What do ‘inevitable’ cyber threats mean for investors and consumers?

By Fergus Halliday

October 18 2021
Share

Saying a major cyber attack on Australia’s financial system will happen is easy, but calculating the costs is hard.

With the Reserve Bank of Australia (RBA) admitting that future cyber attacks on Australia’s financial system are certain, it’s worth considering what the consequences of this possibility look like.

Earlier this week, the RBA conceded that given the very large number of attacks, “it seems almost inevitable that at some point the defences of a significant financial institution will be breached”.

However, associate professor at Edith Cowan University’s School of Science, Paul Haskell-Dowland, told nestegg that the costs of a major cyber attack on Australia’s financial institutions would vary based on the nature of the attack itself.

“We could be looking at a ransomware-style attack which could target back-end (server) infrastructure, or a cross-branch front-office impact,” Mr Haskell-Dowland said, noting that the former would be much more visible to consumers.

Recent major IT failures by banks and other financial institutions might provide a sneak peek into what this would look like for everyday consumers.

“There is no indication that [these] outages have been cyber-related, but the lack of access is likely to be the visible impact to consumers,” he noted.

While finances should be safe under the usual FCS arrangements, Mr Haskell-Dowland warned that this assumes there is clear evidence of losses not being incurred by the account holder.

Asked to put a number on the economic cost of cyber intrusions into Australia’s financial system, Mr Haskell-Dowland said that this impact is hard to quantify due to the sometimes contradictory data on the subject.

While the Australian Cyber Security Centre has indicated that just 4 per cent of cyber attacks targeted the financial sector, the RBA’s most recent Financial Stability Review noted an upward trend in the number of reported cyber incidents.

Mr Haskell-Dowland said that these seemingly contradictory trends might be evidence of broader improvements in the sector when it comes to detecting and preventing cyber attacks.

That said, he highlighted supply-chain attacks as a possible vector for future cyber threats, as it would allow attackers to launch directly into the banking system.

In a worst-case scenario where the RBA itself was hijacked by a cyber attack, Mr Haskell-Dowland warned that the consequences could be wide-ranging.

“The RBA has a large remit and responsibility for fiscal stability and will have a very large volume of sensitive materials which are both required and are not for public disclosure,” he said.

In the event of a ransomware attack, the RBA might struggle to provide services like cash transport to banks and the government could cause serious issues.

Mr Haskell-Dowland said that an inability to move physical cash around could cause problem with consumer access to cash, though he added that this impact would likely only be felt by subsets of the population.

Acknowledging recently introduced changes in mandatory breach reporting, Mr Haskell-Dowland warned that Australia’s cyber-security sector still faces challenges around jurisdictions.

“Most major incidents link back to global cyber-crime groups outside of AU,” he said.

About the author

Fergus Halliday

Fergus is a journalist for Momentum Media's nestegg and Smart Property Investment. He likes to write about money, markets, how innovation is changing the financial landscape and how younger consumers can achieve their goals in unpredictable times.

About the author

Fergus Halliday

Fergus is a journalist for Momentum Media's nestegg and Smart Property Investment. He likes to write about money, markets, how innovation is changing the financial landscape and how younger consumers can achieve their goals in unpredictable times.

sections

sections

sections

sections

sections

sections

sections

Invest