Cyber experts warn Aussie businesses amid AI-driven data threat

Words by Will Seitam for The Australian

The nation’s peak cyber industry body says the unfolding international security emergency – involving software that runs 70% of websites – should be a wake-up call, urging “vulnerable” Australian businesses to reassess internal protocols protecting sensitive data.

The Australian Signals Directorate issued a critical alert, urging organisations and individuals to apply security patches, following the discovery of vulnerabilities in open source software PHP.

Australian Information Security ­Association director Scarlett McDermott told The Australian she agreed schools and health companies often lacked “mature” cybersecurity programs to combat breaches.

She added organisations with high online traffic were also particularly vulnerable and warned them to remain alert.

She warned that many small businesses were also at risk. “These types of organisations may not even realise that PHP is running on some of their servers and that they’re exposed. An attacker could run code on your website without you even knowing it’s happening and when people are visiting the site, they might be affected.

“The reality is that there are really significant impacts when some systems have downtime. If you’re running a system that people need to use as a matter of safety, that’s going to take down your business operations.”

Australian Information Security Association director Scarlett McDermott. Pic as appeared in The Australian

She said the global emergency had sparked “fears” of a dawning AI-security cataclysm as artificial intelligence accelerates the discovery and exploitation of cybersecurity weaknesses.

Several high-profile data attacks have preceded the so-called PHP2shell event.

A May hack of American cloud-based software company Canvas compromised information belonging to thousands of educational institutions around the world.

State schools in Queensland and Tasmania, universities in NSW and South Australia, and TAFE in Tasmania, were affected by the breach.

In July, personal information not limited to patients’ names, addresses and private health insurance information was taken from 16 Partnered Health clinics.

“There’s a lot of fear out there because this vulnerability and others were identified using AI tools for cyber research,” she said. “We need organisations to implement cyber hygiene basics.

“The vulnerabilities discovered this week have existed for years. What has changed is the speed and sophistication with which AI can identify weaknesses that have previously escaped detection. That has enormous implications for cybersecurity.

“Vulnerabilities that might once have remained undiscovered for years can now be identified much more quickly, and attackers can potentially exploit them just as quickly.”

She added that maintaining a clear asset register – identifying potential exposure weak points – and maintaining contingency plans for an array of breach scenarios were critical.

This article first appeared in The Australian as Cyber experts issue urgent warning to Australian businesses amid AI-driven data threat.

The post Cyber experts warn Aussie businesses amid AI-driven data threat appeared first on Stockhead.