Can super funds mount united front cyber security? | Australian Markets

The Australian Prudential Regulation Authority (APRA) has made clear to the superannuation sector that it must develop the power to ship a coordinated industry response within the face of a cyber incident affecting a number of stakeholders.

The regulator has made its expectations clear within the wake of an industry roundtable which concerned representatives from Australia’s largest superannuation industry organisations, the regulator itself however, more importantly, National Office of Cyber Security.

The roundtable was held in July with cyber incidents concentrating on superannuation funds in March and April on the prime of the gadgets for dialogue. Among the funds focused within the assaults was Australia’s largest fund, AustralianSuper.

APRA’s evaluation was that whereas the general affect of these cyber incidents concentrating on particular person superannuation members had been contained, “it was recognised as an indication of the system’s appeal to threat actors”.

“The timing of the incident, which coincided with market volatility, was also considered relevant to the overall impact,” the APRA evaluation of the roundtable dialogue stated.

Without naming specific funds as laggards, APRA made clear that some funds had carried out higher than others in coping with the cyber incidents.

“Entities that responded effectively demonstrated a clear understanding of their control environments, particularly around payments processes, which enabled swift action to interrupt transactions and recover funds,” it stated.

“The industry needs to improve awareness of incident impact on public perception and member trust, as well as improved coordination for timely responses. Entities with clear accountability for member protection consistently outperformed others, highlighting the value of a proactive cyber security approach.”

The need for a collective strategy was pushed home by National Cyber Security Coordinator, Lieutenant General, Michelle McGuinness who referred to “a key tension between competition and collaboration in the cyber security space which can hinder collective progress”.

A key query submitted to the roundtable was, within the occasion of a cyber incident affecting a number of stakeholders – together with funds within the superannuation ecosystem – who shall be liable for coordinating the industry response?”

“In the first instance RSEs and operators need to respond and address immediate threat/s during an incident. While it was acknowledged that it is challenging to identify responsibility for an overall response today’s roundtable reflects the need and an opportunity for the industry to develop this capability,” the APRA evaluation stated.