What the OAIC data breach report tells us about cyber threats: Peter Moon
![Health companies reported the most data breaches in the last quarter, but they're also more likely to be caught by the ...](http://web.archive.org./web/20180810073250im_/https://www.afr.com/content/dam/images/h/0/y/s/q/k/image.related.afrArticleLead.620x350.h13t11.png/1533882033497.jpg)
![Peter Moon AFR Woodcut](http://web.archive.org./web/20180810073250im_/https://www.afr.com/content/dam/images/g/y/z/h/e/v/image.imgtype.afrWoodcutAuthorImage.120x120.png/1507775529834.png)
The awkwardly named Office of the Australian Information Commissioner, known to its friends by the equally ungainly acronym OAIC, has released its first full quarterly report on data breaches that have been notified to it under the mandatory self-reporting law that launched in February. It makes for interesting reading, as long as you recognise the limitations around its data.
It reveals that in the June quarter, 242 incidents were notified. In some cases, it seems the same breach may have involved multiple organisations that separately reported. I'll have something to say about that in a few paragraphs.
So, who were the bad boys? The document doesn't name names, but it does list the top five industry sectors for notified breaches. Coming in at No.1 are health service providers (49 notified breaches), followed by the finance industry (36), then legal, accounting and management services (20), with education (19) and business and professional associations (15) making up the field.
But let's not wag our collective finger at the medicos based on those raw numbers. What they don't tell you is that health service providers of any size are subject to the notification laws, while in many other cases businesses turning over less than $3 million are excused. If all small businesses were required to report, as small health services providers are, our white-coated friends probably wouldn't top the leader board.
The quarterly report also tries to shed some light on the reasons why organisations end up leaking potentially toxic data. Overall, it suggests that malicious or criminal "attacks" account for 59 per cent of notified breaches, 36 per cent are due to human error and 5 per cent the result of "system faults".
More data needed
This kind of data could be invaluable in focussing business security strategies, but the OAIC's report is problematic. At this stage, the volume of data simply isn't large enough to generate statistically significant conclusions. But, even with more quarters completed and larger numbers analysed, it will always be hard to get reliable information on the root cause of many data breaches.
Businesses often don't know what happened, and even if they do there's a temptation to blame an evil cyber-mastermind rather than admit they were just plain dumb.
Even the OAIC's own classification of "attacks" treats the use of compromised system credentials and falling prey to social engineering as instances of attack rather than human error. As one security expert put it to us, most so-called hacks depend on human stupidity. (Security geeks are seldom diplomatic.)
An interesting metric the Office is trying to track is the number of individuals affected by different kinds of data breaches. For instance, 32 breaches arose from personal information being mailed to the wrong recipient – 22 of those were by email and 10 by paper post.
According to the analysis, however, the average number of people affected per incident was six in the case of misdirected paper mail, but 35 for email. It seems that digital data bombs create a much bigger blast zone than paper ones.
We'll look into the OAIC's methodology for measuring this, but if it's sound and the long-term data holds course, it has implications for the design of business email systems.
Talking about systems, there's a curious category of data breach cause called "system faults", which the OAIC describes as "a business or technology process error not caused by direct human error". According to the detailed data, this accounts for incidents of "unintended access" or "unintended release or publication" that made up 5 per cent of total reported incidents.
If this kind of fault is correctly diagnosed, other users of similar systems deserve access to detailed information about what went wrong. It seems that a business could do everything right, but still fall victim to a "system fault" that produced a serious data breach. As when a software vulnerability is discovered, these "system faults" need to be patched.
Finally, here's that word about single incidents being reported by multiple organisations. There's no law against that, but where there's room for two or more businesses to be involved in a breach then a coordinated response, including reporting, is best. Businesses and their partners should already have their coordinated disaster response plans in place.
Peter Moon is a technology lawyer with Cooper Mills. peter.moon@coopermills.com.au