[AusNOG] Optus Hack

[Mark Stewart]

In this type of breach and, like many others, is that companies provide access to the entire consumer data without any consideration of the consumer who is having their data being accessed.

The current model(s) need to change and are changing to be more consumer centric.

Preventing 3rd party companies' direct access to consumer data without consumer consent is what needs to be put in place now to remove such egregious breaches from occurring in the future.

Allowing the consumer to decide who has access to their data and what data they want is the model that should be taken.

This limits the scope of an attack down to a single consumer as the data passing between "company to company where the source company is the data holder" or "company to company via the consumer where the consumer is the data holder" is only specific to that consumer not entire data set. If an attacker manages to gain access to that data in-transit, then it will be limited to the scope of that consumer, the risk can be mitigated and the cost to access large swathes of consumer data will be so high that it will be not cost effective for the hacker.

It is only a matter of time until companies will need to pivot to facilitate this change.

So why not start working towards making this happen before you are forced to.



Regards,

Mark Stewart

M:      0438005415<tel:0438005415>
E:      mark at nabc.com.au<mailto:mark at nabc.com.au>
W:      www.nabc.com.au<https://nabc.com.au/>

[cid:logo_134bce06-4035-4c5e-9960-5d389b43b8b5.png] [cid:nabc_9bc8b7c1-99a1-415f-8f90-68e51c42614a.png]

P Please consider the environment before you print this e-mail
As communication via the internet is insecure in the form of e-mail, you are advised that material which may offend or infringe individual rights may be transmitted without the knowledge or consent of Nuts and Bolts Computing or any of its related entities or subsidiaries. Whilst Nuts and Bolts Computing has taken reasonable steps to ensure the integrity of such communications, it accepts no liability for material transmitted via this medium. This e-mail may contain privileged and confidential information and is intended solely for the use of the individual or entity it is addressed to. If you are not the addressee indicated, or the person responsible for delivering e-mail, you may not copy, print, forward or deliver this message to anyone. If you have received this e-mail in error, please contact the sender by reply e-mail and insure that the original transmission and its content is deleted and destroyed. Thanking you for your attention.

From: AusNOG <ausnog-bounces at ausnog.net> On Behalf Of Bevan Slattery
Sent: Tuesday, 27 September 2022 8:46 AM
To: ausnog <ausnog at ausnog.net>
Subject: DMARC Violation[AusNOG] Optus Hack

Hi everyone,

Obviously a big week in telco and cybersecurity.  As part of my work I am on the Australian Cyber Security Industry Advisory Committee as an industry representative.

I am keen to look at opening up a dialogue with more and more telco, DC and Cloud CISO's on what they are doing around this issue and looking to take a proactive step towards best practice on customer data and system security.

There will be some pretty serious consequences of this hack on the industry and importantly we need to make sure we are as best placed to help each other continually increase in security posture through best practice, but also working with each other as an industry.

Are people keen on having a online/VC session sometime in the next few weeks where like-minded industry participants get together and discuss security, retention, encryption, threat detection etc.?  If so, just ping me directly and if there is enough interest I will send out an invitation to the list for a call.

Cheers

[b]

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.ausnog.net/pipermail/ausnog/attachments/20220927/416b7ec8/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: logo_134bce06-4035-4c5e-9960-5d389b43b8b5.png
Type: image/png
Size: 7828 bytes
Desc: logo_134bce06-4035-4c5e-9960-5d389b43b8b5.png
URL: <https://lists.ausnog.net/pipermail/ausnog/attachments/20220927/416b7ec8/attachment.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: nabc_9bc8b7c1-99a1-415f-8f90-68e51c42614a.png
Type: image/png
Size: 11400 bytes
Desc: nabc_9bc8b7c1-99a1-415f-8f90-68e51c42614a.png
URL: <https://lists.ausnog.net/pipermail/ausnog/attachments/20220927/416b7ec8/attachment-0001.png>