Australian boards urged to boost cybersecurity skills

A University of Queensland study has identified a need to prioritise cybersecurity training for board directors, to better protect Australian organisations from cyber-attacks.

Dr Ivano Bongiovanni from the UQ Business School said his research found board directors were not always sure about their duties and liability for cybersecurity, and often did not fully understand its importance.

“As the data breach at Optus this month demonstrates, no organisation is immune to cyber-crime,” Dr Bongiovanni said.

“We interviewed non-executive directors of 43 organisations about cybersecurity; a lot of uncertainty emerged in terms of current best practices or industry guidelines for cybersecurity strategies.

“There is a misleading perception of cybersecurity being a purely technical topic and directors weren’t engaged or confident talking about it.

“Considering the responsibility to oversee cyber risk management in modern organisations lies with their board of directors, an uplift of cyber-skills at the board level is necessary.”

Cybersecurity failure is considered one of the top threats facing Australian businesses, and with customer information accessed in an attack on Optus, the Australian Cyber Security Centre is warning companies to remain alert.

Study co-author and UQ honours graduate Megan Gale said the potential impact of data breaches on Australian organisations was massive.

“A disruption to IT infrastructure could force a company to shut down, leading to financial loss or even more severe consequences,” Ms Gale said.

“In the Optus breach, sensitive, personal customer information along with identity documents have been accessed, putting people at risk of being victims of fraud.”

The researchers have called for clearer regulations and reporting practices and for cybersecurity training to be made a priority for all board directors.

“It’s not just boards of large companies that need to be better equipped in this area,” Ms Gale said.

“Boards of small to medium-sized organisations across all sectors in Australia, including not-for-profits and community-run organisations, need to be vigilant.”

Director of Cybersecurity at UQ and the Australian cyber emergency response team AusCERT, Dr David Stockdale, said the study showed Australia has some work to do for boards to include cybersecurity in their enterprise risk management activities.

“As we’ve seen with Optus, cyber threats are a matter of ‘not if, but when’, and organisations must be prepared,” Dr Stockdale said.

“More cyber risk training and regular communication between executives and their security teams will ensure the best course of action and prevention.”

The study also involved Associate Professor Sergeja Slapnicar from the UQ Business School.

This research has been published via ScienceDirect.