Matthew Miller, Author at Techbest - Top Tech Reviews In Australia - Page 21 of 161

Huawei FreeBuds SE 4 ANC Wireless Earbuds Review


We independently review everything we recommend. When you buy through our links, we may earn a commission which is paid directly to our Australia-based writers, editors, and support staff. Thank you for your support!

Huawei FreeBuds SE 4 ANC Wireless Earbuds, 50 Hours Battery Life, Multi-Mode Action Noise Cancelling for Commuter and Office, 4.3g Lightweight Headphones, Bluetooth 5.4, Clear Calling, IP54

Bendigo Bank Progresses IT Revamp with Collaborations from Infosys and Genpact


We independently review everything we recommend. When you buy through our links, we may earn a commission which is paid directly to our Australia-based writers, editors, and support staff. Thank you for your support!

Bendigo Bank’s IT Evolution with Infosys and Genpact

Quick Summary

  • Bendigo Bank enters into a seven-year IT agreement with Infosys and a six-year contract with Genpact.
  • The partnerships are aimed at advancing IT service delivery and enhancing processes.
  • Changes to the workforce are anticipated, affecting both technology and business teams.
  • Bendigo Bank pledges to manage transitions thoughtfully and with dignity.

Revolutionary IT Collaborations

Bendigo and Adelaide Bank has initiated a major transformation of its technology operations, ushering in a new phase through its strategic alliances with Infosys and Genpact. The agreements, lasting seven and six years respectively, are poised to instigate considerable alterations within the bank’s IT framework.

Bendigo Bank IT evolution with Infosys and Genpact

Effects on Staffing

The bank has recognised that these collaborations will affect its technology and business sectors, although precise information on the degree of impact has not been revealed. CEO Richard Fennell emphasises the necessity of approaching these changes with compassion, acknowledging the difficult time for affected employees.

Infosys: Boosting IT Competencies

With the new agreement, Infosys is tasked with significantly enhancing Bendigo Bank’s IT service delivery. The partnership aims to bolster the bank’s skills in software development and artificial intelligence, fields in which Infosys has already shown significant proficiency.

Genpact: Improving Processes

Genpact, recognised for its capabilities in digital transformation, will concentrate on process improvement and delivery. This partnership is anticipated to elevate productivity and enhance risk management, aligning with Bendigo Bank’s strategic goals.

Conclusion

The partnerships between Bendigo and Adelaide Bank with Infosys and Genpact signify a transformative era in technology. While adjustments to the workforce are expected, the bank is dedicated to managing these shifts thoughtfully. The alliances are set to foster sophisticated IT service delivery and process improvement, laying a strong groundwork for future expansion.

FAQs

Q: What prompted Bendigo Bank to collaborate with Infosys and Genpact?

A: The partnerships seek to enhance IT service delivery, improve capabilities, and streamline processes, preparing the bank for prospective growth.

Q: What will be the impact of these partnerships on the bank’s workforce?

A: Workforce adjustments are anticipated, affecting technology and business teams, though specific details are still to be determined.

Q: What is Infosys’s role in the bank’s transformation?

A: Infosys will focus on improving IT service delivery and providing expertise in software development and artificial intelligence.

Q: How will Genpact contribute to Bendigo Bank?

A: Genpact will apply its expertise in process improvement and delivery, aiming to enhance productivity and strengthen risk management.

Q: What is the duration of the contracts with Infosys and Genpact?

A: The contract with Infosys is for seven years, and the agreement with Genpact is for six years.

Q: How does Bendigo Bank plan to manage workforce changes?

A: The bank is committed to managing transitions sensitively and respectfully, recognising the difficulties faced by impacted employees.

AI, Sovereignty, and Visibility: The Emerging Foundations of Cyber Strategy Evolution


We independently review everything we recommend. When you buy through our links, we may earn a commission which is paid directly to our Australia-based writers, editors, and support staff. Thank you for your support!

AI, Sovereignty, and Visibility: Transforming Cyber Strategy

Quick Overview

  • Data sovereignty has become a strategic priority for organisations due to geopolitical and regulatory dynamics.
  • The emergence of “shadow AI” creates governance challenges as employees engage with AI tools beyond established frameworks.
  • AI integration is significantly outpacing the formation of essential governance frameworks.
  • The threat landscape is swiftly evolving, with vulnerabilities being exploited more rapidly than ever before.
  • Numerous organisations fail to maximise their existing security solutions due to visibility challenges and disjointed models.
  • Eliminating barriers between infrastructure and security teams is vital for an effective cyber strategy.

Data Sovereignty as a Strategic Concern

With the ongoing evolution of the digital realm, data sovereignty has become a crucial issue for Australian businesses. Julian Challingsworth, MD & CEO of Infotrust, underscores the vital need to comprehend data location and access permissions. As geopolitical tensions rise and regulatory demands tighten, companies must adeptly handle these hurdles while fulfilling customer needs. Data governance and procurement strategies should align with national jurisdictions, establishing data sovereignty as a strategic concern.

AI, Sovereignty, and Visibility: Cyber Strategy Transformation

Tackling “Shadow AI” Issues

Challingsworth emphasizes the challenge of “shadow AI,” where staff utilize AI tools outside sanctioned governance protocols. This practice introduces considerable risks, as boards might remain uninformed about the scale of these activities within their organisations. Proper oversight and management of AI tools are essential to safeguard data integrity and security.

The Necessity for AI Governance

As AI adoption accelerates, organisations encounter familiar obstacles reminiscent of the initial days of cloud computing. Simon McKay, CEO of Cyber at Infotrust, highlights the urgent need for solid governance structures to oversee AI-related risks. The swift embrace of AI technologies demands effective guardrails to secure these tools and optimize their benefits.

The Shifting Threat Landscape

The threat environment is intensifying, with the interval between vulnerability detection and exploitation drastically shortening. McKay observes that vulnerabilities, which previously remained dormant for months, are now being exploited within days or even hours. AI technologies are amplifying both the scale and complexity of cyber-attacks, emphasizing the necessity for vigilant security measures.

Aiming to Optimize Current Cyber Resources

Dan Suto, Executive General Manager of Managed Technology at Infotrust, asserts that many organisations already hold the necessary cyber capabilities but are not fully leveraging them. Visibility remains a critical challenge, as it is impossible to protect that which is unseen. Organisations need to dismantle silos between their infrastructure and security teams to develop a unified cyber strategy.

Finding a Balance Between Technology Adoption and Governance

For rapidly evolving organisations, the urgency to integrate new technologies often surpasses governance frameworks, posing future risks. Suto advises achieving a balance between swift technological adoption and strong governance to reduce potential security vulnerabilities.

Conclusion

As cyber threats continue to evolve, Australian organisations must traverse the complexities of data sovereignty, AI governance, and visibility. By confronting these challenges, companies can bolster their cyber resilience while promoting innovation and growth. An effective cyber strategy necessitates coordinated efforts across infrastructure and security teams, ensuring that existing resources are fully utilized.

Q&A Section

Q: Why is data sovereignty increasingly viewed as a strategic issue?

A: Data sovereignty is essential due to geopolitical uncertainties, regulatory requirements, and customer expectations. Organisations must ensure their data governance complies with national laws and contractual obligations.

Q: What does “shadow AI” refer to, and why is it concerning?

A: “Shadow AI” pertains to the use of AI tools by staff members without formal approval or governance. It poses risks as it can result in unmonitored data processing and potential security vulnerabilities.

Q: In what way is AI adoption surpassing governance frameworks?

A: Organisations are swiftly integrating AI technologies without fully establishing the governance structures required to manage the related risks, mirroring patterns seen during early cloud adoption.

Q: What obstacles do organisations confront in the current threat environment?

A: The duration between vulnerability detection and exploitation is diminishing, and AI is enhancing the sophistication of attacks. Organisations must adopt robust security measures to keep pace with these developments.

Q: How can organisations enhance their current cyber capabilities?

A: By increasing visibility and breaking down silos between infrastructure and security teams, organisations can more effectively utilise their existing security resources and capabilities.

Q: What risks arise from adopting technology faster than governance?

A: Rapid technology adoption without sufficient governance can result in security risks and vulnerabilities, as governance frameworks may not evolve at the same speed as technological advancements.

Wireless Earbuds Bluetooth 5.3 Headphones 2024 Wireless Headphones in Ear with ENC Mic Review


We independently review everything we recommend. When you buy through our links, we may earn a commission which is paid directly to our Australia-based writers, editors, and support staff. Thank you for your support!

Wireless Earbuds, Bluetooth 5.3 Headphones 2024 Wireless Headphones in Ear with ENC Mic, Bluetooth Earphones Noise Cancelling Ear buds with 50H Hifi Stereo, IP7 Waterproof Headset, USB-C, LED Display

Wi-Fi 7 Mesh Guaranteed Excellence—What’s Causing My Smart Home Devices to Struggle?


We independently review everything we recommend. When you buy through our links, we may earn a commission which is paid directly to our Australia-based writers, editors, and support staff. Thank you for your support!

Why Are My Smart Home Devices Having Trouble with Wi-Fi 7 Mesh?

Quick Overview

  • Wi-Fi 7 offers enhanced speeds and improved reliability but may not be ideal for homes with legacy devices.
  • Multi-Link Operation (MLO) in Wi-Fi 7 can create complications for devices limited to 2.4GHz.
  • Numerous smart home devices do not support the advanced functionalities of Wi-Fi 7.
  • Wi-Fi 6 may be a better fit for residences with both old and recent devices.

Understanding Wi-Fi 7

Wi-Fi 7 represents the most recent advancement in wireless tech, offering unmatched speeds and the ability to accommodate multiple devices at once. However, these benefits come with drawbacks, especially regarding older smart home gadgets.

The Promised Future That Didn’t Fully Materialize

Wi-Fi 7 aims for backward compatibility to support older devices. However, many of these devices experience difficulties connecting to Wi-Fi 7 mesh networks. A key feature, Multi-Link Operation (MLO), intends to minimize lag by allowing devices to link across various bands. Unfortunately, this often results in confusion for older devices that are limited to the 2.4GHz band, resulting in frequent disconnections.

Is Speed a Necessity?

For numerous users, the transition from Wi-Fi 6/6E to Wi-Fi 7 may not be noticeable. If your NBN plan is under gigabit speeds, or if your primary usage centers around internet streaming and browsing, Wi-Fi 6/6E is still adequate. Those who transfer sizable files within their home network may find Wi-Fi 7’s advantages more beneficial.

Common Challenges

Problems with Wi-Fi 7 are widespread. Reports from forums and technology sites frequently indicate that most smart home IoT devices still rely on the 2.4GHz band, which is not optimally supported by Wi-Fi 7 systems. Router manufacturers, such as Asus and TP-Link, have recommended deactivating Wi-Fi 7’s advanced features to preserve connectivity, effectively reverting to Wi-Fi 6.

Older Smart Home Gadgets

Households with a range of devices, from new to over five years old, encounter issues with Wi-Fi 7. Items like smart hot water heaters and air conditioners, which depend on 2.4GHz connectivity, face struggles with the automatic band-switching features of Wi-Fi 7, leading to frequent connection interruptions.

Replacing Devices Isn’t Always the Solution

The idea of swapping out incompatible devices isn’t a feasible option for many. The expense of replacing high-value appliances that operate satisfactorily on older Wi-Fi standards can be daunting. Numerous smart home devices are not yet designed to accommodate the latest Wi-Fi technologies, rendering replacement an impractical remedy.

Returning to Wi-Fi 6

After experimenting with Wi-Fi 7 systems, reverting to a Wi-Fi 6 mesh system showed to be more effective for sustaining stable connections among mixed device types. For example, the D-Link Aquila Pro AI M60 mesh system supports both 2.4GHz and 5GHz bands, allowing older devices to stay connected without interruptions.

Conclusion

While Wi-Fi 7 delivers advanced features and enhancements, it may not be suitable for homes with a diverse range of smart home devices, particularly those that depend on 2.4GHz. Wi-Fi 6 continues to be a strong and dependable option for such settings, balancing speed and compatibility efficiently.

Q&A

Q: What is the Multi-Link Operation (MLO) in Wi-Fi 7?

A: MLO enables devices to connect across multiple frequency bands at the same time, aiming to decrease lag and enhance congestion management.

Q: Why do older devices find it hard to use Wi-Fi 7?

A: Many older devices only work with the 2.4GHz band and cannot manage the automatic band-switching employed by Wi-Fi 7 systems.

Q: Can turning off Wi-Fi 7 features enhance connectivity?

A: Yes, deactivating features like MLO can aid devices in connecting more reliably, but it effectively converts your Wi-Fi 7 router into a Wi-Fi 6 router.

Q: Is Wi-Fi 6 still a viable option?

A: Certainly. Wi-Fi 6 provides solid performance and compatibility for households with a blend of old and new devices.

Q: How should consumers choose between Wi-Fi 6 and Wi-Fi 7?

A: Evaluate the types of devices present in your home and their compatibility with newer standards. If you possess many older 2.4GHz devices, Wi-Fi 6 might be the better choice.

Act Immediately: Highlight the Security of Your Intelligent Product Prior to 2027


We independently review everything we recommend. When you buy through our links, we may earn a commission which is paid directly to our Australia-based writers, editors, and support staff. Thank you for your support!

Quick Overview

  • The smart device security label in Australia is set to launch in 2027, with a trial beginning in October 2026.
  • This label will display a product’s security credentials at the point of sale.
  • Manufacturers, suppliers, and distributors are invited to participate in the trial to stay ahead of the new requirements.
  • Being part of the trial provides practical advantages, such as familiarizing with certification procedures and gaining early visibility.
  • This effort is a component of the 2023 – 2030 Australian Cyber Security Strategy.
  • Expressions of interest for the trial are currently being accepted.

Australia’s Smart Device Security Label Project

The upcoming national security label for smart devices in Australia, anticipated to roll out in 2027, intends to give consumers a clear signal regarding a product’s security attributes at the point of sale. This initiative marks a pivotal change for manufacturers, importers, suppliers, and distributors, focusing on transparency and safety in purchasing.

Promote smart product security before 2027

Trial Program Commencing October 2026

The industry trial starting in October 2026 offers businesses the opportunity to engage in the certification and labelling procedures well ahead of the nationwide launch. By participating, companies will:

  • Navigate the evaluation pathway to grasp the practical requirements.
  • Acquire understanding of complying with essential standards.
  • Get ready for early approval.
  • Be acknowledged as a foundational participant, demonstrating leadership in product security.

Benefits of Early Involvement

Engaging in the pilot program offers significant time and visibility, enabling businesses to work with the project scheme team and testing organizations. This collaboration aids in preparing for certification. Early involvement also reflects a dedication to security, which will be valued by customers and partners.

The Significance of Smart Product Security

As connected devices become crucial to everyday life, their security remains variable. Studies show that approximately 60% of IoT manufacturers provide no clear channels for reporting vulnerabilities. The new security label closes this gap by presenting a simple way to identify products adhering to rigorous security requirements.

Design and Execution

The Security Labelling Scheme for Smart Devices is an essential element of the 2023 – 2030 Australian Cyber Security Strategy. This scheme is being jointly developed by the Connected Technology Alliance in partnership with the Australian Government, with input from industry and consumer representatives. The initiative has garnered substantial engagement, with leading manufacturers and testing agencies finalizing the criteria. Systems supporting the labelling scheme are expected to be operational by September.

Conclusion

The innovative security label initiative for smart devices in Australia is poised to transform the perception of security at the point of sale. With a pilot program launching in October 2026, businesses can participate early, ensuring compliance with upcoming standards and achieving recognition as leaders in the industry. As security for connected devices becomes more critical, this initiative aims to provide consumers with clarity and confidence.

Q: What is the aim of the smart device security label?

A: The label is designed to provide consumers with a clear and recognizable representation of a product’s security credentials, enhancing openness and trust during the purchasing process.

Q: When is the trial program initiated?

A: The trial program is set to start in October 2026, with expressions of interest currently being accepted.

Q: Who is encouraged to take part in the trial?

A: Manufacturers, importers, suppliers, and distributors of smart products are urged to participate to gain early insights and recognition.

Q: What are the benefits for companies joining the pilot?

A: Participants will acquire practical experience with the certification process, receive early recognition as security leaders, and have the chance to engage with the scheme’s team directly.

Q: What is the role of the Connected Technology Alliance?

A: The Connected Technology Alliance is a co-developer of the scheme, working alongside the government and industry stakeholders to design and execute the security labelling initiative.

Q: When will the label be officially introduced?

A: The nationwide launch of the smart device security label is planned for 2027.

Eleror X9 Mini Wireless Earbuds Review


We independently review everything we recommend. When you buy through our links, we may earn a commission which is paid directly to our Australia-based writers, editors, and support staff. Thank you for your support!

eleror X9 Mini Wireless Earbuds for Sleeping & Daily Use, Extra-Small Bluetooth Earphones, Full-Silicone Comfort Tiny Ear Buds, Noise-Isolating, Secure Fit, ENC Clear Calls (Gray)

Supply Chain Compromise Affects Well-Known Axios npm Package with 100 Million Downloads


We independently review everything we recommend. When you buy through our links, we may earn a commission which is paid directly to our Australia-based writers, editors, and support staff. Thank you for your support!

Quick Overview

  • A widely-used JavaScript library, Axios, with more than 100 million downloads weekly, was breached in a supply chain attack.
  • The assault targeted npm’s Axios library to spread a remote access trojan across various systems.
  • The harmful version, plain-crypto-js@4.2.1, was released following the establishment of a deceptive sense of security with a legitimate version.
  • Developers are recommended to revert to axios@1.14.0 or axios@0.30.3.
  • Indicators of compromise consist of network connections to sfrclak.com and certain file paths on macOS, Windows, and Linux.
  • The incident is connected to an advanced persistent threat (APT) entity concentrating on data collection and credential theft.

Investigating the Axios Supply Chain Incident

The popular JavaScript library Axios has faced a supply chain breach impacting over 100 million downloads each week. The attack aimed at Windows, Linux, and macOS platforms, introducing a remote access trojan (RAT) via harmful dependencies.

Supply chain breach affects Axios npm package with high download numbers

Analyzing the Axios Attack

The breach involved the compromise of the npm account held by Axios’ main maintainer, Jason Saayman. By switching the registered email to a ProtonMail address, the attacker manually uploaded harmful packages, circumventing the GitHub Actions continuous integration system.

Phases of the Breach

The intruder initially launched a non-malicious version, plain-crypto-js@4.2.0, to create a credible npm publishing record. The malicious iteration, plain-crypto-js@4.2.1, was then released, designed to evade security scans.

Steps for Developers to Take Immediately

Those utilizing Axios should promptly revert to either axios@1.14.0 or axios@0.30.3. Analyzing network logs for connections to sfrclak.com and specific file paths may assist in detecting possible compromises.

Takeaways from the Open Source Malware Community

The Open Source Malware community characterized Axios as one of the most utilized JavaScript libraries worldwide. They emphasized the attack’s complexity, utilizing obfuscation and anti-analysis tactics to implement RAT features across platforms.

Conclusion

This prominent supply chain attack on the Axios npm package highlights the weaknesses in prevalent software dependencies. The attack’s complexity and emphasis on data collection imply participation from an advanced persistent threat actor, rather than financially-driven cybercriminals.

Q: What is Axios?

A: Axios is a widely-used HTTP client library for JavaScript, heavily employed in web development to perform HTTP requests.

Q: How was the Axios package compromised?

A: The breach involved a malicious entity taking control of the npm account of the package’s maintainer, releasing a harmful dependency that introduced a remote access trojan.

Q: What actions should developers take to safeguard their projects?

A: Developers should revert to secure versions of Axios (axios@1.14.0 or axios@0.30.3) and scrutinize network logs for unusual activity.

Q: What are the signs of a compromised system?

A: Signs include network connections to sfrclak.com and particular file paths on macOS, Windows, and Linux platforms.

Q: Who is believed to be responsible for the attack?

A: The attack is thought to be orchestrated by an advanced persistent threat actor, prioritizing intelligence gathering over financial incentives.

NBN Co Under Examination for Increasing ARPU from Fibre Clients


We independently review everything we recommend. When you buy through our links, we may earn a commission which is paid directly to our Australia-based writers, editors, and support staff. Thank you for your support!

NBN Co’s Average Revenue Per User Increase Under Examination

Brief Overview

  • Consultancy HoustonKemp suggests that NBN Co’s ARPU forecasts up to FY33 might be inflated.
  • The ACCC is analyzing NBN Co’s capital spending plans, recommending a cutback for FY27-29.
  • Issues have been raised regarding NBN Co’s rapid fibre upgrades and their fit with consumer demand.
  • HoustonKemp did not contest NBN Co’s commitment to AI and automation investments.
  • The ACCC has deemed the majority of NBN Co’s projected expenditures as prudent and effective.

Questions Raised About NBN Co’s Fibre ARPU Forecasts

NBN Co challenged on ARPU forecasts for fibre subscribers

NBN Co’s forecasts for average revenue per user (ARPU) growth up to FY33 are being evaluated. HoustonKemp, a consultancy working with the ACCC, has voiced skepticism about these estimates, potentially jeopardizing certain of NBN Co’s upgrade investments.

Examination of NBN Co’s Spending

The consultancy analyzed NBN Co’s expenditures from the last three years and projected for the following three, determining whether they were “prudent and efficient.” HoustonKemp contested several aspects of network enhancements, proposing that portions of the copper network could have been retained longer without updates.

Issues Concerning Fibre Upgrades

HoustonKemp highlighted concerns that NBN Co’s investments in the fibre network are outpacing customer needs, questioning the validity of the anticipated ARPU increase for fibre subscribers. Their evaluation proposes that the expected ARPU rise may be exaggerated.

ACCC’s View on NBN Co’s Capital Spending

The ACCC has signaled its intent to approve a reduced capital expenditure for the upcoming three years relative to what NBN Co proposed. The ACCC’s preliminary assessment indicates a total forecast capital expenditure of $6.9 billion for the 2027–29 period, which is 18.2% lower than NBN Co’s initial proposal.

Investments in Technology

HoustonKemp found no issues with NBN Co’s intended spending on technology, including AI and automation, confirming that the technology investment plan emphasizes cost effectiveness.

Conclusion

NBN Co is facing examination over its anticipated ARPU growth, with apprehensions regarding the prudence of swift fibre upgrades. While the ACCC recommends lower capital expenditures, the majority of NBN Co’s spending has been approved as effective.

Q: What led to the examination of NBN Co’s ARPU forecasts?

A: HoustonKemp, contracted by the ACCC, raised concerns that NBN Co’s ARPU estimations might be inflated, influencing the prudence of its investment strategy.

Q: How has the ACCC reacted to NBN Co’s spending proposals?

A: The ACCC has recommended a reduction in NBN Co’s proposed capital expenditure for FY27-29 by 18.2%, while approving 98% of the proposed expenditure as prudent and effective.

Q: What are the primary issues regarding NBN Co’s fibre upgrades?

A: The key issues are that NBN Co could be investing too far ahead of consumer demand and that the anticipated ARPU increase from fibre upgrades may not be justified.

Q: Has NBN Co’s technology investment encountered any problems?

A: No, HoustonKemp encountered no issues with NBN Co’s intended technology expenditures, including AI and automation.

Q: What is the future outlook for NBN Co’s network investments?

A: NBN Co intends to proceed with its network upgrades, although the ACCC’s recommendations may lead to a more measured investment that aligns with consumer demand.

Phishing Fraud Expenses WA Local Authority $350,000


We independently review everything we recommend. When you buy through our links, we may earn a commission which is paid directly to our Australia-based writers, editors, and support staff. Thank you for your support!

Brief Overview

  • A council in Western Australia lost $350,000 due to a phishing scam.
  • This event is featured in a report emphasizing the IT vulnerabilities in local jurisdictions.
  • Social engineering attacks are a frequent risk for organizations.
  • Education and awareness are crucial in thwarting cyber threats.
  • Only one organization met the access management standards during the audit.

Phishing Incident Reveals IT Weaknesses in WA Local Councils

A Western Australian council incurred a loss of around $350,000 due to a phishing scam, illuminating the ongoing weaknesses in local government IT infrastructures. This incident, presented in the report from the Western Australian Office of the Auditor General (OAG), brings attention to the continuous hurdles local authorities encounter in protecting their digital frameworks.

Exploiting Vulnerabilities

The audit characterizes this event as a successful social engineering tactic, wherein criminals exploited the council’s financial system to change a supplier’s account information. The report does not disclose if the misappropriated funds were recovered or which specific council was involved.

Prevalent IT and Security Issues

In addition to the significant phishing incident, the report uncovers further security deficiencies. In a concerning example, a council’s internal networks were reachable from a public library due to insufficient network controls. Another organization failed to update default administrator passwords, creating vulnerabilities in its building management system. Additionally, a server room in another council lacked fire suppression measures, raising alarms about physical security.

Access Management Deficiencies

Weak access management practices were identified as the most widespread vulnerability, with 78 issues detected across 36 organizations. Only one entity complied with the access management criteria, while merely two entities adhered to the endpoint security protocols. Such shortcomings heighten the likelihood of data breaches, financial setbacks, and damage to reputation.

Decline in Capability Maturity

The audit evaluated 15 organizations, revealing a decrease in capability maturity across all 10 control categories compared to the preceding year. This decline is partly due to the inclusion of four new entities, but previously examined organizations also exhibited drops in various categories.

Emphasis on Training Instead of Technology

Auditor General Caroline Spencer stressed the significance of training and awareness over expensive technological solutions. She advised the adoption of phishing-resistant multi-factor authentication, regular security awareness programs, pre-employment background checks for sensitive positions, and efficient offboarding protocols.

Upcoming Cyber Security Projects

The WA Department of Local Government, Industry Regulation and Safety is partnering with the Office of Digital Government on a cyber security pilot initiative aimed at bolstering the local government sector’s defences against cyber threats. This report signifies the seventh iteration of the OAG’s audit on general computer controls pertaining to local government entities.

Conclusion

The phishing incident that resulted in a $350,000 loss for a WA council underscores the urgent necessity for enhanced cyber security practices within local governments. The OAG’s findings shed light on persistent vulnerabilities and highlight the critical role of training and awareness in countering cyber threats. These insights are intended to assist local authorities in strengthening their digital safeguards and protecting taxpayer information from malicious threats.

Q: What primarily caused the phishing incident?

A: The phishing incident was brought about by a social engineering attack that interfered with the council’s finance system to change a supplier’s account information.

Q: Were the misappropriated funds recovered?

A: The report does not clarify whether the $350,000 was recovered.

Q: How many organizations were included in the audit?

A: The audit reviewed 15 selected organizations.

Q: Which IT weakness was found to be most common?

A: The most prevalent weakness was inadequate access management controls, with 78 issues identified across 36 organizations.

Q: What recommendations are provided to avert similar occurrences?

A: The report advises the implementation of phishing-resistant multi-factor authentication, regular security awareness training, pre-employment vetting for trusted roles, and effective offboarding practices.

Q: Is investment in technology essential to resolve these issues?

A: No, the Auditor General indicates that training and awareness are of greater importance than hefty technology expenditures.

Q: What future initiatives are planned to enhance cyber security?

A: The WA Department of Local Government, Industry Regulation and Safety is undertaking a cyber security pilot project alongside the Office of Digital Government to boost resilience within the local government sector.