November 2016 Cybersecurity Threats Challenges Opportunities “It is only when they go wrong that machines remind you how powerful they are.” Clive James Cybersecurity – Threats Challenges Opportunities 3 Contents 01 03 Foreward 1 Threats in the Executive summary 4 information age 13 The nature of threats 14 The Internet of Things (IoT) 16 Botnet armies 17 When security is an afterthought 18 Autonomous systems 19 Driverless cars and transport 19 ATMs and Point of Sale 21 What about wearables? 22 02 Cyberwarfare 24 A brave new world 5 Automated attacks 24 Cyber speak! 6 Energetic Bear 24 What is cybersecurity? 7 Cyberattacks on infrastructure 26 And the weakest link is… 9 When software kills 28 A world without cybersecurity 11 Data manipulation 29 Backdoors and espionage 29 Cloud concerns 29 Blast from the past 30 Virtualised threats 32 Industry and the individual 33 Ransomware and Cryptoware 33 Multi-vector attacks 33 Identity theft 34 The world we live in 34 04 The future in our hands 35 The 100% secure computer 37 Opportunities 38 The data-driven economy 38 Technology as wealth creation 39 Cybersecurity as job growth 39 Leveraging technology talent 39 Challenges 40 Leadership 40 Learning from history 40 Collaboration 41 Education and awareness 41 05 Looking to the road ahead 45 You are what you do 43 State of the nation 46 Legal and regulatory 43 What role can you play? 47 Services and privacy 43 Government 47 Perception and practicality 44 Education and research 50 Business and industry 50 You, the individual 50 The five pillars of cybersecurity readiness 51 Online resources 52 Through the looking glass 53 Fast facts 55 Glossary 57 References 59 Cybersecurity – Threats Challenges Opportunities 5 Foreword You’ve seen documents like this pass your desk before, but we hope this one is a little different. You can gloss over it, seeking the diamonds in the rough, but take the time to delve into the information presented here and you will walk away with a different appreciation of the laptop on your desk, the car that you drive, and the phone that you carry. Not to mention the planes you fly, Logically, then, protecting that upon Protecting that upon the banks that hold your money, the which we depend should be front which we depend should hospitals that keep you alive and of mind for government, business the very infrastructure that makes and industry, academia and every be front of mind for our cities run. In short: the basis individual with a smartphone in government, business of our modern lives. their pocket. and industry, academia It can be hard to not overuse a word Which is to say, all of us. and every individual that’s become popular thanks to If you are part of government, this public awareness, but ‘cyber’ is now with a smartphone in primer serves as a guide to the firmly entrenched in our language their pocket. greater sphere of cybersecurity and our mindset, by virtue of the fact and how it relates to our national that our society today depends so security, our national interest, and much on technology. our economic prosperity. So we’re going to talk about cyber If you are an executive, board with respect to security, as the two member, business leader, or IT are intimately intertwined. In this professional this is an opportunity guide we aim to break down what to verse yourself in the language is sometimes a large and complex and the ecosystem, the threats and issue into an easy to read and the opportunities, and to better digestible summary that should communicate the issues and – if we’ve done our job well – give responsibilities around cybersecurity you the tools to both talk confidently within your organisation. about the issues, as well as equip you with the core information required to And if you are simply an individual make decisions around cybersecurity. interested in understanding more about the nature of our digitally- Because, despite the technical driven world, this guide will provide nomenclature, the issue of cyber- the basics and a clear overview of security is as vital to our way of life how cybersecurity relates to you. as technology itself. In fact, they can’t be separated: our economic health, At the ACS we welcome every our national security, and indeed the opportunity to educate and assist. fabric of our society is now defined If you have any questions, or would by the technology we depend on like more information, please feel every day. free to contact me at: [email protected]. What’s left unsaid here, however, is the assumption that this technology Enjoy this guide. We hope it will make will continue to work as we intend – a difference to you. but this is only true if we can protect it from being hacked, manipulated, Anthony Wong 01 and controlled. President, ACS SECURING AUSTRALIA’S FUTURE At ACS we are passionate about the services to identify and certify Nations in New York, where the ICT profession being recognised as ICT professionals you can trust, importance of ICT professionalism a driver of productivity, innovation including through the Professional was acknowledged by the UN and business – able to deliver real, Standards Scheme that assures General Assembly President in 2015. tangible outcomes. professionals have the specialist In May 2016 the President of skills business can rely upon. This year ACS celebrates 50 years IFIP participated in the European of advancing ICT in Australia. Our ACS is part of the global federation Foresight Cyber Security founders and pioneers worked of professional ICT societies, Meeting where he advocated on the first innovative computers the International Federation for that professionalism of the ICT in government, academia and Information Processing (IFIP), workforce is “a key element in industry, and our members now and the first professional body to building trustworthy and reliable work at the coalface of technology receive accreditation under the systems” and that it is important development across every industry. International Professional Practice to ensure that “cyber security Partnership (IP3) – providing a and cyber resilience is also a In 2011, ACS brought together its platform for accreditation for duty of care of the individual own Cyber Taskforce from our ICT professionals and mutual ICT professional”. 23,000 members to respond to the recognition across international Federal Government’s new cyber As we move forward another boundaries. The ACS currently discussion paper, ‘Connecting with 50 years, ACS will be there chairs IP3 and plays a leading Confidence’, where we highlighted at the forefront meeting the role in the professionalism of the the need to develop co-ordination challenges and opportunities ICT workforce. and a focus on the pipeline of of ICT, and supporting the cyber professionals. IP3 has since gained global growth and potential of ICT attention after successful professionals in Australia. To play our part in securing engagements at the World Summit Australia’s future, we continue on the Information Society (WSIS) to perform the role of trusted Forum in Geneva and the United advisor to government, and deliver Cybersecurity – Threats Challenges Opportunities 2 01 Executive summary As technology continues to evolve so also do the opportunities and challenges it provides. We are at a crossroads as we move from a society already entwined with the internet to the coming age of automation, Big Data, and the Internet of Things (IoT). But as a society that runs largely Critically, this document clarifies Our aim is that this document on technology, we are also as a result the importance for Australia to take provides an informative primer on dependent on it. And just as technology responsibility for its own cybersecurity, the relevant issues facing Australia brings ever greater benefits, it also especially with regards to essential in relation to cybersecurity, to brings ever greater threats: by the infrastructure and governance. generate discussion and debate, and very nature of the opportunities it to raise awareness with regards to On the flip side – and as one of the presents it becomes a focal point for a fundamental building block of the fastest growth industries globally cybercrime, industrial espionage, and technologically-dependent society – developing our own cybersecurity cyberattacks. Therefore, protecting which we have already become. industry is also an opportunity for it is of paramount priority. economic growth, job creation, and As you will read in the following This guide looks at some of the education – ensuring Australia is pages, cybersecurity is not optional. concerns facing us in the near future well positioned for a future as a It must form part of the design of that include: digitally advanced nation. every product, of every database, of every electronic communication. And • Attack vectors such as botnets, Finally, we look at some of the – through education, awareness, and autonomous cars and ransomware. challenges that countries worldwide proactive change – we can all play a are currently dealing with in regards • Threats including data manipulation, part in securing our future. identify theft, and cyberwarfare. to cybersecurity, including: • Tangential issues such as data • The need for more collaboration sovereignty, digital trails, and in order to mitigate threats. leveraging technology talent. • Education and awareness; and Additionally, it provides some • The balance between privacy and background to the nature of digital security. ecosystems and the fundamentals of cybersecurity. Cybersecurity – Threats Challenges Opportunities 4 A brave new world You’re reading this document written with, laid out by, and printed using computers. From start to finish it existed as 0s and 1s – the binary blood of our modern world. In fact, our lives today are codified by data: almost everything we do, and everything we depend on, involves data and the technology that uses it – there are scant few areas not touched by this revolution we call the information age.