Data Breach Detection Methods, Australian NDB Scheme,Cyber Security

This essay provides an analysis of data breach detection methods and the strengths and weaknesses of mandatory data breach notification laws in Australia. It summarizes the debate surrounding mandatory data breach notification and offers a technical overview of breach detection, illustrated with a detailed example of signature-based detection of data exfiltration. The essay also explores the implications of the Notifiable Data Breach (NDB) scheme and the General Data Protection Regulation (GDPR) for Australian cyber security within the context of international anarchy. It discusses various detection techniques, including identifying suspicious file transfers, abrupt system changes, and unexplained data loss, as well as methods for detecting spam, virus, and malware attacks. The essay concludes by examining the legislative impact of the NDB scheme and its role in protecting sensitive data.

Running head: CYBER SECURITY
Cyber Security
Name of the Student
Name of the University
Author Note

1CYBER SECURITY
Introduction
It is difficult to tell sometimes in a business organization, if there has been a cyber
security breach within the business process. Security breaches are mainly the procedures that are
adopted by individual attackers or a group of attackers that are trying to avail access to
unauthorized areas within an IT system1. Breaches depend on vulnerabilities within an IT system
and it is also found that in some cases they represent the probation of openings within an IT
system of an organization.
In any case, cyber security breaches claim a significant amount of sensitive data from an
individual or an organization. Security data breaches are the strikes in a business organization
that makes the entire organization realize the importance of a security breach and the adjacent
need of a security system that is required to detect the breaches before they even appear within
the organization2.
This essay would thus present the analytical skills about the ways by which an
organization can detect the data breaches within an organization, which in turn would help the
organization to prevent further attacks on the security systems of the organization. The essay
would further analyze the strengths and weaknesses followed by a summary of the mandatory
data breach laws that are viable in Australia.
A technical overview about the data breach detection would further be explained in the
essay. The essay would also explain a detailed and empirical example of signature-based
detection of data exfiltration. The essay would lastly explain the implications of notifiable Data
1 Ahmed, Mohiuddin, Abdun Naser Mahmood, and Jiankun Hu. "A survey of network anomaly detection
techniques." Journal of Network and Computer Applications 60 (2016): 19-31.
2 Tschuggnall, Michael, Efstthios Stamatatos, Ben Verhoeven, Walter Daelemans, Günther Specht, Benno Stein, and
Martin Potthast. "Overview of the author identification task at PAN-2017: style breach detection and author
clustering." In Working Notes Papers of the CLEF 2017 Evaluation Labs/Cappellato, Linda [edit.]; et al., pp. 1-22.
2017.

2CYBER SECURITY
Breach Scheme for Australian cyber security and the General Data Protection Regulation in the
context of international anarchy.
Detection of data breaches
In a business organization, or even within the internet server system, it sometimes takes a
lot of time to detect a cyber security breach. The time, during which the business organization
finally detects that there has been a serious claim of the intricate data about the business
organization, it could also happen that the business organization might have already suffered a
huge loss with the security attacks that have been caused by the malicious hackers3. There are
various ways by which a cyber security attack can be detected but sometimes it becomes too hard
to detect, even for the experts dedicated to detect the cyber security breaches.
However, there are certain indications in the day to day activity within an organization
that would help in the detection of a security attack that is in progress. The ways by which these
can be detected are listed as follows:
 Suspicious transfer of files of detections of several failed log in attempts found in
the network activities.
 Abrupt changes in the critical infrastructures in the system or the sudden changes
in the system accounts and passwords.
 Detection of suspicious files within the IT system, that may or may not have been
encrypted.
 Banking activities or transactions that have no record within the known system of
the organization.
3 Baesens, Bart, Veronique Van Vlasselaer, and Wouter Verbeke. Fraud analytics using descriptive, predictive, and
social network techniques: a guide to data science for fraud detection. John Wiley & Sons, 2015.

3CYBER SECURITY
 Unexplained loss of the access to the network, social media networks or even the
email ids.
 Sudden leakage of the intricate details about the customers, the list of clients or
even the confidential data about the organization.
 Unexplainable conditions where the internet services and connections become
unusually slow or there is an intermittent access of network takes place.
 Detection can also occur if careful attention is given to the rapid error or warning
signs are displayed by the browsers, antivirus tools or anti malware tools that
warns the entire system about an impending infection.
There are also detection methods in the system of a business organization that would help
in detection or the monitoring of any anomalies within the system that might provide a warning
sign about an attack in progress4. The following examples might be able to shed light on these
detecting techniques:
 Questionable extras in the developed codes or occurrences of unexplained
inconsistencies within the network.
 Problems associated with the logins from the administrative side or problems the
access of the management functions.
 Drastic drop recognized suddenly within the traffic volumes in the company
website.
 Sudden changes detected within the layout and design of the company website.
 Detected issues in the performance of the website that further affects the
availability and the accessibility of the company website.
4 Shu, Xiaokui, Danfeng Yao, and Elisa Bertino. "Privacy-preserving detection of sensitive data exposure." IEEE
transactions on information forensics and security 10, no. 5 (2015): 1092-1103.

4CYBER SECURITY
There are also way to detect the impending attacks on the company through internet, or
the cyber security attacks led through virus attack, spam and malware5. These attacks can have
immense damaging effect on the business and thus it would be quite obvious to have systems
dedicated to detect these kinds of attacks and recover the systems when an attack incident occurs.
The following are the ways by which these kinds of attacks can be detected within the internet
networks:
Detecting Spam attacks: Spam can be defined as an unsolicited communication which
makes up the majority of the traffic in emails. Every internet service provider should offer the
customers with a default spam filtering feature that would help the customer with their dedicated
email services. The spam filtering services helps in the detection of the impending spam attacks
present within a suspicious email with the detection of word pattern and other clues within the
received email. Furthermore, these spam filters diverts these received messages into a separate
folder or a separate mailbox depending upon the spam content in them and these separated
messages are kept within a specific folder to classify them as spam6. A user can opt for buying a
separate spam filter that would help them in reducing the received spam mails and then manage
the inbox in a secured manner. Network phishing is also a substrate of spam mails where them
spam mails are used as a bait to attack a user or further an organization. A spam containing email
can be accidentally clicked or can drag a person to click on them spreading the attack further.
Proper training should be provided to the users within an organization or while accessing
personal computers so that they do not fall prey to these attacks and make phishing attacks
happen.
5 Costante, Elisa, Davide Fauri, Sandro Etalle, Jerry Den Hartog, and Nicola Zannone. "A hybrid framework for data
loss prevention and detection." In 2016 IEEE Security and Privacy Workshops (SPW), pp. 324-333. IEEE, 2016.
6 Ye, Yanfang, Tao Li, Donald Adjeroh, and S. Sitharama Iyengar. "A survey on malware detection using data
mining techniques." ACM Computing Surveys (CSUR) 50, no. 3 (2017): 41.

5CYBER SECURITY
Detecting Virus or Malware: Virus or Malware attacks are also very frequent in the
recent times spanning around various industries and organizations. There are very common signs
that make notice of an individual about an impending attack of virus or malware7. The ways by
which virus or malware attacks can be detected are listed as follows:
 Slowing down of the system
 Unwanted pop-up messages or the detection of unexpected activities on the
machines.
 Intermittent activities or overload detection in email servers.
 Corrupted or missing data files.
 Sudden and unexpected changes detected within the content of the files created
within the machines.
Whenever these signs are detected, it should be readily accepted that there has been a
virus or malware attack within the system which needs to be immediately eradicated from the
system. It is required that these virus and malware must be deleted from the entire IT system of
the business process. These eradication processes must be done by spreading awareness of the
attacks and making everyone alert about the situation8. The infected machines also would need to
be quarantined and a thorough cleanup process must also be followed, making sure that there are
no further room for a re-infection process. The management of the outgoing email traffic should
also be taken notice of during the crisis processes. A proper cyber security incident response plan
should also be devised by the organization to make sure that whenever these problems arise, the
7 Shu, Xiaokui, Danfeng Yao, and Elisa Bertino. "Privacy-preserving detection of sensitive data exposure." IEEE
transactions on information forensics and security 10, no. 5 (2015): 1092-1103.
8 Sarabi, Armin, Parinaz Naghizadeh, Yang Liu, and Mingyan Liu. "Risky business: Fine-grained data breach
prediction using business profiles." Journal of Cybersecurity 2, no. 1 (2016): 15-28.

6CYBER SECURITY
organization would be ready to eradicate them entirely from the system so that they might never
be able to cause harm to the IT system claiming confidential and intricate data from the system.
Data breach detection systems: There are several tools available that help in the
detection of data breaches within the network of an organization or a service provider. Both
software and hardware products are available to detect these issues within the system and even
detect the active threats present within the system. These products are capable of detecting the
threats and alerting the people in charge of protecting the integrity of the security within the
organization to make sure that they take relevant steps in order to protect the dignity of the cyber
security systems. These tools help in the monitoring the entire network and send alerts for the
suspected breach. They monitor the suspicious user behavior, the vulnerability in the network
and even the threats that are present within the applications and the programs9. These tools help
in the detection of relevant threats and focuses on the identified intrusions when they occur. The
controlling and containing of the breaches are also devised by these tools including the
mitigation of the damages in the system done by the data breaches.
These attacks deal with the gaining of unauthorized access over the system and they start
disclosing the protected, confidential and sensitive data within an organization or the system
providing internet to individuals or business organizations. Various kinds of data are at constant
threat because of this, including the confidential health information of individuals, the personal
identifiable information about an individual or a group, the trade secrets as well as the
intellectual properties. Further would be a discussion on how the continental country of Australia
deals with the mandatory data breach notifications and what are the strengths and weaknesses
regarding the cyber attacks about the mandatory data breach notifications.
9 Choi, Young B., and Gregory D. Allison. "Intrusion Prevention And Detection in Small to Medium-Sized
Enterprises." (2017).

7CYBER SECURITY
Strengths and Weaknesses of mandatory data breach notification laws in Australia
The notifiable data breaches or the NDB has entered into the legislative systems of
Australia under the Privacy Act 1988 (Cth) (The Privacy Act) and has imposed a mandatory
obligation, that would require that the eligible data breaches be immediately reported to both the
Office of the Australian Information Commissioner (OAIC) and any individuals who may be
potentially affected by a data breach10. There have been several changes brought about in the law
about mandatory data breach notification that had gone through several modifications to come
about to the final written legislative impact.
The latest changes that have been brought about have made it mandatory to report a data
breach activity that has been detected and under the Privacy Act, this notification needs to be
sent to both the concerned individual and the agency. The eligible data breach also needs to be
justified as per the law to make it feasible for the notification to be sent. However, this law has
some distinct identifiable merits and demerits or strengths and weaknesses related to them. These
can be identified in the descriptions as below:
Strengths of the law: The mandatory data breach notification law would definitely
encourage the business organization to take note about the significant financial losses that they
have been dealing with the entire time and respond to the slow and steady data breaches that
have been occurring all around the organizations in Australia that has the potential to bring down
the entire Australian economy if not treated11. There are policies generated in organizations that
makes them essential in having a secured cyber system within the organization to protect the
confidential data, but making it mandatory ensures that the entire organization works at pace for
10 Carrigan, Dean, John Gallagher, and Ben Di Marco. "Australia's new mandatory data breach notification regime:
How to prepare your business." Governance Directions 69, no. 5 (2017): 280.
11 Solomon, Andrew. "New mandatory data breach notification laws." Superfunds Magazine 428 (2017): 16.

8CYBER SECURITY
making even the personal information secure, not just the information generated for the purpose
of business propagation.
Weakness of the law: It is hard to find much weaknesses in the mandatory data breach
notification in Australia, but there is indeed a weakness pointed out in the law that it is somewhat
time consuming and claims a lot of useful time in the business process. Another point of
weakness that can be detected within the law is that the law does not respond to the disclosure
disincentive, envelope triviality, or content triviality. The companies can try to avoid the data
breach notification that they receive from the customer end. This would in turn make the
consumers keen on not opening the letter of notification as they would already be overwhelmed
enough from the commercial entities. Mostly, the consumers, who are bad at making the relevant
data security choices, would consider such information as irrelevant.
Summarize the debate over mandatory data breach notification
Thus, it can be said that there has been an impending debate over the mandatory data
breach notification law in Australia as the law has both relevant strengths and weaknesses related
to the entire law being imposed on the business organizations all over Australia12. The business
organizations are now obligated to make the customers or consumers aware of the impending
cyber security threat that has the potential to claim their personal and intricate data. The law has
indeed made the positive move by making the reporting of the data breaches mandatory ensuring
that the entire organization works at pace for making even the personal information secure, not
just the information generated for the purpose of business propagation.
However, there are also negativities of the law as they require necessary time that would
have otherwise helped the business propagation. Additionally, the companies can try to avoid the
12 Leonard, Peter, and Data Synergies Principal. "The new Australian Notifiable Data Breach Scheme." (2018).

9CYBER SECURITY
data breach notification that they receive from the customer end and also the consumers, who are
bad at making the relevant data security choices, would consider such information as irrelevant13.
Therefore, it can be said that there is lack of awareness in the people about the severity of the law
or even the severity of the data breaches that has the potential to ruin an entire organization or
gain access over all the unauthorized data of an individual or a group of organization.
Technical overview of data breach detection
The ways by which data breach can be detected follows a lot of technicalities that can be
described in this part of the essay. The data breach can be detected by the potential discrepancies
within an organization or a network provider as well.
The data breaches can be detected if there is proper attention paid on the suspicious
transfer of files or detections of several failed log in attempts found in the network activities.
Again, the abrupt changes in the critical infrastructures in the system or the sudden changes in
the system accounts and passwords make the situation susceptible to data breaches. Detection of
suspicious files within the IT system, that may or may not have been encrypted are also a way by
which data breach can be suspected14. Other methods would be the monitoring of the banking
activities or transactions that have no record within the known system of the organization,
unexplained loss of the access to the network, social media networks or even the email ids,
sudden leakage of the intricate details about the customers, the list of clients or even the
confidential data about the organization, or unexplainable conditions where the internet services
and connections become unusually slow or there is an intermittent access of network takes
13 Solomon, Andrew. "Time to prepare for mandatory data breach notification." Governance Directions 69, no. 10
(2017): 593.
14 Do, Quang, Ben Martini, and Kim-Kwang Raymond Choo. "Exfiltrating data from Android devices." Computers
& Security48 (2015): 74-91.

10CYBER SECURITY
place15. Detection can also occur if careful attention is given to the rapid error or warning signs
are displayed by the browsers, antivirus tools or anti malware tools that warns the entire system
about an impending infection. There are various tools available for the detection of data breaches
as well that prepares an organization or a network system before there is an occurrence of a data
breach.
Detailed and empirical example of signature-based detection of data exfiltration
Data Exfiltration is a method by which an authorized access over a confidential data and
data theft can be regarded as an unauthorized transfer of data from a computer. These are threats
to both commercial organizations and the government equally16. However, there are also ways by
which these data exfiltration can be detected with the help of signature based detection methods.
One of such a detection method is the Content Signature Generator, which is used to generate the
content signatures of sensitive content. Just like the SIDD system, it also matches the content of
the confidential encrypted files within a system and while doing so, it might suddenly make an
exit and take a responsive action17. The spontaneous analogy of the process makes the signature-
based detection method identify the covert communications and statistical features that are able
to capture the natural correlation inherent in media.
Implication of notifiable Data Breach Scheme and General Data Protection Regulation for
Australian cyber security in the context of international anarchy
15 Blumbergs, Bernhards, Mauno Pihelgas, Markus Kont, Olaf Maennel, and Risto Vaarandi. "Creating and
detecting IPv6 transition mechanism-based information exfiltration covert channels." In Nordic Conference on
Secure IT Systems, pp. 85-100. Springer, Cham, 2016.
16 Djanali, Supeno, ADI P. BASKORO, Hudan Studiawan, Radityo Anggoro, and T. C. Henning. "CORO: GRAPH-
BASED AUTOMATIC INTRUSION DETECTION SYSTEM SIGNATURE GENERATOR FOR E-VOTING
PROTECTION." Journal of Theoretical & Applied Information Technology 81, no. 3 (2015).
17 Shim, Kyu-Seok, Sung-Ho Yoon, Su-Kang Lee, and Myung-Sup Kim. "SigBox: Automatic Signature Generation
Method for Fine-Grained Traffic Identification." J. Inf. Sci. Eng. 33, no. 2 (2017): 537-569.

11CYBER SECURITY
International anarchy in the context of cyber security law is a state where there is lack of
authority and sovereignty in accession of authorized data and information18. The way, by which
data breaches occur, indeed there is a state of international anarchy where random data breaches
occur at a drop of hat and the notifiable Data Breach Scheme in Australia would help in the
accession of reducing the international state of anarchy in this matter19. The way by which the
law states that it would require by an organization that the eligible data breaches be immediately
reported to both the Office of the Australian Information Commissioner (OAIC) and any
individuals who may be potentially affected by a data breach would surely make sure that there
are necessary steps taken to make people aware of the cyber security threats and adopt relevant
steps to prevent it20.
In the same way that the notifiable Data Breach Scheme in Australia would help in the
curbing of the international anarchy in cyber security, the General data Protection Scheme also
helps in the same way21. This makes every individual as well as organizations to make sure that
they have applied relevant measures to make sure that there are no cyber security threats detected
within the system they have been using22. In this way, the awareness of data protection and their
importance would spread to the entire population around Australia and the significant breaches
of data including the confidential user data would be secured23. This would in turn help raising
18 Daly, Angela. "The introduction of data breach notification legislation in Australia: a comparative view."
Computer Law & Security Review 34, no. 3 (2018): 477-495.
19 Eesa, Adel Sabry, Zeynep Orman, and Adnan Mohsin Abdulazeez Brifcani. "A novel feature-selection approach
based on the cuttlefish optimization algorithm for intrusion detection systems." Expert Systems with Applications
42, no. 5 (2015): 2670-2679.
20 Bird, Sara. "Mandatory notifiable data breaches." Good Practice 12 (2017): 26.
21 Abrahams, Nick, and Jamie Griffin. "Privacy law: The end of a long road: Mandatory data breach notification
becomes law." LSJ: Law Society of NSW Journal 32 (2017): 76.
22 Johnston, Anna. "2018: A year of significant changes to privacy law." LSJ: Law Society of NSW Journal 41
(2018): 84.
23 Selvadurai, Niloufer, Nazzal Kisswani, and Yaser Khalaileh. "Strengthening data privacy: the obligation of
organisations to notify affected individuals of data breaches." International Review of Law, Computers &
Technology (2017): 1-14.

12CYBER SECURITY
the economy of the country in future as data breaches are able to ruin the entire economy of the
country, as well as the world further24.
Conclusion
Thus, it can be said that the cyber security systems and data breaches that occur within
network system, or in turn within an organization needs to be taken care of with all the technical
amendments possible. This is because; the time, during which the business organization finally
detects that there has been a serious claim of the intricate data about the business organization, it
could also happen that the business organization might have already suffered a huge loss with the
security attacks that have been caused by the malicious hackers. Thus, the essay talks about all
the possible technical ways by which the data breaches can be mitigated. This has been analyzed
with the help the analytical skills about the ways by which an organization can detect the data
breaches within an organization, which in turn would help the organization to prevent further
attacks on the security systems of the organization. The essay has further analyzed the strengths
and weaknesses followed by a summary of the mandatory data breach laws that are viable in
Australia. The analysis explains why these measured should be made mandatory with every user
accessing the internet.
A technical overview about the data breach detection has further been explained in the
essay. The essay has also put forward a detailed and empirical example of signature-based
detection of data exfiltration, called the Content Signature Generator, which is used to generate
the content signatures of sensitive content. The essay has lastly explained the implications of
notifiable Data Breach Scheme for Australian cyber security and the General Data Protection
Regulation in the context of international anarchy.
24 Mann, Monique. "Privacy in Australia: Brief to UN Special Rapporteur on Right to Privacy." (2018).

13CYBER SECURITY
References
Ahmed, Mohiuddin, Abdun Naser Mahmood, and Jiankun Hu. "A survey of network anomaly
detection techniques." Journal of Network and Computer Applications 60 (2016): 19-31.
Tschuggnall, Michael, Efstthios Stamatatos, Ben Verhoeven, Walter Daelemans, Günther
Specht, Benno Stein, and Martin Potthast. "Overview of the author identification task at PAN-
2017: style breach detection and author clustering." In Working Notes Papers of the CLEF 2017
Evaluation Labs/Cappellato, Linda [edit.]; et al., pp. 1-22. 2017.
Baesens, Bart, Veronique Van Vlasselaer, and Wouter Verbeke. Fraud analytics using
descriptive, predictive, and social network techniques: a guide to data science for fraud
detection. John Wiley & Sons, 2015.
Shu, Xiaokui, Danfeng Yao, and Elisa Bertino. "Privacy-preserving detection of sensitive data
exposure." IEEE transactions on information forensics and security 10, no. 5 (2015): 1092-1103.
Costante, Elisa, Davide Fauri, Sandro Etalle, Jerry Den Hartog, and Nicola Zannone. "A hybrid
framework for data loss prevention and detection." In 2016 IEEE Security and Privacy
Workshops (SPW), pp. 324-333. IEEE, 2016.
Ye, Yanfang, Tao Li, Donald Adjeroh, and S. Sitharama Iyengar. "A survey on malware
detection using data mining techniques." ACM Computing Surveys (CSUR) 50, no. 3 (2017): 41.
Shu, Xiaokui, Danfeng Yao, and Elisa Bertino. "Privacy-preserving detection of sensitive data
exposure." IEEE transactions on information forensics and security 10, no. 5 (2015): 1092-1103.
Sarabi, Armin, Parinaz Naghizadeh, Yang Liu, and Mingyan Liu. "Risky business: Fine-grained
data breach prediction using business profiles." Journal of Cybersecurity 2, no. 1 (2016): 15-28.

14CYBER SECURITY
Choi, Young B., and Gregory D. Allison. "Intrusion Prevention And Detection in Small to
Medium-Sized Enterprises." (2017).
Carrigan, Dean, John Gallagher, and Ben Di Marco. "Australia's new mandatory data breach
notification regime: How to prepare your business." Governance Directions 69, no. 5 (2017):
280.
Solomon, Andrew. "New mandatory data breach notification laws." Superfunds Magazine 428
(2017): 16.
Leonard, Peter, and Data Synergies Principal. "The new Australian Notifiable Data Breach
Scheme." (2018).
Solomon, Andrew. "Time to prepare for mandatory data breach notification." Governance
Directions 69, no. 10 (2017): 593.
Do, Quang, Ben Martini, and Kim-Kwang Raymond Choo. "Exfiltrating data from Android
devices." Computers & Security48 (2015): 74-91.
Blumbergs, Bernhards, Mauno Pihelgas, Markus Kont, Olaf Maennel, and Risto Vaarandi.
"Creating and detecting IPv6 transition mechanism-based information exfiltration covert
channels." In Nordic Conference on Secure IT Systems, pp. 85-100. Springer, Cham, 2016.
Djanali, Supeno, ADI P. BASKORO, Hudan Studiawan, Radityo Anggoro, and T. C. Henning.
"CORO: GRAPH-BASED AUTOMATIC INTRUSION DETECTION SYSTEM SIGNATURE
GENERATOR FOR E-VOTING PROTECTION." Journal of Theoretical & Applied
Information Technology 81, no. 3 (2015).

15CYBER SECURITY
Shim, Kyu-Seok, Sung-Ho Yoon, Su-Kang Lee, and Myung-Sup Kim. "SigBox: Automatic
Signature Generation Method for Fine-Grained Traffic Identification." J. Inf. Sci. Eng. 33, no. 2
(2017): 537-569.
Eesa, Adel Sabry, Zeynep Orman, and Adnan Mohsin Abdulazeez Brifcani. "A novel feature-
selection approach based on the cuttlefish optimization algorithm for intrusion detection
systems." Expert Systems with Applications 42, no. 5 (2015): 2670-2679.
Bird, Sara. "Mandatory notifiable data breaches." Good Practice 12 (2017): 26.
Abrahams, Nick, and Jamie Griffin. "Privacy law: The end of a long road: Mandatory data
breach notification becomes law." LSJ: Law Society of NSW Journal 32 (2017): 76.
Daly, Angela. "The introduction of data breach notification legislation in Australia: a
comparative view." Computer Law & Security Review 34, no. 3 (2018): 477-495.
Johnston, Anna. "2018: A year of significant changes to privacy law." LSJ: Law Society of NSW
Journal 41 (2018): 84.
Selvadurai, Niloufer, Nazzal Kisswani, and Yaser Khalaileh. "Strengthening data privacy: the
obligation of organisations to notify affected individuals of data breaches." International Review
of Law, Computers & Technology (2017): 1-14.
Mann, Monique. "Privacy in Australia: Brief to UN Special Rapporteur on Right to Privacy."
(2018).