Login
Business must beware of internet attack threat
Cyber attacks are on the rise in Australia and businesses that fall victim must move quickly to increase their chances of recovering stolen information, a lawyer has said.
Stephanie Quine
Cyber attacks are on the rise in Australia and businesses that fall victim must move quickly to increase their chances of recovering stolen information, a lawyer has said.
Australia is now ranked the 21st most targeted nation for cyber attacks, up three places from 24th in 2011, according to Symantec’s Internet Security Threat Report, released on Tuesday (16 April).
Kellie Stonier, a senior associate from IP law firm Griffith Hack, said her firm has had a number of enquiries, particularly over the last 12 months, from businesses that have had issues with confidential information being taken.
“Predominately it has been internal staff leaving with that information rather than actual [third party] attacks on the business,” said Stonier.
Departing staff are taking customer lists and distribution lists, as well as trade secrets the business owns in relation to documents, or records in relation to systems and procedures.
The largest growth area for targeted attacks are among businesses with fewer than 250 employees, according to the annual Symantec report, which benchmarks the level and type of cyber-crime activity taking place in Australia and around the world.
“Sometimes in the smaller businesses, people don’t have an IT department or IT person but it’s important to go and get some assistance from a person with IT expertise to set up protection,” said Stonier.
“When we go and ask the court to assist a business to protect their confidential information it’s important for us to show that business actually took steps to keep it confidential.”
Such steps include passwords to restrict access to documents and systems; login restrictions from the business’ server for mobile technologies, and provisions in employment contract agreements regarding confidential obligations.
“Educating staff throughout their employment about how to manage and maintain this confidential information is really important … staff are the people who are on the frontline and are probably going to be the ones who come across an issue,” said Stonier.
When a breach does occur, a business can can go to court and seek an Anton Piller Order, which allows it to search and seize evidence from the third party.
This is normally done on an urgent basis and is normally done ex-parte, which means the business goes to court and puts forward evidence of the breach without the other party, explained Stonier.
“The court will give you an order to go onto the third party’s property and site and retrieve the documentation or identify evidence that’s relevant and seize it,” said Stonier, adding that a forensic team will normally image computers and track any electronic footprint.
“The really critical thing with confidential information is that it’s time sensitive; once it’s out there in the public domain it’s not really recoverable ….programs can [also] update themselves and overwrite information so you need to move quickly,” said Stonier.
Mobile attacks
Last year, mobile malware increased by 58 percent, and 32 percent of all mobile threats attempted to steal information like e-mails and phone numbers, according to the Symantec report.
Apple’s iOS had the most documented vulnerabilities but more threats were made on Androids than any other mobile operating system, the report found.
“Android’s market share, its open platform and the multiple distribution methods available to distribute malicious apps, make it the go-to platform for attackers,” the report stated.
Stonier said that businesses are forgetting to apply IT security protections to mobile phones and iPads, which employees wander around with (and sometimes lose), carrying often just as much sensitive information as their desktop and laptop.
