Jess THOMAS
Good morning, everyone, and welcome to the securing Australia together webinar. It's a pleasure to have you all with us today. I'm Jess Thomas, an assistant director at the National Office of Cybersecurity. I'd like to begin by acknowledging the traditional custodians on the lands from which we are all joining today.
I'm joining from the lands of the Gadigal people of the Eora nation. I would like to express my respect and gratitude to the elders, past and present, and extend that to any First Nations people who have joined us today.
Alison Pike
I'll leave you with it.
Jess THOMAS
The purpose of this event is to highlight how the big four banks and the Knox are working to secure Australia against cyber threats together and we are very lucky to have some incredible speakers which I will formally introduce shortly. But first I'd like to take you through some housekeeping.
Due to the large number of attendees, microphones and cameras are switched off for all attendees. This event will be recorded and made available at a later time by the bank's websites and by the National Office of Cybersecurity.
Information about how to access the recording will be distributed following the event. You will also receive an e-mail with a list of cybersecurity resources to help your business. This is the first securing Australia together webinar.
But we would like it like for it to continue and would value your feedback to make the next edition even better. If you would like to provide feedback, please follow the instructions in the e-mail you will receive following this event shortly. We will hear from the National Cybersecurity coordinator, Lieutenant General Michelle McGuinness.
The coordinator has come to us from a 30 year military career both in Australia and overseas. She was appointed to the role in February 2024 as coordinator General. McGuinness leads national cybersecurity policy.
The coordination of responses to major cyber incidents, whole of government cyber incident preparedness efforts and the strengthening of Commonwealth cybersecurity capability.
Following the coordinators address, she will moderate the panel discussion with A&Z's chief Information Security Officer, Doctor Maria Milosavljevic, Commbank's Chief Security Officer Nicola Nicol, NAB's Chief Security officer Sandro Bucchianeri.
And Westpac's chief information security officer Richard Johnson, following this there will be a short audience Q&A where we will put to the panel some of the questions you submitted during the registration process. We received too many questions to answer during the allocated time, but have chosen a representation of the key themes that came through. We hope you leave today with a stronger understanding of how to strengthen the cyber security of your own business and a sense that as a nation we are on our way to securing Australia together.
With that in mind, I will now hand over to the National Cybersecurity coordinator.
Apologies, Michelle. I think you're on mute.
There we go.
Michelle McGuinness
Thank you, Jess. Thank you so much for that and good morning, ladies and gentlemen. I am so pleased that you all made the time in your busy schedules to attend today. It tells me that you know that cyber threats pose significant risk and you know what it could mean for your businesses and more than that, potentially for your livelihoods. Your attendance, I believe, is a critical step toward not only securing yourself against these threats, but as Jess has mentioned, securing Australia together. This is a journey that we're on together.
We want you. That is all the small and medium business owners out there to leave today being super clear about what's at stake, what you can do, what you can start, what you can continue so that you can secure your business from cyber threats.
And I don't think there's any better time to do this than during the 2025 Cybersecurity Awareness Month, which is now, let me just take a minute to add my personal acknowledgement of the custodians of the lands on which we all join from today. And I pay my respects to elders, past and present.
And extend that to any First Nations people who are joining us today as well.
And of course, thank you to our great panel who will be sharing expertise, their collective knowledge and experience is incredibly valuable to us and demonstrates how essential our partnership is. The partnership between government and business and what we're doing to strengthen our nation's cybersecurity.
My hope is that during this hour it will give you a practical jump start, give you steps no matter where you might be on your journey to uplift your own cyber security. Our panel will detail the most important answers to the questions that you and your customers have.
Including the cyber threats and the risks they pose to your business and clients, we'll also hear about cybersecurity investments and what role AI may play in all of this.
Importantly, we will start with discussing how to build a cyber safe culture in your business.
This is really important and where I do want to start, it is fundamental and foundational to our strategy. The Australian Cybersecurity Strategy and the success of our vision. Under that strategy, my team, the National Office of
Cybersecurity or the NOCS.
And I work to uplift and support the resilience of our government, our businesses and citizens, and we do that every day in order to prevent, prepare, respond to and recover from cybersecurity incidents.
We cannot do this without support and engagement from across all sectors. This includes sharing knowledge and strengthening our partnerships and relationships. That's why a key priority is really helping every Australian to do their part to become more secure.
Whether it be in our homes, our schools, our workplaces, absolutely everyone has a role to play for Australia to be cyber secure, we really are only as strong as our weakest link as business owners. Many of you, I suspect, without dedicated IT teams.
I know there is a lot on your shoulders and if you do have staff they are juggling so many other tasks.
So many of you tell us that you find cybersecurity rather new and daunting, and sometimes it can be paralysing. That's why we're taking this partnership approach. The government seeks to reduce the burden on small businesses in every way that we can, and we want to help you do what you do best, which is focus on your business and the goods and the services that you provide.
Ultimately, we want to and need you to thrive. We want you to be innovating and delivering and not paralysed by cybersecurity threats, so I'm not even knowing where to start. So today's event it is the first of its kind, as Jess said, demonstrates this partnership approach in action.
We know that the daily running of a business takes so much of your time, energy, budget and attention. In fact, it might take everything you have if you're like many people, this means you might be putting off tasks of working out what cybersecurity is about and what you can do about it.
You may be unsure about where to start, and it would be very natural to put in this in too hard basket crossing your fingers, closing your eyes and hoping that things will be OK.
But even the last 18 months tells us there is too much at stake to rely on luck. More than ever, it's proving to be a question of when, and not if a cyber-incident will happen. I've been in this role, as Jess said, for just over 20 months, and I'm supported by a great team of people who work hard at delivering our cyber strategy
every day which seeks to position us as a world leader in cybersecurity.
For those who aren't aware, the strategy is structured around 6 Shields.
These Shields together create interlocking layers of defence. It includes ensuring that our technology is safe, particularly for our smart devices, that we have mechanisms to rapidly share and block threats to protect our critical infrastructure.
It also seeks to enhance our sovereignty, making us less reliant on supply chains we can't control.
Building our workforce and of course building a resilient Indo Pacific region and being a leader in the world.
All of that said, small and medium businesses are right at the very heart of our strategy and have their own shield. In shield one more than 97% of Australian businesses are considered small businesses. So what you do every day keeps us as a nation running.
Small business owners are disproportionately targeted by cyber criminals because they are seen as a soft underbelly and easier mark. The risks are high and the costs are growing, but you're not alone.
We, as the government are working with businesses to ensure that you are protected from cyber threats and as you can see today, our big industry and our banking partners are with us on that journey.
Genuine partnership with government and private enterprises have and will continue to build on our respective strengths and are the absolute jewel in our crown in getting after this threat.
Today, we're going to benefit from, as I said, the incredible and valuable insights of our nation's largest banks. I think they know better than anyone where vulnerabilities are and are sharing today so that you can strengthen your own
cyber defences for your businesses.
And ultimately we drive uplift through this across the nation because when it comes to being cyber secure, we are all connected.
As the banks know, many of the cyber incidents and online scams are successful because of unwitting participation by intended victims, in other words, so much of this includes human error. Maybe the biggest piece and the most affordable way we can be efficient in uplifting our cybersecurity is to actually uplift our awareness as humans.
You know, the minister said it at the AFR Summit recently that we need to build a human firewall.
This requires a cultural shift. The best protection you can offer your business is to raise the consciousness of your people around what are good cyber health practises, because cybersecurity is everyone's business.
We know that cultural shifts are also hard and challenging. As leaders, we all have a role to play in making this happen across our organisations.
To strengthen that human firewall and make sure that we're as prepared and resilient as we can be when attacks occur.
This means embedding security across every function of your business. This is not just an issue for our IT experts. Like any significant business risk, this requires awareness, training and prioritisation. I'm really looking forward to hearing from our panel on changing our culture. But also on supply chain vulnerabilities and how critical it is to understand your connections and networks.
As well as rehearsing scenarios by running through an incident, these are some of the best ways to identify our connections and potential vulnerabilities, so you'll know the state of play. And you don't want to be doing this for the first time in the middle of an incident, so practising and having plans are really important.
Before we share these discussions and I turn to the panel, I do want to say we know people need practical, simple steps if they're going to embrace cybersecure behaviours. So we have a few resources out there for you. Our key message is obviously at the forefront, Act Now Stay Secure. This is a government campaign. We have a website that outlines 3 key actions for every Australian to protect themselves online. It won't surprise you and hopefully you've seen the media, use a unique and strong pass phrase for every account. Don't share passwords.
Install all software updates to keep your devices secure and always set up multi factor authentication when available. In addition to that, we want everyone to be aware of the proliferation of scams and how to recognise them and what to do. Don't respond. Hang up. Source your own confirmed telephone number or e-mail to contact your bank if you think it's legitimate. There are absolutely simple actions we can all do and they work. Whether you're an individual or a business.
Please visit actnowstaysecure.gov dot.au I'm also really excited to share with you a new cyber health check tool. It's been developed with the Australian Signals Directorate.
It's a simple 5 minute cybersecurity assessment, perfect for small businesses and not-for-profit organisations. And in fact it's custom made for people who want to know where to start.
This plain English tool asks simple cybersecurity questions and provides an instant cybersecurity health check score and rating. Not only that, but a tailored action plan along with a prioritised list of actions that you can take after you've done.
It's a health check to improve your own cybersecurity.
Visit cyber.gov.au to access the cyber health check tool, along with a range of other free resources like the ransomware playbook and a host of other things that we put on that site.
The government also offers one-on-one assistance with cyber capability challenges, resilience and recovery through the small business Cyber Resilience Service program. This can be accessed through idcare.org/smallbusiness.
These resources will be shared with you at the end.
Before I wrap up and turn to our fantastic panel, let me just touch on the cyber elephant in the room. AI. We are experiencing AI's benefits and beginning to better understand its risks and it's happening really quickly. Notwithstanding the immense opportunities that AI offers, it will almost certainly increase national security risks.
Likely to be compounded by potential risks that we haven't contemplated yet relating to data security, integrity and more, the Australian government is taking steps to mitigate the risks presented by AI.
They include providing practical guidance to Australians through the voluntary AI safety standards to support businesses to adopt AI in a safe manner. We're also publishing advice from the Australian Signals Directorate on how to safely engage with AI and best practices for deploying secure and resilient AI systems, so you can get it right from the start and embed that security culture across your organisation and in the applications that you're embedding. The government is also engaging internationally to ensure global governance of AI strengthens safe and responsible practices across the world because we are so interconnected.
Ultimately, we must embrace AI if we don't want to get left behind and we should be able to leverage the immense benefits and the potential that it offers. But we should also do so safely.
With that, I am super keen now to share the challenges with our steemed panellists and hear from them on how we can all be more secure. So with that I would really like to start with you Richard. I've talked a bit about the threat environment and the importance of working together.
From your perspective, how are we responding to these threats together?
Richard Johnson
Thank you, general. So if I cast my mind back, I can still remember the day of the attack really well. 4th of July 2003, a fake website appeared. A ghost website trying to get usernames and passwords off Westpac customers.
It was hosted in Florida on the 4th of July. It was poorly constructed, bad language, Cyrillic, Russian on the bottom of the page, and it was a very, very effective because we had trained people to trust any website and enter information without trusting it.
We realised then by talking to our peers that ANZ NAB CBA were all being targeted at the same time by the same adversary and we realised that the logical course of action for us was to collaborate against this new threat which today we all would recognise as phishing sites, and share this attack data of these innovative attacks and also what defences were proving effective against this new threat. So what we effectively, we had realised 22 years ago was that against a common enemy, only a coordinated defence makes sense.
And so the interbank Security Forum was formed and it is still meeting 22 years later, still proving effective at sharing that attack data and, and countermeasures now. Back then, there were about 10 CISOs in the country. I knew them all personally. Today it's a bit bigger, but the fact is attackers have a lot of advantages and they're criminals after all, so they can operate outside of a lot of the constraints we have and they actively collaborate. And so against us, it's common sense that we should do the same.
Now, Fast forward to today and from the small beginnings, there are hundreds of CISOs in Australia as the threat actors have dramatically expanded their focus to other targets. Indeed, all of the people are joining us here on this call today. The fact is, today it's not just banking, telco's and government. Cyber threats target all businesses, all individuals, regardless of size or sector. Now one of the unique advantages Australia does have compared to say the US or UK, we're reasonable scale, but we're still small enough that the cybersecurity community knows and trusts itself and is willing and able to share telemetry in a trusted way. And we haven't gone down the path of some other nations that are very litigious when there's incident response and lawyer up and don't share and I hope we never do. The fact is that, that a key strength of combating our adversaries, is that we collaborate during, during incidents and during major incidents that many of us on this call have, have worked through is that in those events that trusted network of sharing attack and control data freely between ourselves, between our government colleagues is absolutely crucial to our collective defence as a nation. As we build a picture of what our adversaries are doing and what countermeasures work most effectively for them, and it's for this reason that Westpac and our peer banks who are here today and the Cyber Coordinator and government are very active in the broader cyber community. We treat all security Intel as non competitive and we will actively collaborate with any other white hat against those common enemies. And the fact is that we need to, to protect not just ourselves but our supply chain and the ecosystem.
Our customers, our peers, our investors, our suppliers, it's all part of the ecosystem that collaboratively and effectively we need to, we need to secure. And by doing that we can ensure that my customers who are also your customers, who could be your supplier, your investor, your mum and dad, by working together we can make sure that they are secure and suitably protected. One of the exciting examples where everyone here today is working together is through the National Cyber Intel Partnership under the leadership of General McGuinness and the Threat Blocking Working Group where we've gone from those early days of reacting to phishing.
Where all the banks are now, telcos and other companies are joining in to actively share live attack data and enable active blocking through telcos and big tech to protect Australians. While the attacks are still active. It's that kind of effective grassroots collaboration that I think has a lot of hope for the future.
And, and it's very exciting that through sheer force of will, the people on this call are able to are able to do that. The fact is that, that effective collaboration creates a force multiplier effect and can significantly magnify the impact of our individual contributions.
Because the simple fact remains against a common enemy, only a coordinated defence makes sense.
Michelle McGuinness
Which is fantastic. Thank you. It’s great call to action, collaboration, not competition. I hope that those listening are reassured that reaching out to your peers and collaborating and seeking help at times of crisis is absolutely critical. And you showed your depth of experience there as as well Richard back when Australia had 10 CISOs. That's the kind of experience we're leaning on here.
Let's go to Nicola. So when thinking about security investment, how do you balance your interests with Australia's national interests?
Nicola Nicol
Look, that's a really interesting question. And I think because if you actually zoom out and and look at the context of the Australian ecosystem, Australians are deepening their engagement across our digital ecosystem, whether it's through banking, whether it's through e-commerce, etcetera. And if you if you take an example.
You know, at CBA we've got 9 million customers using our app every month and logging on like 12.7 million times a day, like that's the norm and and my peers see the same thing, right? We, we collectively see that engagement across our digital ecosystem growing. So we're constantly investing and innovating and looking at how, how we solve some of the more complex cyber challenges that are emerging and, and part of that is actually about investing in safeguarding Australians through partnership and that's a part of our strategy overall. And I know again that is echoed across across the other banks.
Now let me give you a couple of examples of what that means in practice. So the first is investing in partnerships with government so you know the cybersecurity strategy, 2023 to 2030 lays a great foundation for lifting Australia's cyber capability. And part of that is about cultivating this, you know, improved partnership between government and industry and the Executive Cyber Council, which General McGuinness also sits on and and actually co-hosts that session and really brings industry together to look at how can we help delivere on those horizons. So investing in that conversation I think is is really critical.
And personally, an area that I'm most close to is an investment in sovereign capability where what we're looking at is for Australia's collective defence. How do we think about workforce and investing in our cyber workforce?
How do we think about investing in research capabilities and making sure that Australian research capability is really focused on the problems that corporate Australia need to solve and also thinking about in how we support Australian start-ups in our cyber economy overall?
Now we also though invest in partnerships with our peers. So Richard's already talked about some of that intelligence sharing that we do, but another area on which we look at the Australian national interest as we partner with with one another on getting match fit in the middle of a cyber attack. So we've talked about that and and General McGuinness, you mentioned you know, making sure you have a plan and a recovery plan at the ready. One of the things that we do is we work together to look at how would we collectively respond at a national level. And again, I think that's really, you know, a great demonstration of how we are doing. So that we are well prepared to defend Australia's national interests and then maybe the final thing I'll comment on is we also invest in partnerships to help build the Australian economy. So one area that I'm particularly proud of is some of the commitment we've made to investing in cyber companies that are indigenously owned in Australia and and I think that's a great example of where the investment is not only in sovereign capability but supports an indigenous community, it supports the growth of talent and indigenous education and employment programmes. So I think those are a couple of examples where we really together all work to balance both our individual
investments that we need to make in our in our capabilities, but also really investing in national interest and National Defence.
Michelle McGuinness
Look for the audience out there as a service member, I was incredibly struck and inspired by the national interest that all of our partners demonstrate in this. I'm pretty proud to say that when an incident happens, I'm not only getting calls from victims, but from experts across the nation saying how can I help? I hope that reassures you and it should encourage you to reach out to your providers.
Amazing people and the services they offer to ensure that you're connected in whatever they're offering. Let's move on to Sandro. I'm so we're hearing a lot about AI at the moment. Maybe a bit remiss of me to talk about it as an elephant in the room, but what threat do you believe it poses?
And how can it be used for good in cybersecurity, and how do you work together to combat that threat?
Sandro Bucchianeri
Good morning. Thank you. That that's a great question. I think from my side, you know AI is both friend and foe and it's essentially a double edged sword. The challenge that you have is because it's easily and readily available just like cloud was when it came out, you know about a decade or so ago.
The same challenge happens now. AI is readily available. The bad guys has access to the same tools we have as defenders, and they and as Richard mentioned, they have no boundaries. There's there's no legislation that they need to contend with. There's no privacy act or whatever the case may be.
So they use it rapidly. If you think about any of the emails you receive now, those phishing emails, have you ever seen a bad phishing e-mail? Probably not, because they're using AI to craft this perfectly worded e-mail. So that's the that's the one. That's the one, at least on the bad side. And it creates new routes to attacks what we typically talk about in our our area is the yes, this the attack service or the the attacks that comes through the service area has just grown exponentially because of AI and it's a key enabler to increase those attacks for that reason.
Where we see AI helping us is think of two supercomputers playing chess against each other. That's essentially where we would get to, where you'll have an attacker AI and a defender AI trying to see who is better than the other and getting into your environment.
I think that we can definitely use AI to help uplift our own defences. The number one question that I get and I know Richard, Maria and Nicola gets the same question is how do you guys sleep at night? And I think with with the admin of AI where we want to go to.
As a nation and to protect everyone, our customers, our own colleagues, I think AI is going to help us defend much faster than we have in the past. But all of this comes down to doing the the, the most basic thing and that's hygiene. We've been talking about getting hygiene right forever.
A day making sure you're patching your systems. You're using multi factor authentication and the like, and if you just do those basics, the essential 8 is a great tool that most of the businesses can use right now. It's a great way to get yourself started to increase your or improve your overall security posture. I think that's how we then defend ourselves against bad actors that are trying to get into our environments. And then I think the last thing is as AI is accelerating at great pace, you think about it in the last 2 1/2 years we've gone from generative AI, which everybody just couldn't believe how quickly AI was growing.
Going to agentic AI which is now bots, an autonomous bots basically booking your your holiday for yourself without you, just say hey, I want to go to Fiji, can you book me a holiday for five days? and it just goes off and does it for you. The attackers are using that and that's the, the chess analogy. But I think it may be daunting because it's new technology right now, but I think you working together and collaboratively sharing our our knowledge that we have, I think that's going to be the greatest defence that we has have as a nation.
Michelle McGuinness
Hey, Sandro, it's so fantastic to hear you articulate it so clearly and in those simple steps and that the Act Now Stays Secure actions are really important to baseline hygiene, whether you're talking about a start up business or AI and again collaborating together. I do think this is an area where we need to work as a nation and lift threats further upstream, and we're working with our big industry partners and our providers to do what we can for the Australian economy to protect it, but secure at its outset is a great approach. So Maria, let's come to you. I'd really love to hear your views on building a cyber aware culture and what that actually looks like in practice. This is a challenge for all of us and I'd love to hear, hear your views.
Maria Milosavljevic
Absolutely. I think one of the most important things is that it's about shared responsibility and workforce readiness, because this goes to the heart of cyber resilience and shared responsibility. When we talk about things like securing Australia together or responding together, It means everyone. It means within an organisation, from the board down, every employee, every contractor plays a role. It means our customers need to take steps to make sure that they prepare themselves. But we need to take responsibility to educate them, to make sure that they are aware.
So at ANZ for example, we have a lot of in app messaging. We have a security hub, we use social media, we run events, etcetera. It also means our supply chain. We've we've heard a little bit about that today and it means you know having dedicated teams that manage relationships with vendors and suppliers to make sure that everyone understands, their role, and everyone remembers that risks do not live in silos. It means government and industry working together to make sure that we all understand what are the most important things. And I mentioned the essential eight. What are the most important things to do to prevent things from going wrong? What do you do when something does go wrong? How do you all work together? And then we've also heard a lot this morning about the security community as CISOs we don't compete because we know we're all playing for the same team. When we secure our banks, we're securing our economy. We're securing our way of life, we're securing our future as a country.
And so within an organisation that workforce readiness is absolutely critical and research shows us that people learn more from their own organisations about cybersecurity than they learn it from anywhere else. So we all have a responsibility.
Building a cyber aware culture is not just my job as the CISO, it is a shared responsibility. It involves every single individual, every single day. It means protecting our organisation and our customers from threats, and it requires everyone to be alert, informed and fully engaged.
It's really very similar to the way that we deal with other hazards in life. We all know how to call emergency services. We teach our children how to do that when they're really young. We also teach our children how to swim when they're young, and we teach them to swim between the flags.
And every home owner knows that they have to clean their gutters to reduce the risk of a fire. It's their responsibility. It's exactly the same with cybersecurity, because ultimately it's about a resilience mindset, and that starts with workforce and it builds that whole ecosystem so that we all make sure that that we are working collaboratively, everyone remains curious, collaborative prepared to act under pressure because ultimately it's what we do when things go wrong that really makes a difference and matters most. So at ANZ, like all of my colleagues, we invest in things like ongoing training. We foster a culture of vigilance we partner with with many others and make sure that we all understand what we need to do, the future of cybersecurity really relies on us all playing our part every single day.
Michelle McGuinness
Yeah, I couldn't have said it better. Thank you so much. It does require every one of us on this call on this webinar today to get to a point where our actions in the cyber domain are innate and that security, that's what it means to have a cybersecure culture, to know that you, to clean your gutters, to know that you need to put on your seat belt. Well, to know that you need to update your software, you need to use passphrases. You need to be alert to those scams, so thank you so much. Look, I am so excited we're going to come to some questions from the audience, but first I'm going to put you on the spot and do a quick hot round. I'm going to ask you to click and I'm going to go in reverse order.
I'd love it if each of you could give me your top two things that customers should do right now to improve their cybersecurity. Maria, let's start back with you.
Maria Milosavljevic
So my top two, the first one would be make sure you understand what are your most critical services and what do they depend on. Because if you don't understand that then you're not going to be able to have a resilient business. And the second thing is make sure you rehearse. Make sure everyone is empowered to act. Everyone understands what they need to do and what they are allowed to do when things go wrong, those who might talk to.
Michelle McGuinness
OK Sandro over to you.
Sandro Bucchianeri
And I don't want to repeat what Maria said, but two things. One, breathe, take a breath. It's easy. You don't realise how important it is when you're actually taking a breath. If you cross the street and you're looking left and right, you are pausing because your physical safety is important to you. The same should apply when you are online.
You're clicking a link or whatever the case may be. The second thing is get the basics right. If you get the basics right. I know it's boring. It's not as cool as AI and quantum computing, but if you get the basics right, it goes a long way in protecting yourself and your organisation from those threats that come. Because if you look at any of the attacks that has happened over the last ten years, just let's just take 10 years, nine out of the 10 times, it's been the basics that was was not done correctly. So those will be my top 2 tips.
Nicola.
Nicola Nicol
OK, top two for me. First one would be a little bit of a mindset takeaway which is think like an attacker. So it's probably building a little bit on and on Maria's comments about knowing your business and what's important to you. But also like know your weak spots. So think about how the attacker is going to go after you.
If you take something like Jaguar Land Rover and as an example, which we've recently as a community been talking about, you know it wasn't so much for them about their data. It was about disrupting their overall business. And there's their manufacturing business. So think about not only what's most important to your business, think like an attacker who might they attack you and what are your weaknesses?
And if you can look to protect those first, I think that's really, really critical and maybe the second one, a really simple one. I go with, which is who's your phone a friend? Well, I know my phone a friend that's right in the middle of an incident that actually in the first in the middle of an incident, your first phone, a friend. Everyone’s is absolutely the Australian Cybersecurity Centre without a doubt. But what if you are looking for what if you're looking for advice and guidance, or you're concerned about something like who is your phone a friend? I think for us it's the peers on this call. But but I think that's a good a good thing to think about who you're calling.
Those are my 2.
Michelle McGuinness
Amazing. Richard, bring us home.
Richard Johnson
Now this is really good stuff. I'm busy typing it down because I want to use some of this. I think it's fantastic and I don't want to repeat. So what can I add to that body of knowledge I would say.
What is your security perimeter? And if you think it's your building and your internal network, think again because the reality is it expands deeply into your supply chain and out to your customers and through your partners and the community. And that's the mindset you need to adopt when you think about cyber and prepare your defences. It's that ecosystem that you need to approach and defend not just your internal network and and building on what we said before, do you have a cyber response playbook? And where is it and how do you get to it when you really need it and have you prepared it in advance and most importantly, rehearsed it? Especially the first hour, so that like training hard, fight easy, it's a drill and you're very used to what everyone needs to do when you've got all the people that might be involved to have gone through dry runs and practice this and rehearse ahead of time for that when you need it. It's muscle memory for not just your cyber team but the broader organisation, comms, media, government relationships, suppliers, regulators. All of those teams. If you don't have one, there's one freely available on the ASD website. Westpac has one. I think a lot of our peers probably have them on their website as well, so you can get a free resource there just to kick start that off.
Michelle McGuinness
Amazing. You know, when I think about what keeps me awake at night, people say, how do you sleep? I sleep because I have amazing colleagues and peers across our economy in this sector and in so many others that are helping secure Australia together. This does take everyone.
So with that, now is time to go to some of our audience questions. As Jess said, we don't have time to respond to all of the questions today, but I know my team have been doing their best to consolidate them into themes for us and we will seek to share those questions and get answers out after the event as available. So Jess?
Do you have some questions for us over to you.
Jess THOMAS
Hi, Michelle. Yes, I've, we've received a lot which is excellent a lot on AI and we have heard the panel talk about this, but I think the first question might be best placed with with you, Michelle, what measures is the National Office of Cybersecurity taking to respond to the AI threat and how can our audience, small and medium businesses, contribute to that work?
Speaker 1
Thanks, Jess. That's a great question. We are relying on our experts and working across the areas of government that have expertise in this. And as I said during my remarks, we're producing safe adoption of AI guides with the help of various organisations including the Australian Cybersecurity Centre at the Australian Signals Directorate.
We're also working with some of our other colleagues that you see here on the screen through the executive side of the Council through working groups, because we know this is one of our significant challenges and massive opportunities as a nation. So we're looking to collaborate and provide best practise and experience vignettes to share across the economy.
And we will seek to publish those in the coming months as we've done research with academics, we've got use cases and we're looking to publish those and share. How can people get involved?
It's a really great question. I get this a lot. I know that we're a small organisation but there are ways that you can communicate with us. If you have a vignette, an example, then you should reach out to the NOCS, but also access all those resources, whether it be on cyber.gov.au which is owned and run by the Australian Signals Directorate, is the home of a significant number of technical resources or ActNowStaySecure.gov.au or even the coordinators page on the Home Affairs website as well, but we'll post all those resources and we do want engagement, so please reach out. I think the most important thing you can do is build peer groups, collaborate across networks and reach out. Understand that if you need help.
Jess THOMAS
Thanks, Michelle. The next question is is sort of in relation to the intelligence sharing that we heard both Richard and Nichola speak about, we know that's happening in the banks really effectively, but our audience would like to know how some of that information can be shared with small and medium businesses and other industries in Australia.
Michelle McGuinness
Would you like to take that? I would just start by saying sign up to the ASD programmes with CITIS and you will be a recipient of that information. If you haven't signed up, sign up today. There are individuals that sign up individual business leaders, larger organisations. That's the way that you can tap in and receive and be on the receiving end of that. We also have a range of information sharing organisations as ISACs, but we'll try and get some details in the resources that we share. But Maria, please jump in.
Maria Milosavljevic
Look, one of the main things that I would also suggest is to look up ID Care if you haven't. And Michelle did mention ID Care in her opening comments, they have a lot of resources and a lot of information that they put out around what is happening and where the the sort of targeted attacks are for business as well as first aid kits.
And things like that. So definitely go there.
Richard.
Richard Johnson
I'd encourage you to use the the resources that are there with the ACSC website cyber.gov.au There's a lot of material that gets shared, a lot of it gets pushed out in real time, but really importantly myself, my peers, other large organisations, we do a lot of work when a new attack comes out of which there are many and we will share that any Intel or or even reverse engineering a tool set or a capability freely with government and others, and it's through those government sites that's the best possible way to obtain access to that and use that and also give the government telemetry about what's happening so they can better coordinate across the country, so it really is that symbiotic relationship with with ACSC and the and the national coordination mechanism.
Michelle McGuinness
Thanks, Richard. No matter how big or small your organisation is, if you have information on an incident, ACSC need that information. That is how we've we build our whole integrated picture of everything we know and then we provide advice back to the nation in terms of what they can do about it. I will just very quickly say that in the National Cyber Partnership, we are piloting a range of initiatives that see those that can block threats upstream, be it telcos or service providers, that they block them as they become aware and the banks are huge partners in that in sharing those threat indicators and then we're seeking to have them automatically blocked so that customers aren't victims of scams or cyber incidents, but there's a lot working in the background there that I'm excited about. When we look every day to figure out how we can scale it and make it bigger and more impactful for every Australian. Jess, I believe we have time for more questions.
You're on mute.
Maria Milosavljevic
Play song.
Jess THOMAS
Apologies, I'm back. So related to your response, we have heard a lot about how the financial institutions are collaborating and working together and you've just mentioned telecommunications, but how heavily are you all integrated with the other critical infrastructure sectors and how do you work with them?
Nicola Nicol
I I might jump in and take that to start with, and I'm sure others will will build on this. So and we're we're really very well integrated. And I think firstly and maybe if I if I draw a sort of visual picture of this. So firstly, if we think about places like the Executive Cyber Council where we've got a whole lot of different industries represented banks, telcos, supermarkets, you know, small businesses and different but different board industry bodies as well all represented in that forum and working together to look at how do we collectively lean in and on building and executing against the outcomes from each of the horizons under the under the cyber strategy. So I think that's one really good example where the work is focused on sort of innovation. What can industry do for industry and what can we do together to really deliver on some of those strategic outcomes.
But perhaps then also sort of tucked up going back to a topic I touched on earlier, when we think about being match fit for, you know, responding to some sort of cyber event, again, there's a lot of work we do, which is exercising, but across different parts of our critical infrastructure. So bringing the banks, the telcos, the energy sector together to say how would we, what would a collective response look like and and as an example we had some of my, our colleagues from the energy sector come and join one of our internal crisis management exercises along with NOCS and along with the ASD and along with some of our regulators. So we do a lot of work I think not only on the strategic thinking and and through the lens of their our national strategy, but we also work at a really practical level on our response capabilities and practising and exercising as a community. So there's just two examples and I'm sure Richard or Maria will build on that.
You both had your hands up, Maria. You took yours down.
Richard Johnson
Yeah. Thanks, Nicola. The the fact is there's hundreds of CISOs. I mentioned before, it is very practical and real time information sharing that we enjoy in this country. When I and my peers or certainly when I get out.
Nicola Nicol
Yeah.
Richard Johnson
And I look at my phone. If I don't have 350 alerts in those shared rooms, that all of the CISOs of our community and their teams are collaborating on, then I have breakfast. If there's a 350 alerts, then I stop and react and respond. I know it's going to be a bad day and it's not just Intel, it's attack data and control response data, really actionable information of what's working and what isn't working and how are people approaching the problem? It is an amazing ecosystem approach that we are incredibly fortunate to have in this country and not every country has that and it's part of our secret capability that we need to protect and defend is the ability to work as one ecosystem whilst under attack and share freely amongst white hats without fear.
Maria Milosavljevic
I'll just quickly jump in there. So we knocked my hand down. Nicola, your your response was so eloquent, just adding what Richard to what Richard said though I think was a really important point around, you know I'm saying I pick up my phone the first thing before I have breakfast before I do anything, I pick up my phone and I'll look at the sites, our community to to see what's what's happening. You know, I I once landed in Heathrow and turned on my phone and it just went Bing, Bing, Bing, Bing, Bing, Bing, Bing and I thought, oh, OK, it's going to be one of those days, right. And so it's that community is really important. And so I would say to anyone out there who is from a small business, if you're not connected into the CISO community, you can be right. There are many, many CISOs, reach out phone a friend. As we heard before, or find a friend, reach out to one of us. You know your bank CISO and we can we can connect you with peers if you don't have any.
Sandro Bucchianeri
Yeah. And then the only thing that I will just add, I'll give a practical example. I think 3 weeks ago, I I pinged my three peers on the call and I said I need to speak to you urgently. Maria and Richard got back to me immediately because they they always answer my messages. So thanks for that. Nicola did eventually call me back later in the afternoon.
Because we, we discovered an issue in NAB and I provided the those indicators of compromise that Richard mentioned and the three of them went went away to go and look in their environments, did they see the same thing? So that's a very practical example. It's. I'm glad Richard has breakfast in the morning, but that's a very real example of how we work very closely together and then when we take it down to our customers. So I know we do it at NAB and I'm sure my peers do it as well. Our business customers have access into a whole myriad of resources that we provide them. Along with the webinars and the like. So all that sharing we share freely, openly, etcetera, we have one-on-one discussions etcetera. So it's a, it's a whole of community event. It's not that I'm going to keep my information to myself. So we we encourage anybody that if you are in a if you have a coffee shop speak to the other coffee shop owners in the area to come together because you'll have similar challenges. So I think that's that. That's the messaging that we would want to leave you with on that.
Michelle McGuinness
So this is our superpower. Thank you for that. And collaboration is cool. Jess, do you have one more, short question that we should address before you run out of time?
Jess THOMAS
Yes, I have one more short question on culture. Do you think we're experiencing a cultural shift in cybersecurity from being risk driven and prevention focused to increasingly resilience driven and recovery focused?
Michelle McGuinness
So my plan, I absolutely hope so and it's hard to get data around this, but it's going to require every one of us to drive to that. But absolutely the message we're sending is, is and it is about that sometimes and Maria touched on as well. It's not what happens to you, it's how you respond because we have to be clear on about the fact that our threat actors and the technology are evolving so quickly that we are going to constantly learn new ways to protect and this is exactly what Sandro was talking about as he talked about sharing new things that he's finding or identifying. So I hope so and I believe so, but I need everyone on this call. And in fact every leader across our nation to be part of that. Let's go to Sandro then Maria.
Sandro Bucchianeri
So the short answer is yes, there has been a massive shift in cyber and the focus that we place in it in our country. If you think about just go back three years, there was no national coordinator role there was, there was no centralised focus from government.
And here we are, sitting together on a call, all in different parts of the country, talking about how we share information, how we work together, and I can sense that mindset and the way people are talking about it all the way down to my 12 year old who talks to me about cyber at the grassroots levels like Dad, what do you do and are you having a super secret squirrel meeting with government? And can you tell me what they talked about and I tell him no, I can't and he tries that everyday when I drop him off, but that's the interest that that this all has generated and it's terrible when the events happen, but I think the nation has moved forward in a good way and long may it continue, we just need to continue this conversation and collaboration.
Maria Milosavljevic
So I would add a little bit more to that as well around the fact that attacks that may start in a physical world actually, you know, sorry start in a virtual world actually become a physical issue and we've seen that you know this we we really need to take an all hazards approach because everything is connected to everything else.
And unless we understand that cyber digital becomes physical, we're not going to be prepared for things like I can't, I can't pay the bills. I can't actually buy my groceries. You know, I can't take transport, those sorts of things are impacting on daily life, and it's really important to understand. Those things must go together. One of the things that I kind of joke about is that the SOCI Act, security for critical infrastructure maybe should be ROCI for resilience of critical infrastructure for this very reason, right? Because it's it's this deeply integrated approach that we need across you know, government agencies, industry peers, law enforcement, technology partners we all need to work together to make sure that we understand the full potential impacts and who needs to be involved in actually addressing those sorts of impacts, particularly when they can undermine our economy or our way of life.
One of the things that's also changed a lot in recent times is that a lot more people are working remotely, and so we need to become much more acutely aware that the sorts of risks that we're dealing with are not necessarily things that we may have thought about in the past and some cyber threat actors, may actually want to, you know, pretend to be someone that they're not, and that's also got to be part of the way that we think about resilience, because the way that we trust each other and the way that we trust our employees, the way that we know who each other is, all of that has fundamentally shifted.
Nicola Nicol
And I may make one one build on that as well, I guess 2 observations. I would offer one that if we think about that shift of protecting to resilience that I think we've seen a mindset that was about protecting our data and we've all but, but in the in the last few years, we've really started to see a shift towards resilience through disruption because again, I think we see the threats evolving where the threat actors are not that you know, yes, there's always been sort of hacktivists, there's always been those that are out to make a point and have a purpose, but I think we see much more these days where threat actors are very much looking to disrupt a business and and it's rather than the more traditional sort of looking after looking to get after your sensitive data. So I think that's part of the reason for the shift as well from a cyber community perspective is it, is it is, yes, always will be about protection, but we've got to be ready to be resilient through disruption and and the and the final thought I'd I'd share it is I think that's where particularly in Australia we have a great opportunity to be much more integrated with our regulation. Somebody I talked about it's OK and the all hazards approach. If you look in the banking and finance
sector at things like CPS 2:30, which is about operational resilience. If you look at some of the evolution of what we're seeing in the fraud and scam space, you often will find at the core, you've got the same threat actors who are, you know, causing disruption in multiple different ways where we might have traditionally thought about these things in silos. Let's let's look at fraud over here. Let's look at resilience over here. Let's look at cyber over here. I think the learning for us and what we're doing as a community is taking a much more integrated approach to thinking about operational resilience and that includes cyber and scams and and other sort of disruption activities across the community. Yeah.
Michelle McGuinness
Thank you so much, Nicola, and thank you all of you for coming.
We are now closing in on our ending time here today. I do want to make a couple of remarks. Firstly to the team here. Thank you so much for being here. There is absolutely no doubt in my mind that you are on the front line with a range of other industry partners of this issue. You are under consistent, persistent attack and this is why it's so critical that we partner together. So thank you for your time being here and thank you for everyone who has dialled in.
I also really want to thank my team represented by Jess, but obviously backed up by others who have pulled this together. It's been fantastic and the team to the banks who have been so willing to jump in and do this, it has been novel and new and I can't wait to do it again.
Let me just say as we come to a close that the Australian government, along with our partners is busy building our cyber workforce, our cybersecure culture, strengthening our resilience as we’ve talked about and responding of course to incident after incident as a nation.
Critically, at each step we are partnering like you see here today with industry.
The benefits of us taking action that absolutely is compounding when cybersecurity is improved anywhere in the whole chain, whether as an individual, as a small business, big industry or within government, it benefits us all.
So I really urge you to take what you've heard and learned today and take practical steps and run with them for your businesses. Please also be an advocate for cybersecurity. It will take every one of us to do this, and not just with your employees, your co workers, your peers, but speak to your Nana. Talk to your siblings. Reach out to your friends. Keep inspiring all the 12 year olds. We need that future workforce, but talk to anyone in your circle and help them to understand the risk and embrace the simple things we can all do to make us stronger.
Unique passphrases, multi factor authentication, software updates.
A robust and resilient cybersecurity culture is the glue that will harden us as a nation against these threats. And please keep that top of mind in every decision you make across your business. Being together we can be more secure as a nation.
With that, thank you so much again for your attendance. Thank you to the team and our fantastic experienced analysts, have a great day.
Sandro Bucchianeri
Thank you.
