Major resources companies are experiencing an increase in cyber attacks, with both competitors and foreign countries looking for information that will give them a commercial advantage, writes Craig Donaldson
Both business leaders and IT security experts believe that countries such as China, with a strong vested interest in obtaining information about major resource projects and foreign investment, have stepped up cyber attacks.
Former Woodside Petroleum chief executive Don Voelte recently told a forum in Perth that cyber attacks were a major concern and that the company had been attacked “from everywhere”.
“I saw the number of attacks against our company over a time period,” he said.
“It comes from everywhere. It comes from Eastern Europe; it comes from Russia. Just don’t pick on the Chinese; it’s everywhere.”
Peter Lilley, cofounder of IT security firm Stratsec, which specialises in a number of industries including mining and resources, has also seen an increase in attacks but observed that it can sometimes be difficult to pinpoint the source of such attacks.
Attacks are staged through a range of compromised networks and hosts, and Lilley said this can make it difficult for resources firms to defend against such attacks. “It makes it very difficult to trace the sources of threats, and it’s really not until an incident occurs and you can discover the type of information that was actually taken as a result of the attack or the compromise, that you get an indication of the likely source of the attack,” he said.
Ajoy Ghosh, chief information security officer for IT solutions and security firm Logica, said there has “definitely” been an increase in cyber attacks on resources companies. However, he points out that any company in Australia that has significant foreign trading interests is also under increased threat.
“It’s very important to make the point that attacks come from all of our large economic competitors. I have personally seen attacks coming from so-called friendly nations such as the US, Japan or friendly parts of Europe, so they don’t come from just China,” he said. “At the end of the day it’s less about politics and more about economics.”
Ghosh said resources companies had the added challenge of geography to factor into IT security. “An issue for the resources companies is that they have diverse geographies, so if you can get into any one of their locations, you can use that as a jumping point into other locations,” he said.
Hackers were usually seeking information to gain an advantage in trade or contract negotiations, or information that they could use to leverage to coerce someone to do something, according to Ghosh.
“Yes, information is held by IT, but it really is about people. If you understand what information people have that could be used against them, you can actually go a long way towards preventing that information being collected and successfully used,” he said.
Lilley said IT security and risk management professionals in resources companies need to improve their ability in both raising awareness of IT security issues and in translating technical IT security language into real business language.
“They need a really clear understanding of the business impacts that are actually going to arise from some sort of compromise or successful cyber attack on the business. If they look at it in the context of their business and the types of transactions they’re dealing with, they need to be able to identify what I would term ‘trophy information’,” he said.
“This is information which is so valuable and so sensitive to the business; it might be in relation to an upcoming transaction, a business acquisition or long-term financial performance and management, so this is the kind of information that might be of interest to an attacker.”
IT security professionals needed to organise and harden their internal network to protect this trophy information, he added. “So don’t focus only on the perimeter, identify where your trophy information is and design security on your internal network to help protect against a compromise or a cyber attack.”
The cost of cyber attacks
Symantec’s 2011 State of Security Study found that two-thirds of businesses had experienced a cyber attack in the past 12 months, with larger organisations more likely to experience cyber attacks at 73 per cent, compared to 63 per cent of small to medium size businesses. In addition, 21 per cent experienced an increase in the frequency of cyber attacks.
Furthermore, every organisation experienced some form of loss as a result of a cyber attack, and while a typical business lost $7,925 as a result of a cyber attack 20 per cent of businesses experienced a loss of $100,000 or more. The survey, which took in 250 Australian organisations, found that 50 per cent of businesses experienced downtime as a result of cyber attacks; 18 per cent lost intellectual property; 13 per cent lost other corporate data and 11 per cent reported theft of financial data or credit card numbers.