Cyber security : should Australian businesses rethink their data governance practices and cyber security strategies?

Cyber risks such as cyber security breaches, cybercrimes and cyber terrorism are hot topics around the world. Government networks and businesses are regularly targeted by cyber adversaries. Regulators in Australia and elsewhere are facing major challenges in providing comprehensive regulation, a harmonized cyber security framework and strategies to mitigating cyber risks. Cyber security is not only an IT issue but a major governance issue. Good data governance practices and cyber-security infrastructure frameworks assist in managing some of the cyber risks and threats without the need for regulatory requirements on corporations and government agencies. The maturity of cyber security practices varies across government institutions and businesses organisation with many such entities facing significant exposure to cyber security risks. According to the 2014 Australian Cyber Security Centre (ACSC) Report, the estimated cost of cybercrime at a systemic level in Australia from October 2012 – October 2013 is AUD$1 billion which include the actual costs of financial losses from fraud, system remediation costs and costs of immediate response. This paper will first map the cyber threat environment in general. It will then examine if Australia’s current cyber security framework and strategies for data governance meet the international standards set under the European Union’s General Data Protection Regulation for cyber security; and if Australian businesses need to rethink their data governance practices and cyber-security strategies. It concludes with some recommendations for incident response strategies for businesses to implement in order to mitigate and defend against cyber risks