IT security ‘Best Practise’ in Australia, or better titled “Security through Avoidance”

Reading this article (http://www.theregister.co.uk/2014/05/15/aisa_finding_infosec_bores_board_execs/)  today was a reminder to me of the customers I talk to on a daily basis. Having worked in many countries previous to coming to Australia, it was very apparent that security was very topical for Northern Hemisphere companies, with standards such as HiPAA, SOX, J SOX, Basel II, PCI.

Not to mention best practise IT through ISO and ITIL where automation and processes are critical.

Northern companies understood that improvements to security were critical to protecting sensitive customer data and therefore the organisations own Intellectual Property and value. It didn’t hurt that governments required companies to comply with the aforementioned standards.

Admittedly, it is still an evolving practise but companies knew they needed to do something to protect their value.

Working with customers in Australia though has really brought home the old adage ‘She’ll be right’, thankfully this is slowly starting to change but its taking significant time. Geography is not a protection from hackers and fraud, and even though IT in Australia moves more slowly than its equivalent in the north, the potential for significant cost and pain to companies here is exactly the same as anywhere else in the world. The Internet and frequent vulnerabilities in software has enabled an attack to occur anywhere without care over the location. Australian businesses have been very lucky upto now to not have suffered attacks like Target (USA), eBay, Sony etc.

I can only surmise that:

• Companies are too small to warrant hacking in Australia
• Companies have been hacked but kept it quiet
• Companies are not online sufficiently to be able to be attacked yet

Its probably a combination of all three.