Author: Matthew Miller

How CPS 230 is Influencing the Future of SaaS Security in Australia

Quick Overview

• The deadline for compliance with the Australian Prudential Regulation Authority’s (APRA) CPS 230 is scheduled for July 2025.
• CPS 230 requires robust cybersecurity practices, compelling financial organisations to effectively manage cyber risks.
• Key tools for adherence to CPS 230 include SaaS Security Posture Management (SSPM) and Identity Threat Detection & Response (ITDR).
• The Shared Responsibility Model assigns the responsibility of configuring, securing, and managing SaaS environments to businesses.
• Essential pillars for SaaS security encompass Misconfiguration Management, Identity & Access Governance, Third-party Connected Applications, Connected Device Posture, and Threat Detection.

The CPS 230 Deadline: An Urgent Compliance Challenge

Australian financial institutions are hurrying to comply with the CPS 230 deadline set by the Australian Prudential Regulation Authority (APRA) for July 2025. This regulation imposes demanding standards for managing cyber risks, encompassing the identification, monitoring, assessment, and mitigation of cyber threats. With time running out, organisations are on the lookout for dependable solutions to ensure compliance.

A significant aspect of this compliance route involves addressing the cybersecurity risks related to Software as a Service (SaaS) applications. SaaS Security Posture Management (SSPM) and Identity Threat Detection & Response (ITDR) are two critical tools that have surfaced to help fulfil these requirements, becoming indispensable for financial institutions aiming to protect their digital assets and evade penalties.

The Shared Responsibility in SaaS Security

In September 2018, APRA recognised the growing reliance on cloud computing and SaaS solutions for vital operations. The APRA document “Outsourcing Involving Cloud Computing Services” pointed out that while SaaS providers deliver essential security controls, customers carry substantial responsibility for establishing proper security settings, user authentication practices, and overseeing connected applications.

The Shared Responsibility Model, which governs SaaS products, requires businesses to secure their data, configure services accurately, and manage access control policies. Even secure platforms like Salesforce or Microsoft 365 can expose risks if misconfigurations or inadequate access controls are not rectified. Recent incidents, such as breaches affecting Snowflake users, highlight the necessity of effective SaaS management.

Five Fundamental Pillars for Securing a SaaS Environment

To align with CPS 230 and avert severe financial consequences, Australian financial organisations must concentrate on the following five pillars of SaaS security:

1. **Misconfiguration Management:** Ensuring security settings are properly configured to prevent vulnerabilities.
2. **Identity and Access Governance:** Managing user roles and permissions to restrict access to critical systems.
3. **Third-party Connected Applications:** Overseeing and evaluating risks from third-party applications linked to the SaaS environment.
4. **Connected Device Posture:** Monitoring devices that access SaaS applications to guarantee they are secure and effectively managed.
5. **Threat Detection:** Identifying and addressing potential cyber threats, such as unauthorised logins or unusual user activity.

Kendal Watt, a cybersecurity expert from Adaptive Shield, underscores that while staying proactive through configuration management and access policies is crucial, threat detection plays a vital part in spotting threats that bypass these safeguards.

SaaS Security Posture Management (SSPM) and Identity Threat Detection & Response (ITDR)

The Importance of SSPM for CPS 230 Compliance

SaaS Security Posture Management (SSPM) tools are vital in ensuring that SaaS applications are configured accurately and stay secure. Initially centred on monitoring configuration parameters, modern SSPM systems now oversee a diverse range of attack surfaces, detecting misconfigurations, tracking user access, and ensuring adherence to best security practices.

SSPM solutions also play a role in managing identity security, a critical facet of SaaS operations. These tools can identify inactive accounts, external users with excessive permissions, and even past employees who still have access to company systems. Furthermore, SSPMs keep tabs on Non-Human Identities (NHI), like service accounts and API keys, to ensure protections against misuse by attackers.

Bolstering Security with ITDR

Identity Threat Detection & Response (ITDR) tools complement SSPM in recognising potential security threats. ITDR enhances SaaS security by scrutinising user behaviour, spotting suspicious activities, and reporting possible threats. For example, ITDR can identify if a user tries to log in from two different locations at once, signalling a potentially breached account.

When integrated with SSPM, ITDR affords greater insights into user and application interactions, forming a robust alliance for identifying and reducing threats. This synergy is crucial for Australian financial institutions aiming to adhere to CPS 230 and secure their SaaS environments.

The Shared Responsibility Model for SaaS

As stated by the United States National Security Agency’s (NSA) Shared Responsibility Model, SaaS providers are accountable for securing and maintaining the underlying infrastructure, including hardware, operating systems, and networks. However, it is the customer’s duty to configure the service, manage access protocols, and secure data.

Australian companies need to fully grasp their responsibilities within this model to comply with CPS 230. Documentation and service terms from Cloud Service Providers (CSP) will specify each service’s responsibilities, and it is essential for businesses to follow these protocols closely.

Conclusion

As the July 2025 deadline for CPS 230 compliance draws near, Australian financial institutions must focus on securing their SaaS environments. By utilising tools like SaaS Security Posture Management (SSPM) and Identity Threat Detection & Response (ITDR), businesses can alleviate risks, manage configurations, and detect possible threats. The Shared Responsibility Model emphasizes the necessity for customer accountability in the security of their SaaS applications, making it imperative for organisations to take a proactive stance in managing their cybersecurity. By adhering to the five pillars of SaaS security, financial service providers can achieve compliance with CPS 230 and protect their digital assets.

Q&A: Frequently Asked Questions About CPS 230 and SaaS Security

Q: What is CPS 230, and to whom does it apply?

A:

CPS 230 is a regulatory framework set forth by the Australian Prudential Regulation Authority (APRA), mandating financial service providers to manage operational and cyber risks. It applies to all entities regulated by APRA, including banks, credit unions, and insurance firms.

Q: Why is SaaS security crucial for CPS 230 compliance?

A:

SaaS applications are extensively utilised in financial services and often house sensitive information. CPS 230 requires that businesses manage risks associated with third-party service providers, including SaaS platforms. Errors in configurations or inadequate access controls can leave companies vulnerable to cyber threats, rendering SaaS security essential for compliance.

Q: What are SSPM and ITDR, and how do they facilitate CPS 230 compliance?

A:

SaaS Security Posture Management (SSPM) tools help oversee and manage the security configurations of SaaS applications, while Identity Threat Detection & Response (ITDR) tools identify and counteract potential identity-based threats. Together, they ensure that SaaS applications remain secure and adhere to CPS 230 stipulations.

Q: How can organisations verify that they are meeting their obligations under the Shared Responsibility Model?

A:

Organisations need to scrutinise the terms and conditions of their SaaS providers to comprehend their responsibilities in safeguarding data and managing access. Implementing SSPM and ITDR tools allows businesses to monitor configurations, track user permissions, and identify potential threats, ensuring compliance with obligations under the Shared Responsibility Model.

Q: What are the ramifications for a financial institution that does not comply with CPS 230 by the deadline?

A:

Non-compliance with CPS 230 could lead to substantial financial penalties and reputational harm for APRA-regulated entities. It is essential for financial institutions to utilise the necessary tools and processes to meet compliance standards by the July 2025 deadline.

SmartGate Kiosk Malfunction Disrupts Operations of Australian Border Force

Brief Summary

• The SmartGate kiosks operated by the Australian Border Force experienced a nationwide malfunction.
• Significant disruptions were reported at international airports in Sydney, Melbourne, and Brisbane.
• Passengers underwent manual processing, resulting in extensive queues and delays at various airports.
• Approximately 1000 passengers were impacted at Melbourne Airport, which saw three flights delayed.
• Systems were back online by midday AEDT, with the cause of the malfunction still being examined.
• Additional ABF personnel were assigned to assist with manual processing and minimize disruptions.

Significant SmartGate Kiosk Malfunction Disrupts Australian Airports

On this day, significant interruptions occurred at Australia’s international airports when the Australian Border Force’s (ABF) SmartGate kiosks went offline for several hours due to a technical malfunction. This incident affected major airports in Sydney, Melbourne, and Brisbane, leading international passengers to undergo manual processing, which caused long queues and delayed flights.

Effects Across Key Airports

The malfunction impacted both arriving and departing passengers at some of Australia’s busiest international terminals. Melbourne Airport was notably hit, with around 1000 passengers affected and three flights delayed. Significant delays were also reported at Sydney and Brisbane airports, prompting the deployment of additional ABF personnel to assist with manual processing.

Reports from the ABC indicated that travelers in Sydney and Melbourne encountered particularly lengthy queues. The manual procedures for passport checks and customs clearance, which are typically managed by automated SmartGates, considerably reduced the efficiency of passenger processing.

Resolution by Midday

As of midday AEDT, the ABF confirmed that the situation was resolved and systems were functioning again. A spokesperson from the ABF commented, “The Australian Border Force has been addressing a technical malfunction affecting both inbound and outbound passengers at international airports nationwide this morning. By midday AEDT, the issue has been resolved across all airports, and all systems have resumed operations.”

Though service has been restored, the ABF continues to investigate the underlying cause of the malfunction. They also expressed gratitude to travelers for their understanding during the incident, which led to delays during a peak travel period.

SmartGate Systems: Essential Components of Australian Border Operations

SmartGates are automated self-service kiosks utilized by the Australian Border Force to enhance the efficiency of clearing passengers through customs and immigration. These systems employ facial recognition technology and biometric data to automatically correlate travelers with their passport information, thereby significantly lessening wait times and human errors compared to manual procedures.

A widespread malfunction such as the one experienced today can rapidly lead to considerable disruptions, as manual processing is inherently slower and demands more personnel. The ABF’s swift action in assigning extra officers helped to alleviate the situation, although many passengers in Melbourne and Sydney still faced considerable delays.

Possible Causes and Future Precautions

While the specific cause of the malfunction is still uncertain, issues with large-scale digital systems like SmartGates can arise from various factors including software glitches, hardware failures, or network connectivity issues. The ABF’s ongoing investigation will likely aim to determine the root cause and implement measures to avert similar disruptions in the future.

This incident emphasizes the increasing dependence on automated systems in critical infrastructure and the necessity for effective contingency plans. As Australia progressively adopts digital transformation across various sectors, including border security, guaranteeing the reliability of these systems will be essential.

Conclusion

Today’s SmartGate malfunction at major Australian international airports caused considerable delays and disruptions for passengers, necessitating manual processing by ABF officers. Although the issue was resolved by midday, it affected thousands of travelers, particularly in Melbourne, Sydney, and Brisbane. The ABF is currently looking into the cause of the malfunction, and it is anticipated that measures will be taken to prevent future disruptions.

Q: What is a SmartGate kiosk, and what is its function?

A:

SmartGate kiosks are automated systems employed in Australian international airports to facilitate the passport control process. They utilize facial recognition technology and biometric data to match a passenger’s face with their passport photo, providing quicker and more efficient processing without human involvement.

Q: How long did the malfunction persist?

A:

The malfunction lasted for several hours in the morning, with systems being completely restored by midday AEDT. During this period, passengers underwent manual processing, leading to long queues and delays.

Q: Which airports were affected by the SmartGate malfunction?

A:

The malfunction impacted major international airports throughout Australia, including Sydney, Melbourne, and Brisbane. At Melbourne Airport, approximately 1000 passengers were affected, and three flights were delayed due to the malfunction.

Q: What actions did the Australian Border Force take to mitigate the disruption?

A:

The ABF deployed additional personnel to manage passengers manually and minimize the impact of the malfunction. While this helped to some degree, extensive queues and delays were still noted at several airports.

Q: Is the cause of the SmartGate malfunction known?

A:

Currently, the precise cause of the malfunction remains under investigation. The ABF is undertaking a thorough review to pinpoint the technical issue and apply measures to prevent future incidents.

Q: What measures will the ABF implement to avert similar events in the future?

A:

While the ABF has not yet disclosed specific details, the investigation into the malfunction will likely lead to the establishment of safeguards and contingency plans to ensure the robustness of the SmartGate systems in the future.

Q: Were any flights delayed due to the malfunction?

A:

Yes, at Melbourne Airport alone, three departure flights were delayed as a result of the disruption caused by the SmartGate malfunction.

Q: Are SmartGate malfunctions frequent in Australia?

A:

No, SmartGate malfunctions are relatively uncommon. However, when they do occur, they can result in significant disruptions due to the reliance on these automated systems for efficient border control.

Gen3 Supercars Set to Hit iRacing Starting December 10

In thrilling news for fans of motorsport and sim racing aficionados, iRacing will unveil the eagerly awaited Gen3 Supercars in its 2025 Season 1 update, set to launch on December 10th. Followers of Australian Supercars can finally take control of the Chevrolet Camaro Gen3 and Ford Mustang Gen3 in the virtual realm, signifying a major leap from the last generation of racing vehicles. These fresh models have been carefully crafted in partnership with Supercars, Chevrolet, and Ford, ensuring a racing experience that closely mirrors reality.

Quick Overview

• New Gen3 Supercars: iRacing will introduce the Chevrolet Camaro Gen3 and Ford Mustang Gen3 on December 10.
• Improved Realism: The latest models boast enhanced physics, tire modeling, and graphics for a more immersive racing experience.
• Legacy Content: The Holden ZB Commodore and Ford Mustang GT will become legacy content, with credits awarded to recent buyers.
• Gen3 Supercar Adjustments: Notable improvements in aerodynamics, chassis design, and engine performance, encouraging tighter and more thrilling racing.
• Cost Efficiency: Gen3 Supercars are engineered to be more economical to construct and maintain, both on real circuits and in the virtual realm.

What Constitutes Gen3 Supercars?

Gen3 Supercars, which made their debut in the Australian Supercars Championship in 2023, represent the most recent advancement in racing technology. Initially envisioned in 2020, these vehicles aim to facilitate closer racing, lower costs, and enhance their resemblance to consumer vehicles. With the 2025 Season 1 update from iRacing, virtual racers will finally get the chance to drive these innovative machines.

Closer to Consumer Models

The new Gen3 Supercars are crafted to resemble their road-going versions more closely. The Chevrolet Camaro and Ford Mustang within the game will feature a more robust, aggressive appearance, closely resembling the cars found on Australian streets. This evolution is intended to boost fan involvement by making the race cars more relatable to everyday automobiles.

Reduced Downforce for More Intense Racing

A significant alteration in the Gen3 Supercars is the downforce reduction, now about 60% less than the Gen2 vehicles. This change presents a more challenging driving experience, fostering closer racing and increased overtaking chances. Achieving this involves implementing simpler aerodynamic designs with smaller rear wings and diffusers.

Technical Innovations in Gen3 Supercars

New Control Chassis

At the heart of the Gen3 Supercars lies a new control chassis. This structure is lighter and more cost-efficient to produce, accommodating the Ford Mustang and Chevrolet Camaro body styles. The revamped chassis design is vital in decreasing the overall manufacturing costs while enhancing performance on the track.

Engine Enhancements

While the Gen3 vehicles retain the classic V8 engines, they have been slightly tuned down, generating approximately 600 horsepower as opposed to the 650+ horsepower of the Gen2 models. This adjustment aligns with the reduced downforce strategy, emphasizing driver skill and racing tactics over sheer speed.

Transaxle Gearbox and Larger Tires

A noteworthy upgrade is the implementation of a transaxle gearbox at the rear of the car. This modification improves weight distribution, enhancing the handling and overall balance of the vehicles. Additionally, the Gen3 Supercars will utilize 18-inch wheels with wider tires, providing superior grip and responsiveness on the track.

Simplified Suspension System

The suspension in the Gen3 Supercars has been streamlined, lowering costs and offering reduced adjustability. This simplification is part of the broader objective to make the vehicles more affordable to manufacture and maintain, while still delivering an exhilarating racing experience.

Legacy Content and Credits for Recent Buyers

For those who have recently acquired the current Supercars Ford Mustang GT or Supercars Holden ZB Commodore in iRacing, there’s positive news. To ease the transition, iRacing will provide credits to anyone who purchased these models in the previous year. The amount of credit will be based on how recent the purchase was.

Following the launch of the Gen3 vehicles, the Ford Mustang GT and Holden ZB Commodore will be designated as legacy content. They will no longer participate in competitive racing series, but will still be available for players who wish to use them in other formats within iRacing.

What to Anticipate on Launch Day

The introduction of the Gen3 Supercars on December 10 is set to be a pivotal moment for sim racing enthusiasts, particularly in Australia. With the new Supercars, iRacing users can expect a more immersive and lifelike racing experience, thanks to enhanced physics, tire modeling, and graphical upgrades that have been integrated into the game.

If you’re new to iRacing or contemplating renewing your subscription, iRacing is currently featuring Black Friday offers, providing 50% off new memberships and 25% off renewals. This is an excellent chance for Australian racing supporters to get involved and experience the new Gen3 Supercars on launch day.

Conclusion

The introduction of Gen3 Supercars in iRacing on December 10 heralds a new era for sim racers and Australian motorsport fans alike. With key changes in aerodynamics, chassis, and engine performance, the Gen3 vehicles promise to deliver an exhilarating and engaging racing experience. Additionally, iRacing is granting credits to recent buyers of the outgoing Supercars models, facilitating a smoother transition for existing players. Whether you’re a seasoned sim racer or a newcomer to the game, the arrival of Gen3 Supercars is an occasion you won’t want to overlook.

FAQ

Q: What are the main differences between Gen2 and Gen3 Supercars?

A:

The Gen3 Supercars showcase a design that is more aligned with road vehicles, decreased downforce for tighter racing, and a new control chassis that is lighter and more economical. They also have slightly detuned engines producing around 600 horsepower and use a transaxle gearbox for improved weight distribution.

Q: Will the older Supercars (Ford Mustang GT and Holden ZB Commodore) still be accessible in iRacing?

A:

Indeed, they will remain accessible but will be reclassified as legacy content. This indicates they will not be included in competitive series but can still be utilized for other types of racing within iRacing.

Q: How will credits for recent purchases function?

A:

iRacing will grant credits to users who bought the Ford Mustang GT or Holden ZB Commodore within the last 365 days. The credit amount will vary based on the recency of the purchase. This offer will conclude upon the release of the new Gen3 vehicles.

Q: What enhancements can players anticipate in the Gen3 Supercars on iRacing?

A:

The Gen3 Supercars will leverage iRacing’s newest advancements in physics modeling, tire modeling, and visual fidelity. Players can look forward to a more authentic and demanding driving experience, with improved handling and enhanced graphics.

Q: When will the Gen3 Supercars be made available in iRacing?

A:

The Gen3 Supercars will be accessible on December 10, 2024, as part of iRacing’s 2025 Season 1 update.

Q: Can new iRacing users benefit from any discounts?

A:

Yes, in celebration of Black Friday, iRacing is offering 50% off new memberships and 25% off early renewals. This presents a fantastic opportunity for newcomers to join and experience the Gen3 Supercars on launch day.