New Zealand Business Has Increased Cybersecurity Spending, Not Expertise

State-sponsored cyber-attacks have risen 10 per cent in the last financial year, and a survey of New Zealand's most significant organisations has returned a mixed picture when it comes to resilience against such threats. All the while, total recorded cyber incidents had dropped; a statistic that had piqued the interest of the spy agencies.

As the NZ National Cyber Security Centre (NCSC) progressed the rollout of its new "Malware Free Network" capability, or the affectionately-named "son of Cortex", it was advising organisations to be aware of a "shift in the cyber threat landscape".

Director of the NCSC Lisa Fong said the rise of state-sponsored activity, cyber-attacks known to have originated within a foreign government, was "notable, certainly".

The NCSC is a branch of the external spy agency the NZ Government Communications Security Bureau (GCSB), which works directly with New Zealand's "organisations of national significance" to protect against cyber threats. It recently carried out a high-level survey of 250 nationally significant organisations, which revealed a marked increase in security spending on tools, but less so on expertise.

Only 19 per cent of those organisations had a dedicated chief information security officer and 39 per cent did not provide any cyber security reporting to senior management. A further 33 per cent had fully identified their "critical information assets".

"If an organisation is unclear about what its most critical assets are, it is difficult to be confident they are protected," the survey said.

But 73 per cent of all organisations had increased their cyber security spending in the last year. It was encouraging in terms of the awareness of risk, but the NCSC would like to see a bigger spend on personnel and training.

"There has been an increase in spending, but largely that's gone on tools. Where we see the need is investment alongside those tools, because they won't be able to analyse their systems for instance, that won't produce effective reporting to your board," said Fong.

While the NCSC would not comment on what agencies were deemed "nationally significant", it included a range of critical Government departments as well as private companies that provided national services, were economically significant, or had access to nationally sensitive information.

Fong would not be drawn on which states had been responsible for the rise in cyber-attacks in this country.

"We don't talk about specific actors unless we're prepared to publicly attribute. Part of the reason for that is that we can hold our hand to make sure we can keep detecting and remediating."

In December 2018 the GCSB took the rare step of joining its Five Eyes allies - the United States, Canada, the United Kingdom and Australia - in naming China as being behind a major global attack.

Most went unattributed, however.

"The decision to publicly attribute isn't a decision we make alone. It's a multi-agency process and of course, ministers and the Prime Minister will make that choice," said Fong.

Cyber-attacks on New Zealand companies were primarily focused on financial crime or espionage, but recent state-sponsored campaigns like Russia's disinformation attack during the US presidential election also had authorities here paying attention.

Malware Free Networks took it a step further.

"What we're trying to do is take our understanding of what we are learning through those accesses or those relationships, and make sure we can push those out to as many different nationally significant organisations as possible.

"So what we're hoping to do is work with Internet service providers - and we're mid-project - to develop a capability that will allow us to proactively detect potential incidents before they occur," Fong said.

Outsourcing of supplies, and the "Internet of Things" were two emerging areas of weakness as technology progressed.

The "Internet of Things" referred to increasing connectivity between devices that powered homes, buildings or entire networks, they effectively created a wider "surface area" for potential attacks.

The development of a 5G network also fell under that category.

"What that presents is both opportunity - you get your driverless cars, you get your medical devices, because you can rely on the quality of the internet.

"It also represents potential vulnerability."

The Government and the GCSB were working through an application from telco Spark, which wants Chinese telecommunications company Huawei to build its new 5G network in New Zealand. The application was initially rejected by the bureau, which has the power under New Zealand law to exert such vetoes when it comes to nationally-sensitive infrastructure.

Huawei's relationship with the Chinese Government, paired with a law change last year, that many western countries perceive to mean that Government could compel Chinese companies to spy, is understood to be a major driver in the GCSB's decision. Similar decisions had either already been taken, or were being considered, by other Five Eyes countries.

Stuff

You Might Also Read:

In New Zealand, Hacking Is A Serious Business:

« Could An AI Arms Race Lead To Accidental War?
Apple ‘Subscription Confirmation’ Phishing Scam »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

Directory of Cyber Security Suppliers

Directory of Cyber Security Suppliers

Our Supplier Directory lists 7,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

VMworld

VMworld

VMworld is a global conference for virtualization and cloud computing, including associated security issues.

Information Security Group (ISG) - Royal Holloway

Information Security Group (ISG) - Royal Holloway

The Information Security Group, Royal Holloway, University of London, is an Academic Centres of Excellence in Cyber Security Research.

Combitech

Combitech

Combitech is the Nordic region’s leading cyber security consultancy firm, with about 260 certified security consultants helping companies and authorities prevent and manage cyber threats.

Arthur J Gallagher & Co

Arthur J Gallagher & Co

Arthur J. Gallagher & Co. is a global insurance brokerage and risk management services firm. Services include Cyber Liability insurance.

SEC Consult

SEC Consult

SEC Consult is a leading European consultancy for application security services and information security.

SparkCognition

SparkCognition

SparkCognition’s AI-powered solutions enhance cybersecurity, identify and prevent equipment failures before they happen, and provide prescriptive intelligence for maintaining your most critical assets

Six Degrees

Six Degrees

Six Degrees is a leading secure, integrated cloud services provider. We protect UK organisations and help them thrive in the cloud by giving them secure platforms to innovate and grow.

miniOrange

miniOrange

miniOrange is a cloud and on-premise based identity and access management (IAM) solution provider.

Cyber Army Indonesia (CyberArmyID)

Cyber Army Indonesia (CyberArmyID)

Cyber Army Indonesia (CyberArmyID) is the first platform in Indonesia to collect and validate reports from hackers (referred to as Bug Hunter) regarding vulnerabilities that exist in an organization.

NTIC Cyber Center

NTIC Cyber Center

NTIC Cyber Center is an organization dedicated to making the National Capital Region (Washington DC) more resilient to cyber-attacks.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Cyber Security & Cloud Expo

Cyber Security & Cloud Expo

The Cyber Security & Cloud Expo is an international event series in London, Amsterdam and Silicon Valley.

Collins Aerospace

Collins Aerospace

Collins Aerospace provides cybersecurity services and systems to protect critical infrastructure facilities and railroad operations.

Cypress Data Defense

Cypress Data Defense

Cypress Data Defense helps clients build secure applications by providing training, best practices, and evaluating security during every stage of the Secure Application Development Lifecycle.

Bright Data

Bright Data

Bright Data Inc is the world’s #1 web data platform, enabling organizations to research, monitor, analyze data, and make better decisions.

Insane Cyber

Insane Cyber

Insane Cyber make cybersecurity easier to manage through automated, easy-to-use software and expert support and partnership.