S&P delves into Australian banks’ cyber exposure

“An attack on a third-party service provider could also cripple banking operations. Many smaller banks use the same content delivery networks (e.g., Akamai, which saw a major outage in 2021), cloud-based service providers (such as AWS), or providers of software as a service for core banking systems (e.g., Temenos or Data Action, which is especially relevant for smaller and regional banks),” the report added.

Read more: Cyber challenges: how should brokers advise clients?

Another factor intensifying concerns about cyberattacks is cyber-skill shortages, with the cyber-skilled workforce gap totalling around 2.7 million people globally due to the rise in cyber incidents and new cyber security and data privacy laws forcing organisations to protect their data more closely. Banks also compete with the information technology sector experiencing an increasing demand for these skills.

Despite increased concerns about cyber risks, the report deemed the overall risk for the Australian banking system low.

“This is because of early steps taken to strengthen cyber risk management, strong industry collaboration, and the strong capitalization of the banking system,” the report said.

For example, in March 2019, the Australian Council of Financial Regulators – composed of the Australian Prudential Regulation Authority (APRA), the Reserve Bank of Australia (RBA), the Australian Securities and Investment Commission (ASIC), and the Federal Treasury – established a cyber security working group to design a framework improving cyber resilience in the Australian financial services industry.

The Australian Department of Home Affairs also encourages critical infrastructure asset owners, including banks, to voluntarily report cyber security incidents to the Australian Cyber Security Centre (ACSC) even if the threshold for mandatory reporting is not met.