SBM4302: IT Audit and Controls - National Australia Bank Data Breach

This report provides an in-depth analysis of a data breach experienced by the National Australia Bank (NAB). It begins with an introduction to data breaches and their impact, followed by an overview of the specific incident where NAB informed consumers about the exposure of personal information to third-party data service providers. The report highlights the common security issues within NAB that an auditor should investigate, including unencrypted data, malware, insecure third-party services, data manipulation, spoofing, and skimming. It then details NAB's response to the data breach and proposes information security measures the bank should adopt, such as better risk assessment, stronger authentication standards, a layered security approach, advanced authentication techniques, and enhanced consumer awareness. Finally, the report underscores the importance of cloud computing in information security, emphasizing its benefits like centralized security, cost reduction, reduced administration, reliability, and agile innovation, concluding with a summary of the key findings and recommendations for improved cyber security practices.

Running head: IT AUDIT AND CONTROLS
IT AUDIT AND CONTROLS
Name of the Student
Name of the University
Author note

1IT AUDIT AND CONTROLS
Table of Contents
Introduction................................................................................................................................2
Overview of the addressed problem...........................................................................................2
Common security issues of National Australia Bank................................................................3
Response of National Australia Bank to the data breach...........................................................5
Importance of cloud computing in information security............................................................7
Conclusion..................................................................................................................................9
References................................................................................................................................10

2IT AUDIT AND CONTROLS
Introduction
Data breach is an incident that reveals all kind of confidential information. Hacking
and malware is the primary reason for data breach in banking sector at 74.5%. Insider threat
increased from 2.9% to 5.5% today, while the accidental disclosures increase from 14.7% to
18.2% (Hernandez-Nieves et al. 2020). According to Bitglass, in 2019, only six percent of all
data breaches were affected by the banking sectors. In 2019, sixty percent of all leaked
records were exposed by the banking sectors. It happens because of Capital One Mega breach
which hampers more than hundred billion records.
In this report, an overview of the problems highlight in the case study is discussed
(Jain and Puri 2020). After that, this report will highlight a common security issues that the
auditor needs to investigate for the National Australian Bank. After that, the response of
National Australia Bank regarding the data breach will be discussed. Then the report will
propose the information security measures that should be adopted by National Australia
Bank. After that, the report will describe the importance of cloud computing in the
information security.
Overview of the addressed problem
On 26th July, 2019, National Australia Bank communicated thirteen thousand
consumers to inform that some personal information was uploaded to the servers of the two
data service providing companies (Derhab et al. 2020). The security team of the bank advised
the two companies to remove all the information within two hours. The Chief Data Officer of
the bank mentioned that compromised data involved the name of the consumer, date of birth,
contact details and in some cases a government issued identification number. The Chief Data
Officer of the bank said that they took necessary actions for protecting the information of the

3IT AUDIT AND CONTROLS
consumer. She said that it was a human error and it was a breach of the data security policy of
National Australia Bank. She also mentioned that it was not an issue related to the cyber
security because no login details and passwords of the bank had been compromised. The
system of the bank was totally secured.
National Australia Bank individually informed all the consumers. They appointed a
team for providing 24/7 service to the consumers. The bank authority said that if government
identification document required being re-issued, then the bank authority would bear the cost.
They would provide a fraud detection services to their affected consumers.
Common security issues of National Australia Bank
There can be many security issues of the National Australia Bank which an auditor
needs to be investigated. These are as follows:
 Unencrypted data
It is a very basic yet a crucial part of good cyber security in National Australia
Bank (Rawwash et al. 2020). The security auditor needs to investigate whether all the
data of the consumers stored on the computer as well as online is encrypted or not. If
the data is encrypted then it is hardly possible for the black hat hackers to use those
data after hacking. If it is not encrypted then hackers can use those data very
easily and can create a serious problem.
 Malware
The security auditor should check whether end gadgets (such as computer and
cell phone) have been affected by malware or not because it creates a big security risk
to the cyber security of the National Australia Bank each time when it is connected to
the bank’s network (Tesema 2020). If sensitive data passes through this network and

4IT AUDIT AND CONTROLS
if the gadget of the end user is affected by the malware (without appropriate security
features), that malware could attack the network of the bank.
 Insecure third party services
National Australia Bank appointed two third party data service provider for
providing better consumer services (van Gilst et al. 2020). The security auditor needs
to investigate whether these two companies have a good cyber security measure or
not. It is very important to investigate how the bank authority protects their consumer
data from cyber security threats imposed by those two service providing companies
before deploying their software.
 Data that can be manipulated
Sometimes, black hat hackers do not steal data from the server of the bank
(Vijai and Anitha 2020). They simply modify those data. It is very difficult to detect
this type of attack. The security auditor should investigate whether such incident
occur or not. If such incident occurs then it may lead to a huge amount of financial
loss for the National Australia Bank because modified data does not have any
difference than unaltered data. It is very challenging for the security auditor to
detect what has been hacked and what not if the hacking is done in this particular
manner.
 Spoofing
New type of cyber security is spoofing. In this particular case, hackers will
create a duplicate website of the bank which looks and functions exactly same (van
Gilst et al. 2020). Security auditor should give a special emphasis to this cyber
security threats. If it happens to the National Australia Bank, then it is very crucial

5IT AUDIT AND CONTROLS
cyber security issue. When a user enters his or her login details to the official portal
of the bank, then it is hacked by the black hat hackers. Most important point that
latest spoofing technique is using slightly different but almost similar uniform
resource locator of the bank. Their intention is to hack those consumer details who
visit the bank’s website.
 Skimming
With the help of this method, fraudsters use credit cards details to get all the
details of the consumer such as account number, PIN number and many others
(Toapanta, Zamora and Gallegos 2020). It is also a very crucial security issues which
can be addressed by the security auditor. When a consumer swipes his or her credit
card, there is skimming gadget attached to the machine. It captures and stores all the
personal information of the consumer. They use this information for performing
online transactions.
Response of National Australia Bank to the data breach
National Australia Bank advised their all consumers that they do not to take any
action regarding their bank account. Ms Crisp mentioned that they reviewed all the accounts
of the consumers. But they did not find any abnormal activity into it. The bank authority
informed this matter to the Office of the Australian Information Commissioner (Tesema
2020). The Chief Data Officer mentioned that they would investigate this matter. They
assured the consumers that it did not happen again. Regarding the further development, the
Chief Executive Officer of National Australia Bank said that it was hardly possible to invest a
huge amount of money for the information security of the bank compared to the IT giant like
Microsoft, Google, and Amazon.

6IT AUDIT AND CONTROLS
Information security measures that NAB should adopt
 Providing better risk assessment
In order to establish risk mitigation plan, the National Australian Bank
should assess their online transactions as well as the risks presented by this type
of transactions (Suseendran et al. 2020). The bank authority should make sure to
assess some attributes such as type of consumer, volume as well as capability of
the transaction methodology, sensitivity of the information, exisisting security,
ease of use and how mobile gadgets are working. Bank authority needs to review
this strategy at least every twelve months. This risk assessment will help the bank
authority to figure out the potential impacts as well as necessary security service
level.
 Adopting strong authentication standards
National Australian Bank should implement some strong
authentication standards, not just simply giving username and password
especially for high risk financial transactions such as wire transfers (Singh et
al. 2020). Traditional two factor authentication solution such as one-time
password tokens are not very efficient against current cyber attacks such as
man-in-browser attacks. There are various types of strategies that gives a level
of protection needed either with the help of separate communication channel
with the user or by implementing a fraud detection engines that can detect
transaction automatically.
 Taking a layered approach

7IT AUDIT AND CONTROLS
Conventional fraud detection approach is not at all beneficial for the
National Australia Bank for stopping the advanced malware (Rawwash et al.
2020). Bank authority needs to adopt complementary security policy such as
powerful authentication, out-of-band transaction verification, mobile
communication as well as extended validation of SSL security certificates
which provide the outstanding methodology for securing the consumer data as
well as transactions in banking environments.
 Implementing advanced authentication techniques
There are lots of advanced authentication methodologies (Megargel,
Shankararaman and Walker 2020). As the online frauds become sophisticated
then innovation in authentication is very important to prevent these online
attacks in consumer space. These technologies are mobile based transaction
verification, dynamic device authentication and many others.
 Enhancing the consumer awareness and education
National Australia Bank involves the consumers to reduce the fraud.
They should perform some awareness programs to make the consumers aware
regarding to mitigate those threats (Logan 2020). They can also perform some
education and training programs to the consumers for preventing those
threats. It is very crucial that consumer confidence is maintained. Continuous
investment in the security measures and hiring Information Technology
Officer is must rather than nice to have.

8IT AUDIT AND CONTROLS
Importance of cloud computing in information security
For National Australia Bank, robust cloud computing security is very important (Jain
and Puri 2020). Security threats are gradually increasing as well as cloud computing is not
less than an on-premise environment. For that reason, it is mandatory to work with cloud
service provider who has the capability to provide outstanding security that can be
customized in the IT infrastructure of the National Australia Bank. It has several benefits,
such as:
 Centralized security
Cloud based networks contain many gadgets as well as terminal points
that can be very difficult to manage for shadow IT or BYOD (Bring Your Own
Device) (Hernandez-Nieves et al. 2020). Management of these entities
centrally increases the traffic analysis as well as web filtering, streamlines for
monitoring the network events. As a result of that, it creates updates for fewer
software and policies.
 Cost reduction
One of the major benefits that can be enjoyed by National Australia
Bank is the utilization of cloud storage as well as security. It helps to reduce
the importance of investment of the bank in dedicated hardware (Derhab et al.
2020). It eliminates the capital expenditure as well as administrative overhead
of the bank. Cloud security offers security features that gives 24/7 protection
having a small amount of human intervention.
 Reduced administration

9IT AUDIT AND CONTROLS
If National Australia Bank selects a popular cloud service provider or
cloud security framework then the bank authority does not have to bother
regarding manual security as well as it provides almost constant security
updates. These tasks may have a huge amount of resource drainage
(Barankova, Mikhailova and Afanaseva 2020). But when the National
Australia Bank migrates them to the cloud based platforms then entire security
administration is managed by itself.
 Reliability
Cloud computing services offer a huge amount of dependability
(Balapour, Nikkhah and Sabherwal 2020). With the proper security measures,
consumers can access data as well as applications of National Australia Bank
within the cloud platform, no matter the location of gadgets or what gadgets
they are using.
 Agile innovation
Accessing cloud based platforms helps to enhance the ability of the
National Australia Bank to perform innovation by enhancing agility,
efficiency and productivity (Aribake and Aji 2020). It helps the bank authority
to reallocate the resources far away from the IT administration. It helps them
to move forward towards the innovation, fast delivery of the products and
services to the market.
Conclusion
When it comes to the cyber-security threats, there is only one guarantee: hackers will
adopt some new strategies to hamper the network of the National Australia Bank. Target may

10IT AUDIT AND CONTROLS
be to decrease the reputation of the bank, but cyber-criminals are adopting some new
technologies to perform the attack. In order to fight back, the bank authority must be prepared
to face both the latest threats and old methodologies. One way to resolve this issue is that the
bank authority may prepare an effective data breach response plan. It offers identity theft
protection for providing enough protection to the consumer information.

11IT AUDIT AND CONTROLS
References
Aribake, F.O. and Aji, Z.M., 2020. THE MEDIATING ROLE OF PERCEIVED SECURITY
ON THE RELATIONSHIP BETWEEN INTERNET BANKING USERS AND THEIR
DETERMINANTS. Technology (IJARET), 11(2), pp.296-318.
Balapour, A., Nikkhah, H.R. and Sabherwal, R., 2020. Mobile application security: Role of
perceived privacy as the predictor of security perceptions. International Journal of
Information Management, p.102063.
Barankova, I.I., Mikhailova, U.V. and Afanaseva, M.V., 2020, January. Minimizing
information security risks based on security threat modeling. In Journal of Physics:
Conference Series (Vol. 1441, No. 1, p. 012031). IOP Publishing.
Derhab, A., Belaoued, M., Guerroumi, M. and Khan, F.A., 2020. Two-Factor Mutual
Authentication Offloading for Mobile Cloud Computing. IEEE Access, 8, pp.28956-28969.
French, L., 2020. HOW DATA IS TRANSFORMING THE FINANCIAL SERVICES
INDUSTRY.
Hernandez-Nieves, E., Hernández, G., Gil-González, A.B., Rodríguez-González, S. and
Corchado, J.M., 2020. Fog computing architecture for personalized recommendation of
banking products. Expert Systems with Applications, 140, p.112900.
Jain, R.B. and Puri, M., 2020. An Approach Towards the Development of Scalable Data
Masking for Preserving Privacy of Sensitive Business Data. In Artificial Intelligence and
Evolutionary Computations in Engineering Systems (pp. 733-743). Springer, Singapore.
Logan, P.Y., 2020. Crafting an undergraduate information security emphasis within
information technology. Journal of Information Systems Education, 13(3), p.3.
Megargel, A., Shankararaman, V. and Walker, D.K., 2020. Migrating from Monoliths to
Cloud-Based Microservices: A Banking Industry Example. In Software Engineering in the
Era of Cloud Computing (pp. 85-108). Springer, Cham.