Superpartners wins SC Benchmark Awards

Superpartners' Darren Simpson has been crowned CISO of 2015 for a cyber defence strategy that helped to protect the data of 6.5 million Australians.

Darren Simpson, CISO, Superpartners.

Based on the recent experience of health insurers in the United States, superannuation specialist Superpartners is facing a real threat of cyber attack.

In the past year, an enormous amount of sensitive, personally identifiable data of American consumers has been captured by unknown hackers.

Superpartners manages the financial information of 6.5 million Australians, sits on $160 billion in investments and connects directly to transaction clearinghouses, making it a juicy target for fraudsters and digital criminals, according to its chief information security officer Darren Simpson.

Even if digital criminals don’t manage to break into its different systems, Superpartners’ clients need them to be available at all times for transactions - a denial of service attack that delayed or even stopped payments and updates would hurt both the company and its clients, Simpson said.

“I looked at the core business processes for Superpartners and built a threat overlay for each to make it clear what would happen if attacks succeeded,” he said.

With that in mind, Simpson ventured into a project to update and future-proof Superpartners’ IT security, evolving it over three years to evaluate each capability as it was deployed in the business.

Getting the backing of Superpartners’ board was key to keeping the program on track and ensuring quality, Simpson said.

“We would roll out seven to eight new significant capabilities and technologies a year, and needed to be resourced properly to ensure everything worked smoothly," he said.

“The board actually asked if it could be done faster."

Three internal staff were initially deployed to the project, later expanding to 11. 

The 24-7 monitoring of networks and sites was outsourced to Dimension Data, which allowed Simpson's team to work on broadening the security posture throughout the business and to train and inform staff through “brown bag sessions” during breaks.

In one initiative, Simpson’s team checked and advised on executives' and staff home network security.

“Staff are often targeted specifically through phishing and spearphishing attacks, and we wanted to make sure they and their families are safe - this is important for remote working,” Simpson said.

Another initiative was to build dashboards using Splunk to create awareness around threats being discovered through data analysis. 

Superpartners deployed 25 new technologies, augmented with skills from the vendors for the project, Simpson said.

His approach has provided a return on investment in sometimes unexpected ways.

“We identified devs to analyse code in the apps we use, to make sure they’re secure. This had the side-effect of reducing defects by 20-25 percent, which was an unexpected benefit,” he said.

Superpartners' CISO Darren Simpson was crowned at AusCERT 2015.

We'd like to thank ESET for sponsoring this year's awards.

Copyright © SC Magazine, Australia