Westpac CISO urges united front on cyber security intel

Westpac has urged government and industry to come together and share intelligence to raise national capability in thwarting cyber security threats against critical infrastructure.

Richard Johnson

Chief information security officer (CISO) Richard Johnson said the bank had raised the prospect of collaborative intelligence sharing between industry and government with the Department of Prime Minister and Cabinet as part of the cyber security review currently underway.

The review is expected to be handed to the Government in mid-2015 and lead to a revised national cyber security strategy.

Speaking at FST Media's future of security in financial services summit in Sydney, Johnson said Australia's financial services industry represented "critical mass in terms of the cyber security capability" of Australia.

"Due to the nature of our business, banks and financial services institutions of all types tend to have a larger team of information security professionals working for them than most other institutions," he said.

"If you look at it collectively in terms of this industry, and if you add in maybe the big telcos, a couple of three-letter government agencies and a few large vendors, the major portion of our cyber security capability as a nation is covered."

He said Australian FSIs had a history of sharing information and intelligence with each other when it came to cyber security threats. In addition, government was becoming more adept at sharing intelligence between its various departments and agencies.

"I know talking to my cyber security analysts that they've found federal government intelligence a lot easier to work with since the advent of the Cyber Security Operations Centre (CSOC)," Johnson said.

Johnson described the Australian Cyber Security Centre - which opened at the end of last year and subsumed the CSOC - as "the next logical extension" of cyber security intelligence sharing in government.

"It's a great step forward for government in terms of recognising and enabling a free flow of information and sharing of collaborative intelligence," he said.

Johnson was adamant, however, that these various intelligence-sharing mechanisms could present a more united front to tackle security threats.

"Against a common enemy, a coordinated defence is the only answer," he said.

"The opportunity ahead of us as a nation is how do we take the intelligence sharing within financial services and integrate and link it to the intelligence-sharing fabric within federal government, which has a different but complimentary view of the problem?"

"Similarly, how do we link the intelligence capability being shared within [the financial services] industry with other industries that are part of critical infrastructure - telcos, energy, utilities?

"This concept of sending intelligence between our industries and between industry and government - to me - is the future of information sharing for this nation in terms of maintaining critical infrastructure".

Johnson said FSIs were well suited to assume a "pivotal" role in setting up these kinds of arrangements, "but clearly there's a role for government as well".

"That's a key point Westpac has certainly made to the Department of Prime Minister and Cabinet as part of the current Australian cyber security review".

Johnson encouraged those with similar views to add them to the cyber security review process, noting collaboration could eclipse any intelligence-led success in the local cyber security area to date.

"I think our greatest success in terms of collaborative intelligence sharing as a nation still lays ahead of us," he said.