Analysis of Telstra Corporation's Cybersecurity Report (2018)

Desklib provides past papers and solved assignments. This report analyzes Telstra's cybersecurity in 2018.

Cyber Security Law and Regulations
Page | 1

Table of Contents
Introduction......................................................................................................................................3
Cyber Security and its Importance...............................................................................................4
Importance of the Cyber Security............................................................................................5
Security Report of Telstra Corporations Ltd................................................................................6
Preparations for Cyber Security...............................................................................................7
Challenges of Cyber Security...................................................................................................8
Security Threats and Trends........................................................................................................8
Application of legal and legislative consideration in relation with the current trends..............11
Conclusion.....................................................................................................................................16
References......................................................................................................................................17
Page | 2

Introduction
In the era of digitalisation, businesses are adopting new technologies which provide assistance in
carrying the operating and functional activities of the companies. It is well established that the
implementation of digitalisation has been made by companies all over the globe. As
digitalisation makes the performance of activities and the operations involved in the business
easy, at the same time, it also poses a certain threat of security. Security is considered to be an
essential part of the business without which its growth and development are not possible. This
also includes cyber security which is crucial for the management of the companies operating in
the telecommunication sector. With the development in technology, there has been developed in
different threats which are faced by the companies in regards to cybersecurity. As the internet
has become an essential part of everyone’s life, due to which the attackers are targeting internet
as a mode to attack the companies. This affects the working of the organisation financially as
significant information and data of the company is leaked and shared amongst the competitors.
This assignment is based on one of such companies operating in the telecommunication sector,
Telstra Corporation Limited which is established in Australia and operates in different parts of
the world. This assignment is developed on the security report of the company of the year 2018.
For this assignment, the application of legal and legislative consideration in relation to the
current trends has been considered. Laws are considered as a significant factor which provides
a safeguard to the companies operating in the business environment against unfair practices. This
assignment also includes the threats which are faced by the company, Telstra and what laws are
followed by the management of the company in order to ensure about data and information
protection.
Page | 3

Cyber Security and its Importance
It can be stated that proper management and maintenance of security is not easy. Moreover, in
the case of Cyber Security, such management and maintenance become more complex as there
are different ways from which attack can take place. It becomes necessary that adequate and
effective cybersecurity is adopted by the companies so that safeguard against such attacks can be
provided to the information and data of the company (Lord, 2019). Furthermore, there are
different laws or legislation which is required to be followed and complied with by the
management of the company. Compliance with provisions of applicable laws also provides
protection from such attacks. It is necessary that at first instance, Cybersecurity must be
understood properly.
“Cyber Security can be defined as the body of the different practices, processes, and
technologies which are designed to provide protection to the networks, information and data
and devices from the invulnerable attacks or unauthorised access to the system”
(Australia.gov.au, 2019).
It has been stated that cybersecurity of the company is dependent upon its three pillars i.e.
People, Processes and Technology. People mean the staff of the company which considered as
important resources of the company. It is necessary that each and every employee must be clear
with their roles and responsibilities in reducing or preventing cyber attacks or threats.
Appointment of a skilled and expert staff of technical cybersecurity must be made by the
management of the company who will be responsible for ensuring the security (ITGovernance,
2019). Processes mean that set of activities, roles, and documentation which are involved in
cyber security. Such processes are adopted by the management of the company in order to
mitigate the risks. Due to innovative ideas and developing technology, cyber threats are
reforming quickly. Therefore, it is necessary that such processes must adapt accordingly to
reforming cyber threats. Technology includes determination of the issues, risks or threats faced
by the company after which the implementation of the digitalisation will be made. It is crucial
that such implementation is made in accordance with the requirements or needs of the company
and the nature of the threats.
Page | 4

Importance of the Cyber Security
With the development of technology and handy devices, users or companies stores important
information and data in such devices and systems. Moreover, with the connection of interest, the
devices or systems are more vulnerable to cyber attacks. Storing of such sensitive and important
information which includes intellectual property, personal information, financial data and so on
can be jeopardized, if such data or information is exposed or extracted. It is well known that the
company transmits or transfer significant information on its servers or networks for the
conduction of business and for making the performance of the related activities (ITGovernance,
2019). Therefore, with cybersecurity, protection or safeguard to such information and data can be
provided from the cyber attacks and it can be stored as well as transmitted safely.
Page | 5

Security Report of Telstra Corporations Ltd
This report of the company focuses on cyber and electronic security. This report includes the
incidents which took place in 2018, challenges faced by the company and the impact of such
challenges in the business, compliance with different laws, the security threats and trends which
are faced by the company and future investments. Mentioned above are the aspects on which the
report of Telstra is based. It has been stated in the report that there are various events which took
place in 2018 that raised the question on cyber securities of the companies. These events include
WannaCry Ransomware, the Equifax breach, Notpetya Malware and the tools for hacking by the
group, Shadow Breaker. Such events had affected the business environment due to which various
companies have faced financial losses. It has been analysed in the report that the companies are
shifting towards the strategy of implementation of security tools or programmes for ensuring the
security of the information and the data instead of waiting for the security breach to happen. It
has also been analysed in the report that the ransomware attacks has been increased in the recent
period of time. As a survey was conducted in this regards, it was discovered that 31% of the
businesses operating in Australian market was interpreted because of such security breach in the
past year which is more than any other previous years (Herjavec Group, 2017).
Companies operating all over the globe have recognised the significance of security which is
considered as one of the factors of success in the large transformation projects and in getting the
trust the customers. Not only the operations and functions of the business are affected by such
events, but it also has an impact over the customer base of the companies as a customer would
feel that their information and data is not safe with the company. The cyber attack in the year of
2017 resulted in the loss of customer confidence along with public embarrassment, loss of
intellectual property, the decline in share prices of the companies, litigation threats and so on.
This can be made clear with the help of an example of the Equifax breach which was hacking of
145.5 Million accounts of the customers. Moreover, it has been considered as largest reported
breach till now (Hackett, 2017). It can be determined that the loss of 145.5 Million customers
and interruption in their trust and confidence can have an impact on the global business market.
Losing the trust of a such number of customers will result in loss business and some of the
companies may not be able to survive such distress.
Page | 6

As there has been a rise in cybercrime which has become a lucrative business, it has been stated
by spruces of the sector that the damages or losses which can be sustained by the business
environment will reach up to US$6 Trillion Dollars in the global market till 2021 (Herjavec
Group, 2017). There are different types of cybercrime which are taking place in the business
environment. These cybercrimes include DDoS (Distributed denial of service), APTs (Advanced
Persistent Threats), web and application vulnerabilities. The aims or motives of such attacks is
conducted a security breach as publically as possible, to get the price sensitive information of the
company, intellectual property threat, getting the customers information and data and staying
within the system of the company for a longer period of time in order to keep a track of the
activities or plans of the companies. It has been stated that ransomware is one of the fastest
growing security threats. It has been estimated by the Government of Australia that the
ransomware results in loss of A$1 Billion per year. The conduction of such attacks or the events
of breach of security is supported by the underground markets, the growth of cryptocurrency
allowing the sellers and the buyers to make transactions anonymously. It has been stated that
these attacks or events are no longer conducted on a random basis but are conducted deliberately
with the view of demanding the ransom from the companies in exchange of their significant and
sensitive files, information or data.
Preparations for Cyber Security
As the companies are more focused towards cybersecurity, it makes sure that there is a
continuous increase in the promotion of cybersecurity. The management of the companies is
adopting different frameworks in order to ensure cyber security which includes compliance tools
with end-user training, assessments of risks and security audits. In the past few years, security
has been shifted to being an essential part of the company’s operations and functions, hardwired
and integrated to the system of the company from being a value-addition or premium service. It
is essential that the need or requirement of appropriate security must be identified at the initial
stage. Failure to do so results in undergoing postponing the project or even failure to attain the
aims or objectives of the project. It has been analysed that there are various businesses which had
identified the need of security after the project is commenced has faced issues in completing the
project and even in failing to complete the project (Telstra, 2018). In the report of Security
Report of Telstra, it has also been analysed that the European and APAC companies are focusing
Page | 7

more on conduction of security audits as its one of the main activities. It has been stated that
after conduction of security report, the focus of the companies shifts towards risk assessments
and on enhancing the awareness about the security. From this, it is clear that major recognition
has been provided to cyber security. Moreover, GRC (governance, risk management, and
compliance) are considered in regards with Australian laws of disclosure of data breach.
Challenges of Cyber Security
There are various elements which are to be taken into consideration while making
implementation of cyber security. Coordination amongst these elements is required to be
maintained within the information system of the company. Network security, data security, cloud
security, application security, identity security, etc are some of the elements which are
considered while implementing cybersecurity (Lord, 2019). However, maintaining coordination
amongst these elements is a complex task. Another challenge faced by the management in
cybersecurity is continuously changing nature of the security threats. It is necessary that
appropriate cybersecurity must be implemented and it must adapt in accordance with the changes
in the cyber threats.
Security Threats and Trends
It is well established that with the development of technology with the assistance of innovation
and new ideas, the threat which companies has to face while operating its businesses has also
been increased rapidly. There are different ways by which the cybersecurity can be a breach and
the information and data available on such system or available on the system which is connected
to the main system can be hacked, manipulated and stored. This makes it necessary to make sure
that effective measures are taken by the companies in order to deal with such threats. As there
are different ways which pose threat for the companies, one of such threats is Email Threats and
Phishing Campaigns. Emails are considered as the commonly used mean of communication
which is used for personal as well as professional works despite of development of a different
type of messaging apps or platforms which different features. With the rise in a number of emails
with the passing time, there is a rise in the number of spam emails as well. It has been estimated
by a company named, Symantec that in 2017, 53% of the total emails fall within the category of
spam (Symantec, 2017). These emails are considered as harmful as these emails contain malware
Page | 8

in it. It has been analysed by FirstWave Cloud Technology that there also has been increasing in
a number of malicious URLs by the 1,056 percents and rise in phishing by 1,178 percent. In
order to attack through email, vulnerabilities are not to be relied on. Deception has to be
maintained before the victim to be a volunteer in the attack due to which personal as well as
company’s information and data can be compromised. Spam emails are unwanted emails which
are sent by a single source in bulk. This mean is used by the attackers to extract sensitive
information and data from the users (COFENSE Inc, 2017). Whereas phishing can be defined as
an attack in which users data and information including the account credentials of the users and
details of credits cards, etc. are extracted. In this, the attackers track the activities of the user,
online usage and target the websites which are used by them generally by getting into the daily
routine of such user. Then, with help of deception, users are made to click malicious URLs
which help the attackers to extract the information. The chances of breach of security can be
reduced by proper and strict password management policies. The password of the accounts must
be changed frequently and it must be made sure that previously used password is not reused.
One of the most used mean for attacking the companies for its information and data is
Ransomware. It is malicious software which targets the weaknesses of the humans and the
technical system due to which availability of the data and the information is denied in the
system. There are different methods by which system of the companies can be attacked, Phishing
is one of such methods that is used most commonly in the current times. Under this, email,
constraining malware, is sent which is labeled as delivery, invoice, etc. Once the email is
checked by the user, the installation of the malware takes place within the computer system with
the help of hidden downloader. As this attack is unnoticed by the user, it spreads throughout the
system quickly (Stockley, 2017). Then, the user is unable to access its files, data or information
and the attacker demands the ransom. The most common mode of payment demanded by the
attacker is cryptocurrencies like Bitcoin. It is stated by the attacker that if the desired payment is
made within the specific time period, then he or she would be able to access the data or
information. In case of failure to make payment, all the files whether encrypted or not will be
destroyed. In the year 2017, ransomware was the major threat faced by companies. This can be
understood with the help of an example of an attack that took place in June 2017. Maersk, the
shipping container company was targeted and attacked. It was disclosed by the management of
Page | 9

the company that such attack resulted in damages amounting approximately $300 Million.
Moreover, its global business activities were also impacted which is across 76 ports.
Page | 10

Application of legal and legislative consideration in relation with the current trends
Telstra is the largest Telecommunication Company in Australia which assists in building and
operating the networks of communication and voice of the markets, access via the internet,
television payment and other related products and services. This company successfully competes
in the whole market of telecommunication. It is the fastest connection in the field of mobile
network. Telstra is continuously working in satisfying the needs of the customers and improving
their services. In this context, there are several legislations that are abided on the company so as
to conduct the business operations in a fair and transparent manner. These are mentioned below:
General Data protection Regulation- For the security and the compliance purpose the Telstra
hold the data of the EU citizens for providing the high level of protection the role of this
regulation is crucial. In case if any failure in complying of this regulation by the organizations it
would be liable to pay fine highest of the up to €20 million or the total turnover of the company
in the preceding financial year (Anwar, et. al., 2018). For the purpose of cybersecurity 84
percent of the total businesses in Europe follow this regulation. This regulation provides
protection to the data of the company against the unauthorized access of the information and the
confidential data of the company. It also ensures that the data of the company remain safe. In this
regard, the company uses encryption technology for delivering the data securely and this
encryption is important to make the failure of the attempts in attacks of SSL/TLS. It also
provides protection against potential attacks (Team, 2017). It is important that the company can
take appropriate action for securing the data of the employees and implement such software’s
that assist in the protection policies of the data and information of confidential nature. Further, in
this context, the company uses technologies like face recognition. In this context, there are cases
that are mentioned below:
Case1
Australian Broadcasting Corporation v Lenah Game Meats Pty Ltd in 2001
In this case, the issue is related to confidentiality, Unconscionability, and Privacy. In this, the
court held that the activities are not considered as private until and unless they are considered as
private property. For the breach of the Privacy, it is essential that there is infringed of the rules
Page | 11

and regulations and something wrongdoing is involved. Further, it is important to breach the
laws of the privacy act.
Case 2
Doe v Australian Broadcasting Corporation
In this case, the court held that it is the duty of the person to take reasonable care for any breach
of the duty, privacy and confidence and the guilty person is liable for the payment of the
damages and loss caused due to such breach.
Case 3
Dye v Commonwealth Securities Ltd
In this case, the court held that to deny something inappropriately provide the opportunity to the
other for the breach of the privacy as per the common law of the state.
Australian Prudential Regulation Authority- Australian Prudential Regulation Authority is
the statutory authority of the Government of Australia and also acts as a regulator of the industry
of financial services in Australia. It ensures that the businesses are abiding with the financial
promises and meet all the responsibilities towards the fund members, policy holders and
depositors (Summerhayes, 2017). It is important that the businesses like Telstra comply with the
security standards and principles that provide guidance for the policies of the security of the
corporate and for this purpose the businesses of Australia must comply with the standards and
regulations determined by the Australian Prudential Regulation Authority.
Australian Signal Directorate- This frame works abide by the Telstra as it is responsible for
providing protection to Australia against the threats at the global level and implement the
advancement in the field of cybersecurity, cyber operations of offensive nature and the
intelligence of foreign signals (Robinson, 2017). These are directed by the government of
Australia. In this, the Australian Cyber Security center is the sector which includes both the
public and private sector in the form of collaboration so to prevent the threats related to
cybersecurity. This Directorate also provides guidance; assistance and information also include
the strategies of mitigation and certifying the services of the cloud.
Page | 12