Computer Daily NewsThe number, type and sophistication of cyber security threats to Australia and Australians are increasing rapidly and will cost Australia more than $1 billion a year in future, even though the nation is yet to experience a major attack, according to a new report from the Australian Cyber Security Centre.
Noting a likely increase in cybercrime-as-a service, and growing sophistication of cyber adversaries with a destructive capability, it urges governments and private organisations to work together to make Australia a harder target.
The centre is a recently established hub based in Canberra’s Ben Chifley Building. It houses representatives of a number of agencies including Australian Crime Commission, Australian Federal Police, ASIO, Australia Signals Directorate, Computer Emergency Response Team (CERT) and the Defence Intelligence Organisation, which are able to share information.
The 29-page document released yesterday is its first unclassified report. It says serious malicious cyber incidents reported by Australian governments and business have more than tripled in the last three years – growing from 313 in 2011 to 1131 in 2014 and warns that organisations need to improve their “security posture”.
Far more numerous were instances of malware intrusions. Between October 2014 and mid-January 2015, the Australian Internet Security Initiative (AISI) program operated by ACMA reported more than 15,000 malware compromises daily to Australian Internet service providers for action.
CERT Australia responded separately to 11,073 cyber incidents last year, 153 of which involved government, critical infrastructure or national-interest systems.
The report notes ransomware campaigns against Australian computer users are increasing, including a mid-2014 campaign that targeted government and non-government organisations
In the same vein it notes a growing trend for distributed denial of service extortion, in which an adversary will threaten to launch DDoS activity against an organisation unless a fee is paid.
The Australian Cyber Security Centre advises Australian organisations not to respond to such threats. “There is no way to determine if the threat is credible, or to guarantee that the DDoS will not occur if the fee is paid,” it warns.