Australia’s IT and OT environments have seen increasing attacks, especially from ransomware, data breaches, and denial of service in recent years. Cyberattacks in Australia cost AU$276,000, on average (Business Victoria, 2019). For larger organisations in Asia-Pacific, the economic damage can total US$30 million, according to a Microsoft-commissioned Frost & Sullivan study, accounting for the direct, indirect, and induced costs of cyberattacks. While financial gains drive most cybercriminals, Australian IT and OT environments are also experiencing more attacks from state and state-sponsored actors, partly due to rising geopolitical tensions around the world.
Australia is more susceptible to attacks from adversaries of the Five Eyes network – to which it belongs – than its Asia-Pacific neighbours. While this is especially crucial for critical national infrastructure enterprises, other businesses are not exempt from danger; collateral effects of widespread attacks affect all vulnerable systems in the ecosystem. The 2019 PayID breach exposed personal details of nearly 100,000 customers of multiple institutions, including Australia’s four biggest banks, through a vulnerability in the eponymous shared payments system. Conversely, threat actors perceive smaller businesses (SMEs) to be more vulnerable as they are less likely to invest heavily in extensive cybersecurity measures.
Against this backdrop, businesses are under pressure now more than ever to maintain their cyber defences to avoid irrecoverable system compromise. Enterprises face the following major cybersecurity challenges:
Cybersecurity personnel shortages constrain enterprises’ cyber defence efforts
Shortages of skilled cybersecurity professionals in the Australian market are likely to continue. The Australian government anticipates the country needs over 10,000 additional cybersecurity workers in this decade. Consequently, enterprises electing to staff their SOCs are not expected to manage – based on simple supply-and-demand dynamics – without significant cost implications. Moreover, cybersecurity scalability is a vital enterprise consideration. No longer can growing enterprises afford to maintain security at base levels.
Accordingly, hosted services by managed security services providers (MSSPs) offering scalability, cost-effectiveness, and flexibility in managing cybersecurity are gradually gaining enterprises’ favour. For SMEs, outsourcing security management is often cheaper than building a new in-house team.
Increasing severity and latitude of modern cyberattacks exempt no one
The widening Australian cyberspace threat landscape is reaching non-traditional targets. OT targets are increasingly prevalent due to the near-universal adoption of advanced networked industrial systems. SMEs, which are less likely to have comprehensive cyber policies and systems in place, are becoming choice victims.
The easy access to malware creation tools exacerbates the matter. Ransomware-as-a-service, for instance, is an emerging concern. Instead of and besides launching attacks, some cybercriminals choose to sell their capabilities to amateur criminals through pre-packaged malware kits, allowing almost anyone with a computer and an internet connection to disrupt target networks. Furthermore, crypters, programs disguising the code makeup of new and known malware, are easily accessible.
With the proliferation of advanced persistent threats (APTs) and fileless malware, even established in-house teams may be incapable of deflecting the most dangerous attacks – those most likely to cripple an enterprise’s/organisation’s systems.
One glaring example is the APT10 group’s recent hacking campaign, which attempted to access intellectual property and other sensitive information from targeted businesses and government organisations in several countries, including Australia (Nine).
Facing the seemingly insurmountable task of securing every single infrastructure, network, application, and endpoint, businesses and governments are often better off outsourcing security management to cybersecurity professionals such as MSSPs.
Government initiatives to protect their citizens inadvertently create headaches for enterprises
Governments worldwide are becoming more aware of the risks and implications of insufficient cybersecurity policies and have implemented comprehensive data management rules and guidelines. The resulting stricter compliance and regulatory environment is pressuring enterprises to comply or face hefty fines, e.g., Australian businesses falling short of the Notifiable Data Breaches (NDB) scheme of the Privacy Act could be fined up to AU$1.8 million and individuals up to AU$360,000.
Fortunately, Australia has a relatively robust regulatory environment when it comes to cybersecurity compared to its Asia-Pacific neighbours. Despite recent progress in enhancing cybersecurity laws and standards, many of the less cyber-mature nations still lag behind Australia
However, continual compliance requires businesses’ ongoing resource commitment to update and implement the latest rules and regulations, quickly raising the total cost, including manpower, punitive, and reputational costs. Instead, getting support from MSSPs can help decrease non-compliance risk by leveraging established operational frameworks and expertise in their countries of operation.
Cybersecurity has become non-negotiable in running a modern enterprise
Australian organisations are increasingly viewing cybersecurity strategically. More Australian enterprises are creating true chief information security officer (CISO) roles reporting directly to the CEO or board of directors. This is a strategic move as cybersecurity now plays an all-encompassing role in modern enterprises. A significant breach could close down businesses in industries like IT services, financial services, utilities, and technology providers. Data, as the enterprise’s most valuable commodity, warrants the best security possible.
MSSP partners can potentially help enterprises better cope with cybersecurity
The abovementioned issues are some of the primary drivers in the MSS market. Based on Frost & Sullivan’s latest research, the Australian MSSP market is expected to grow at a CAGR of 14.3% from 2018 to 2023.
MSS will be vital in securing digital ecosystems of the future, owing to their security and compliance capabilities, service delivery and cost structure. MSSPs can be enterprises’ partners in business in reconciling shortcomings in their security postures. Even for organisations hard-pressed to maintain in-house teams due to data privacy and residency concerns, MSSPs can provide solutions through hybrid deployments, which retain significant control within the organisation.
Has your enterprise considered partnering with a managed security service provider to better address cybersecurity?
Frost & Sullivan explores the value propositions MSSPs offer to enterprises and government organisations of all sizes in its Asia-Pacific Managed Security Services, Forecast to 2023 report. The research includes valuable insights into the competitive environment, geographical breakdown, key drivers and restraints, trends, and outlook of the MSS market in the East Asia, Southeast Asia, India, and ANZ regions.
