and sharing of select Automatic License Plate Recognition (ALPR) data.

Information presented in TechTime is provided by the relevant advertiser and are not necessarily the views of My Security Media

45 | Chief IT

In turn, Security Center 5.3 users will be able to enjoy the advanced image quality delivered by the award-winning Optera and Spectra Enhanced range of cameras. The Security Center 5.3 integration with Optera enables a separate view of a continuous panorama in a single cell. This feature is made possible exclusively through this innovative integration and is the first of its kind in the industry.

The Optera series delivers a single seamless view of a panoramic, 180° scene, constructed from four 3MP image sensors. With full ePTZ on both live and playback video, Optera provides stitched and blended panoramic views to gain great situational awareness. SureVision 2.0 image processing and Anti-Bloom technologies enable outstanding image quality in the most challenging of lighting conditions, without ever leaving true wide dynamic range (WDR) imaging.

Spectra Enhanced provides industry-leading image quality and great PTZ control along with SureVision 2.0 and 130 dB WDR, at up to 60 images per second video. These and a whole host of features make the camera system an ideal solution for detecting and capturing faces, license plates, tattoos, and evidentiary details in nearly any lighting situation.

“These releases further strengthen the tight relationship between Pelco and Genetec Inc.

with mutual dedication to an integrated product offering and the highest industry standards that each require of their products,” added Lewit.

Pelco customers can access Genetec Security Center 5.3 information as well as additional integration details on the Partner First website. Pelco’s Partner First program marks a new level of openness and commitment to identify and bring to market additional features, capabilities and solutions through development of strategic partnerships.

For more information about Genetec, visit: www.genetec.com

Australian Security Magazine | 47

I THE DIGITAL AGE THE DE F I N I T I VE CYBE RSE C U R I T Y G U I D E F OR DI RE CTORS AN D O F F I C E R S

Navigating the digital age: The definitive cybersecurity guide for Directors and Officers Front Cover.indd 1

48 | Australian Security Magazine 46 | Chief IT

11/09/15 2:31 pm

n 2005 I conducted a thesis study on security risk management in corporate governance and surveyed sixty ASX200 listed companies.

The study determined there was a significant lack of security risk awareness at board level within Australian public companies and less than 30 percent had a security related policy in contrast to safety, environment and financial risk.

A decade on, we have far more powerful and cheaper cyber networks, mobile devices and connected things. The global security threat environment for business has clearly worsened and cyber security has evolved to beyond simply an IT issue but a “business problem of the highest level” (Sharf, CEO Visa Inc). With this in mind, Palo Alto Networks has produced a ‘must read’ for any Company Director and C-suite officer.

In its 2015 Data Breach Report, Verizon found that 60 percent of the nearly 80,000 security incidents reviewed, including more than 2,000 confirmed data breaches, cyber attackers were able to compromise an organisation within minutes. Alarmingly, only about one third of the compromises were discovered within days of their occurrence (Brewer, Fmr CIO, US Department of Energy). The current average discovery takes 205 days (Ashar Aziz, FireEye, October 2015).

As attacks continue, they are also likely to increase in sophistication and profitability and is “simple for hackers to assemble very accurate profiles of individuals and their positions in companies and launch socially engineered attacks or campaigns. These attacks can be hard to spot in the absence of proper training for individuals, and difficult to control in the absence of good practices and procedures regardless of how good the technology is that is deployed to protect an organisation.” (McLaughlin, CEO, Palo Alto Networks) A survey on behalf of KPMG found that of 130 global institutional investors, with $3 trillion under management, affirmed that cyber events may affect investor confidence in the board and demand for the affected company’s shares. Investors opined less than half of boards of the companies they currently invest in have adequate skills to manage rising cyber threats. It was also found 43 percent of board members have ‘unacceptable skills and knowledge to manage innovation and risk in a digital world.’ 86 percent of investors want to see increases in time boards spend on addressing cyber risk.” Boards would be wise to raise their game by disclosing more detail of their board oversight efforts and engaging with investors when cyber incidents occur, or they may run the risk of a loss of investor confidence.

(McGurn, ISS Special Counsel) For additional verification of this issue,

according to a PWC report, Deciding on Data, in 2013 Australia missed out on $48 billion of potential data-driven productivity improvements, particularly within government, health and agriculture. Yet a thriving innovation ecosystem has the potential to increase Australia’s productivity and raise GDP by $37 billion in 2024. (Kumar, WAdirector, Issue 54, Australian Institute of Company Directors) World Economic Forum research showed 90 percent of executives feel they only have nascent and developing capabilities to combat cyber threats. Still very few organisations have developed ways to assess their cyber risk exposure and to quantify them. The aggregate impact of cybercrime on the global economy can amount to $3 trillion in terms of slowdown in digitisation and growth and result in the slower adoption of innovation. Even the annual cost of economic espionage reaches $445 billion. As an example, Target’s breach cost the company more than $140 million, a large portion of which went to cover litigation costs. Aon research shows that more than 80 percent of breaches cost the companies less than $1 million. (Kvochko & Kerimi, World Economic Forum) Although a silver bullet to achieve cyber resilience doesn’t exist, organisations need to consider comprehensive frameworks for quantifying and mitigating risk factors, including cyber risks. For organisations the focus will shift from the attacker to assets and how to secure them in a distributed digital ecosystem, where everything is vulnerable. (Kvochko & Kerimi, World Economic Forum) The attacker’s business plans are expansive with extremely generous profit margins. Multiple reports suggest cybercrime is in the hundreds of billions of dollars. They can use identical attack methods against multiple targets and their ‘market’ is accessible to them worldwide. Meanwhile, cyber defence tends to be almost a generation behind as anticipating the method and point of attack is extremely difficult. Moreover, law enforcement is almost non-existent with less than 2 percent of cyber criminals prosecuted. Traditional government methods to fight criminal activity have not matured to address the threat and may be inappropriate to meet the dynamic nature of this uniquely twenty-first century problem.

Notwithstanding also that consumers tend to prefer utility and function over security, which is a disincentive for companies to enhance new devices with added security, which often slows or limits utility. Corporate boards are faced with the conundrum of needing to use technology to grow and maintain their enterprises without risking the corporate Crown Jewels or hard won public faith

in the bargain. (Clinton, CEO Internet Security Alliance) Directors are well advised to proactively fulfil their risk oversight functions by driving senior management toward a well-developed and resilient Cybersecurity program (Kim & Dunne). Corporate spending on Cybersecurity has doubled over the past few years and totals more than US$100 billion a year. In contrast, the total US Government spending on Cybersecurity is generally estimated to be near US$16 billion.

Despite the spotlight on Cybersecurity one recent survey found nearly half of directors had not discussed the company’s crisis response plan in the event of a breach or other considerations around insurance, engaging experts, risk disclosures, national standards and compliance frameworks.

(Clinton, ISA) To help accelerate toward the same level of stability and comfort had with financial and other risk issues, a board level Cybersecurity blueprint may include six key areas: 1. Inclusive board level discussion and empowering all directors to be accountable for Cybersecurity; 2. Proactive cyber risk management should incorporate Cybersecurity into early stage business decisions; 3. Differentiate assets for varying levels of security and Cybersecurity; 4. Investment in human defences will ensure the organisation’s cybersecurity investment goes beyond technical to include awareness, education and training programs for employees.

5. Limit exposure through business partners; and 6. Incident response policies and procedures to mitigate risk should a breach occur. (Cox) One of the most important defences against cyber-attack is an informed, vigilant employee population. Employees and executives are often targeted with carefully crafted emails designed to be relevant to the employer’s personal or work life. In reality these emails are loaded with malicious code. One click by a less careful individual can deploy a cyber weapon into the company’s network and execute various actions that shut down critical business functions or steal information and accounts. The bottom line is that human behaviour is equally important as security technologies in defending against cyber threats.

Boards should know if employee awareness and training programs are in place and how effective they are. It also helps to build a culture of security awareness. (Cote) Under executive leadership it is very

47 | Chief IT

important that there is continued improvement in processes used to manage the security of organisations. People must be continually trained on how to identify cyber-attacks for people to take appropriate steps to take in the event of an attack.”

(McLaughlin, CEO, Palo Alto Networks) In the wake of a breach, a victim’s security will also come under scrutiny, and a contractual counterpart may argue that the security was inadequate under the contract. It is difficult to define such terms adequately and still provide flexibility in the face of changing threats. (Woods, Banno, Graves) This book is a compilation of contributions from subject matter experts and business leaders and details all relevant and critical issues, considerations and best practice solutions for what is indeed a twenty-first century problem.

Technology continues to progress rapidly. Note 2015 was the year the Future of Life Institute released a letter signed by some 1,500 artificial intelligence (AI), robotics and technology researchers calling for an international ban on offensive autonomous weapons, which could target and fire weapons without meaningful human control.

Companies must be in front of the game wherever possible and cyber security is one such critical element and a business enabler – the subject matter is broad but this book will steer you in the right direction for cyber threats, cyber insurance, understanding cyber espionage and theft of trade secrets, combatting the insider threat and importantly, the needs for corporate structures, legal and regulatory considerations and incident response, risk management and workforce development.

Recommended and essential reading for any public or private sector senior officer, director and above.

Thanks to Palo Alto Networks and Recognition PR for the holiday season read.

We also look forward to hosting executive boardroom lunches with Palo Alto Networks during 2016. If you have a Director or CXO needing to get across the issues, I welcome to register your interest here: editor@australiansecuritymagazine.com.au

Australian Security Magazine | 49

48 | Chief IT

The Region’s Leading Government and Corporate Security Portals

Print Post Approved PP255003/10110

Print Post Approved PP255003/10110

THE REGION’S LEADING GOVERNMENT AND CORPORATE SECURITY MAGAZINE | www.asiapacificsecuritymagazine.com THE COUNTRY’S LEADING GOVERNMENT AND CORPORATE SECURITY MAGAZINE | www.australiansecuritymagazine.com.au July/Aug 2015 Aug/Sep 2015

Security 2015 Q&A ONVIF & COMPLIANCE

PART II Counter-Terrorism Feature Radicalisation, Role of the Media & ISIS Social Media Tactics

Mobile Messaging

It’s all about Cyber Security

IMPROVED BORDER SECURITY The Holy Grail for airports

Security & Risk Management the next evolution

Outstanding Security Performance awards, the OSPAs

Torrentlocker malware reported to the Australian cybercrime online reporting network

From Infosec to intelligence-based cybersecurity

UAVs civil market future expectations

The stratum of work in the security industry

The modern ‘Sherlock Holmes’ of the cyber world…in Silicon Valley

THREATS ARE MOUNTING ACROSS THE TECHNOLOGY LANDSCAPE

PLUS

PLUS

$8.95 INC. GST

TechTime l Cyber-TechTime Movers & Shakers l Quick Q&A and much more...

ASM_AUG_SEPTEMBER_2015.indd 1

$8.95 INC. GST

TechTime l Cyber-TechTime Movers & Shakers l Quick Q&A and much more...

4/09/2015 12:31:08 PM

|

|

For more information and to subscribe visit: www.australiansecuritymagazine.com.au | www.asiapacificsecuritymagazine.com 49 | Chief IT

CivSec 2016 CONGRESS AND EXPOSITION 31 MAY - 2 JUNE 2016 MELBOURNE AUSTRALIA

CIVIL SECURITY AND CIVIL DEFENCE FOR THE INDO-ASIA-PACIFIC A COMPREHENSIVE FORUM FOR LEADERS AND PROFESSIONALS Border Control l Transport, Resource and Infrastructure Security l Physical, Cyber and CBRNE Security l Policing and Emergency Services l Surveillance, Intelligence and Response l Community Safety and Public Protection l Disaster Relief and Humanitarian Assistance l Remediation, Reconstruction and Resilience l Safety, Search and Rescue l Capability and Research l Technology and Innovation

l

FREE ADMISSION - PRE-REGISTRATION REQUIRED

www.civsec.com.au 50 | Chief IT