![Andrew Forrest was the target of a cyber attack a few years ago.](http://web.archive.org./web/20170620104603/http://www.afr.com/content/dam/images/g/w/t/i/2/a/image.related.afrArticleLead.620x350.gwthfe.png/1497939480128.jpg)
This content is produced by The Australian Financial Review in commercial partnership with the Australian Computer Society (ACS).
When one of Australia's richest people, mining billionaire Andrew Forrest, went public in 2015 with the admission that he had been cyber-hacked, it was a stark reminder that no one is safe, Despite the tycoon presumably having state-of-the-art cyber-security measures in place, hackers managed to rip off $615,000 as it was being digitally transferred between accounts.
Last year, information security company Dell SecureWorks said Australia was the third most targeted country of 17 examined in a report on banking "botnets", which refers to computers that maliciously launch repetitive tasks to damage information systems. And according to the security company Kaspersky, Australian banks were among those targeted by the Carbanak campaign, which was discovered in 2016: over a period of 18 months, cyber criminals targeted 100 banks in 30 countries, stealing a reported $US1 billion ($1.3 billion). Carbanak used the "spear phishing" technique, which encouraged some high-level staff to download the malware, which then moved into the bank systems to issue transfers – and even order some ATMs to start dispensing cash.
More recently, the "WannaCry" ransomware attack in May – believed to be the world's biggest online extortion attempt – struck more than 100,000 organisations in 150 countries, including British hospitals, German rail operators and Chinese universities. Britain's National Health Service had to turn away patients after WannaCry locked up hospital computers, forcing the closure of wards and emergency rooms. WannaCry is believed to have emerged from North Korea.
Cyber-security is "a constant game of cat-and-mouse," says Graeme Speak, founder and chief executive officer of BankVault Cyber Security. "Whatever protections a bank puts in place today, the hackers work on that and find a way of cracking it, and then the bank has to work on leap-frogging them again."
Speak says Australian banks, particularly the big four, are "very good" about cyber-security in terms of their internal processes, but the "unavoidable problem" is that their customers' systems may not be secure. And because everyone wants to do their banking online, that is a recipe for problems.
"The bank systems are safe – the problem is always the end-point device that the customer uses. Take your PC: the bank has no control over who you share that computer with, or what other software you've installed on it, and quite simply, no one can ever guarantee the integrity of that interaction."
Nor is the smart phone – onto which digital banking is increasingly moving – safe.
Earlier this year, in Germany, hackers managed to drain customer bank accounts not by hacking the banks themselves, but by exploiting a long-known weakness in a global telephony protocol known as Signaling System 7 – a set of international telecommunications protocols – to redirect the text messages the banks used to send one-time passwords. The hackers used the mTANs – or "mobile transaction authentication numbers" – sent over the O2 Telefonica mobile network to transfer money out of the accounts.
"Previously hackers have targeted your PC using traditional malware to steal people's online banking credentials and break into their accounts, but effectively they've impersonated them," says Speak. "With the new technology they have, they don't have to impersonate you."
BankVault has just launched its SafeKeyboard product, an "invisible keyboard" that builds a pristine virtual machine at a randomised remote internet address, and runs completely independently of the customer's device
"It allows the bank to control the security of that end-point for the time their transaction is happening, for a few minutes – that's all they need," says Speak. "It's effectively a safe window, within which it is impossible for hackers to intercept or see or use passwords, or see anything else they shouldn't."
While something like this "lifts the barrier again," maybe for five or even 10 years, inevitably "the hackers will eventually get around it," he says. "That's just the nature of cyber-security."
Banks must keep adapting to the ever-changing environment, and can "never afford to rest on their achievements," says Lynwen Connick, chief information security officer at ANZ Banking Group. But she adds that it is not just about managing the risks, there are opportunities as well.
"We're going through a digital transformation at ANZ and developing an enhanced customer experience through things like voice biometric security, digital wallets and our BladePay merchant device, and we are also developing improved cyber-security. The two go hand-in-hand."
Connick sees cyber-security as a "key enabler" of innovation and digital transformation. "We're working with a range of partners to promote innovation in security. Embedding security culture will ensure we can safely make the most of the opportunities the online world offers.
"There is also a broader opportunity to develop the right skill sets in our employees, and help develop cyber-security skills more broadly," she says. "There is a worldwide shortage of such skills and we are doing what we can to build them for the future."