"IBM in the US, for example, have deployed a program where they’re redeploying military personnel into cyber security roles because they have very similar skillsets, and the correct mindset to move into cyber security roles. That’s an effort to try and stem the skills crisis that we’re seeing," she said. "I think generally across the board we all need to be doing the same and looking at existing staff within our organisation for when we’re recruiting, looking for people who have complementary skills, not so much the credentials and the certification.” A 2016 amendment to the Privacy Act required businesses to report serious cyber security breaches. Since the law came into effect, the Office of the Australian Information Commissioner has recorded a steady rise in the number of breaches reported. In the last quarter of 2018, the OAIC received 262 breach notifications, up from 245 the previous quarter. The majority – 64 per cent – were a result of malicious attacks from cyber criminals. The sectors most affected were health service providers, followed by financial services. In most cases cyber criminals were after contact and identity information and financial details. Ms Nancarrow said the legislation had made businesses "more diligent in reporting incidents", which went some way to explaining the increase. She said businesses could protect themselves by hiring cyber security staff with appropriate skills, developing and testing cyber security contingency plans, buying cyber insurance and using the services of consultancies like IBM. But she said a key first step businesses should take was simply to train all staff to recognise cyber attacks. She said the most common cyber attack came in the form of malicious emails sent to unsuspecting employees, meaning employees were "literally the first line of defence". “The one that we’re getting most frequently at the moment is what we call a business email compromise," she said. "This is where an attacker launches a phishing campaign so they’ll send an email that tricks the employee into clicking on a link, which downloads malware that gives the attacker access to that person’s computer. "And they usually go after their contact list so what they’ll do then is they’ll extrapolate that email across to the entire organisation, and before you know it you’ve got hundreds of employees clicking on these malicious links, further providing access for the attackers to that particular network.” She said the cyber criminals were most commonly trying to get to someone in the finance department so they can "do fraudulent financial transactions". She said the growing sophistication of cyber criminal organisations demanded the "good guys" collaborate. "These criminals work together. They share intelligence, they will provide each other with code or malware or executables to help reach the outcome they're looking to achieve by launching the attack. So as the private sector, or the good guys, we have to do the same. And that’s not something we are doing enough. The point is we can’t rest on our laurels," she said.
Three quarters of Australian businesses struggle to fill cybersecurity roles, according to an international survey by IBM Resilient. That labour crisis led to the biggest increase in cyber attacks among the 11 countries studied, with 70% of Australian firms reporting a rise in incidents in the past 12 months, compared to the global average of 55%. The report also revealed 79% of Australian companies did not have a consistently applied cybersecurity incident response plan.