NSW Health disclosed yesterday it was investigating a breach of an “isolated server” that occurred last week, after a hacker published data allegedly stolen during the incident on a prominent hacking forum.
The department has so far not responded to further requests for comment, but while the Minister responsible has said no patient data has been compromised, ACS CEO Dr Prins Ralston said continuing incidents impacting major holders of Australian data, such as Qantas’ recent disclosure, continue to raise questions about data sovereignty.
“These are services Australians depend on, and the warnings keep coming. Each incident raises the same question: can organisations demonstrate that their protections work and that the people responsible have the capability to protect them,” Dr Ralston said in a statement.
“Patients trust the health system with personal information and protecting it is part of the responsibility that comes with providing their care.
“Health Minister Ryan Park said no patient data or clinical service had been impacted. He also described NSW Health's cybersecurity systems as very robust and acknowledged the need for government agencies to strengthen their systems against criminal activity and threats.”
Dr Ralston said that Transport Minister John Graham’s assertion that cyber security is getting tougher for private and public organisations in the wake of the NSW Health disclosure is absolutely correct.
“The NSW Audit Office has already raised serious concerns about cyber security in Local Health Districts, including their preparedness to respond to incidents,” he said.
“The question is how government and industry can demonstrate that those protections are working and how we can trust the people doing it. Evidence is needed that security controls work, recovery plans have been tested, and the professionals responsible are capable with independently verified skills.
“Australians deserve confidence that their information is protected and essential services can keep operating under pressure. That confidence has to be backed by evidence.”
However, Dan Elliott, Field CISO, APJ for threat intelligence firm Recorded Future, said that while it is reasonable to feel concerned about the incident, “I think it's too early to evaluate the impact on the average Australian until an investigation has concluded.”
That said, Elliot added that disclosure at this early stage is the right way to preserve trust.
“If the organisation was seen to be concealing a breach, it would likely raise even more concern. It is reasonable that this will reduce some reputational risk, while preserving a potentially live police investigation,” Elliot told Cyber Daily.
“Threat actors also often threaten to leak the existence of a breach as a lever to induce action; while possibly not the case in this instance, acknowledgement takes back that power.”
Elliot also commented on the hacker’s possible motivations for sharing the data online for little cost.
“There are many reasons that individuals and groups publicise their activities outside of direct monetary gain. It could be a case of seeking notoriety or increasing their reputation by simply proving their ability. It could be an insider with a grievance or someone seeking to embarrass the victim. It could be hacktivism or disruption to influence other parties,” Elliot said.
“It could be any combination of the above, and, if the data is truly stolen, it's still available for later resale. In short, without knowing the individual or association, it's very difficult to draw conclusions on their goals or intentions.”
Want to see more stories from trusted news sources?Make Cyber Daily a preferred news source on Google.
