Transcript: How to build trust in the face of evolving cyberthreats

00:00 Dave: Welcome to the Australian Payments Plus Point of View podcast, where we explore the theme of trust from a number of different angles. 

Today on the show, I have Nicola and Cody. Nicola joined CBA as Chief Security Officer in 2024, where she leads over 1000 security experts whose job is ultimately to keep the bank's customers safe and secure. She is passionate about cybersecurity and the role it plays in protecting Australia's digital economy, and brings a wealth of experience from her previous roles at BCG, PwC, JP Morgan Chase, Lloyds Banking Group and Royal Bank of Scotland, to name a few. 

And Cody, who is our Chief Information Security Officer at AP+, has spent 13 years at EY and is excited to contribute to building trust across the digital ecosystem. He likes to take a threat-informed and consequence-driven approach to cybersecurity with strong consideration of cost-effectiveness and sustainability. So, welcome both to what's an important topic today.

01:08 Nicola: Nice to be here, thank you. 

01:09 Cody: Thank you. 

01:09 Dave: So we're gonna start with, obviously this is about trust and that's the theme of the overall podcast series. So I'm just interested in what does trust mean to you personally? So maybe I'll start, Nicola, with yourself.

01:20 Nicola: Yeah, so look, I think it's interesting to think about trust in the concept of today's society. For me, when I think about the way our digital economy has evolved, if you think about it in the context of scams, if you think about it in the context of cyber, it actually becomes a real core challenge of our time, if that makes sense, right? 

How do you convey trust, how do you build trust when it's a very human emotion and you're trying to do that in a really digital way, in a really digital ecosystem?

01:53 Dave: Yeah, and trust for a bank like CBA is particularly important in the financial services.

01:55 Nicola: Absolutely, yeah. 

01:56 Dave: And for Cody, what about you? What does trust mean to you?

01:58 Cody: Yeah, when I think about trust, I think you ultimately have to know something to trust it. I come back to kind of the saying, the devil you know is better than the devil you don't. And I think that's applicable both in life, but also when you think about cyber as well.

02:15 Dave: Yeah, so today, obviously, we're exploring a really important topic around cyber threats, particularly prevalent in the payment industry. We think about what's happened, particularly post-COVID, with digital payments increasing and more data stored online. So, there's many more threats that the industry is facing. So, basic question to start with, what does cyber mean and how should we think about it?

02:40 Nicola: So, if I think about cyber, cyber in itself, the word that's used, I think, can then be applied in lots of different contexts, right? So, I'm going to talk about it in the context of sort of cybercrime and cyber threat. Cybercrime, I think, continues to be one of the number one challenges for organizations across Australia, and that is criminals out to make money. 

And there's a real focus on today around cyber extortion. 

There's one phrase that I think is particularly interesting that's been coined around triple extortion, where you get threat actors who are actually, you know, holding your organization to ransom, then selling your data and then trying to scam the people whose data that they've actually stolen, right? And they're getting three times the money from that. So, I think cyber crime and extortion is something that we continue to see accelerate. 

03:27 Cody: Yeah, I would agree with a lot of what you're saying. I think one of my favourite poll quotes from the ACSC annual threat report is that Australia is facing the most complex threat environment since the Second World War. 

So, yeah, definitely a daunting challenge. And yeah, when people ask what is cyber, it sounds like a simple question, but the industry does a good job of coming up with new terms and calling the same thing something different, you know, the next year. So yeah, but yeah, when you boil it down, to me, it's about thinking about digital threats to technology and the controls to mitigate those.

04:01 Nicola: Yeah. And I think, just it's also about making sure you understand who the threat actors are, right? So, when you think about cyber, it's in the context of someone trying to attack your organization in some shape or form. So, when we think about cybercriminals, we think about hacktivists or nation-states, it's understanding who they are and what their motivations are. I think that's a really important sort of context-setting piece.

04:22 Dave: I mean, it's big business as well, isn't it? I mean, some of these companies or threat actors are making a lot of money.

04:27 Nicola: So, if you look at the World Economic Forum reporting, that would suggest that cybercrime is the third largest economy in the world behind the US and China. Now, that's quite a terrifying statistic, right? But it's, you know, if we're talking in that sort of size and scale, it's a massive business.

04:43 Cody: And they are businesses, like they have their own HR, they'll have their own IT support.

04:49 Dave: I find that fascinating, genuinely. And some people don't even know they're working in these companies as well. 

04:53 Nicola: Exactly. Yeah, yeah. 

04:54 Dave: So, Nicola, how are you seeing the current threat environment? And how is this driving the areas that you're focused on in your role?

05:01 Nicola: So, firstly, if I look at CommBank specifically, we've got 8.5 million customers using our digital app. And that has tripled in the last 10 years. And in that context, our customers expect you know, safe and secure banking 24 by 7, that's a given. And therefore, if I think about that threat landscape that we talked about, and then what we do to protect our customers, my best description of that is we take an intelligence-led approach. 

So we talked earlier about, you know, knowing who the organizations are or threat actors that may be attacking you, understanding their motivations. We then take that information and that intelligence and we adapt our defenses accordingly.

05:48 Cody: And I think about what you just said, but you also need to extend that to your third parties as well. So think about where they might introduce weaknesses to your ecosystem.

05:57 Nicola: Yeah. 

05:58 Dave: So, I mean, it's Team Australia, but actually it's a global approach, isn't it?

06:02 Nicola: Yeah, and I actually think one of the things that really helps us in that context, so firstly, you know, our Australian government and our signals directorate being part of the Five Eyes community gives us access to a lot of global intelligence. And then there's also partners that you work with.

So if I think about Microsoft, for example, we partner with them, but we also have our own intelligence teams or our own red teams, which I'm happy to come back to. But if you think about sort of ethical hacking your organization, those teams that we work with, we actually share learnings with our partners. So, we learn from what they see, they learn from what we see, and that strengthens the whole global ecosystem as well. 

06:38 Dave: Yeah, we will come back to the red teams later. So I got another question for you, though, Nicola. So, if you're in any boardroom now, cyber threat, cyber security is a really big thing. And so how do you think about educating your board around cyber security? How should boards generally be thinking about it? 

06:54 Nicola: I think there's a couple of threads to talk through there. So the first is that your CISO or security officer, your security leader in the organization should really be taking a position where they're helping educate the board, right? And there's some really practical things that you can do. So, one would be sharing and pointing them to information like the ASD annual report, but other reports that they could read that would really bring to life some of that external threat landscape. 

And there's also spending time educating the board on what your organization is doing and your cyber program. And then the other thing I think inside out the organization should be doing is exercising and like crisis simulations. That's one of the most powerful things to do with your board. And then if you look outside in, I would say the board should also be doing their own education. 

07:43 So, and by that I mean, I know a lot of board members who will go out and go to the conferences. They will go to events and they will actually hear from other organizations how they're managing their cyber risk.

07:55 Cody: I think it's interesting too. And like board members do sit on multiple boards. So, it's very helpful to have a relationship with the security leaders at the companies where your board members sit. So you can see what conversations they're having and not kind of caught off guard when you go to present to the board. 

And yeah, I think for me, at least here, we kind of started our discussion with the board very compliance-focused and then having to explain that's not the end-all, be-all, that's kind of a minimum baseline that we need to maintain. Then moving to kind of a maturity standpoint, but ultimately where we want to get to is more risk-focused and what are the particular scenarios that we're concerned about? What are we doing about it? Could Medibank or Optus happen to us or what would happen if it happened?

08:42 Nicola: I think translating those real-world scenarios into what it means for your organization is a really powerful thing to do, right? That resonates with the board members – you could play through how that event happened to another organization and what would it look like if it happened here. And it's a great way to sort of pressure test your thinking and bring a real-world scenario to life.

09:06 Dave: I mean I think about it, I mean it must be one of the top three conversations at most board levels and it's kind of the thing you kind of have to stay match fit on because the cyber threat and the cyber risk is changing all the time. New bad actors coming in, new tactics, so that's why boards have to kind of have it front of mind to kind of try and mitigate those risks.

09:24 Cody: They obviously want confidence that you have a plan but you also need commitment from them that you can be adaptive to the new threats and if there are any changes in the external context. 

09:33 Dave: Okay, so Cody I'd come to you to talk about third-party risk. So, obviously the management of that is particularly important, but why is it such a difficult problem? 

09:44 Cody: Yeah, I alluded to it earlier but I think just the breadth and scope of the problem and truly understanding your supply chain and where the weaknesses might be. Yeah, just a very hard problem to solve.

09:56 Nicola: It is complex, right? And if you think about it, you could almost picture it being like a family tree where you try and map out all of your sort of third parties and connections. Then there are often fourth parties or further parties that are sort of sitting underneath that. 

So, being able to get and understand the depth of your supply chain, I think is important. I think organisations need to understand that environment because that is essentially you expanding your attack surface as well because attacks are coming through third parties and we've seen that now quite regularly in the news headlines.

10:31 Dave: So we talked about a red team earlier, I'm still curious. What is a red team?

10:34 Nicola: What is a red team? A red team in my simple terms is, it's sort of ethical hacking. You've got a group of hackers who are trying to break into your organisation and they're thinking like an attacker, right? So that you can work out how that attacker might be thinking about the bank, what they can see on the outside. 

And, you know, I think red teams are a really important part of an organization's cyber program, at least for mature businesses, right, that have got a kind of reasonable size cyber team, then that's a really important part of our capabilities.

11:04 Dave: So, ultimately a team checking for vulnerabilities so you can drive uplifts in your security.

11:09 Nicola: Yeah, exactly. 

11:10 Cody: And I think it comes from like a military terminology in terms of you have the red team attackers and the blue team, which are the defenders, yeah.

11:16 Nicola: Attackers, defenders.

11:19 Dave: Oh, there you go. Learned something today. So, AI is a big thing globally. And we've been talking about it for many years. Is it a threat? Is it an opportunity? But... What risk does it pose to organizations as we think about cybersecurity and cyber threats?

11:34 Cody: I think it's both a threat and an opportunity. I think the risk, you know, the main one that we think about first is around data loss or sensitive data loss. But depending upon how you're using AI, if it's integrated into your business processes and you're making decisions based off of it, then you also need to be concerned about, you know, how the model is being trained, the decisions that it's making. 

But yeah, at the same time, the onus is on us to also be thinking about how we use AI as an opportunity in cyber to make our processes more efficient.

12:06 Nicola: Yeah, I would agree. And I would build on that maybe and say, well, firstly, I think it is a massive opportunity for businesses overall. And your cyber team can't be the Department of No, right? That says, "We can't do this." This is about enabling the business, right?

And the businesses are gonna use AI and we need to be in it with them, looking at how we do that safely. Clearly there's risk associated with it. And as Cody said, I think, you know, one of them is definitely about the data loss and making sure you're thinking about data security and privacy. 

12:38 I think also there's the model itself and being prepared for malicious sort of prompt injection or disruption of the model. But also, it takes you back to the supply chain, right? If you have thinking as an organization about where you are perhaps partnering with someone or have a supplier who is also using AI, and how does that impact the risk that you might be running in the supply chain?

12:59 Dave: I still find it fascinating that the bad actors are probably using AI to try and hack, and then the companies are trying to stop them, they're also using AI to counter that.

13:09 Nicola: Using AI, you're fighting fire with fire.

13:10 Dave: Yeah, it's just who's better at AI, who's gonna win out, but hopefully the good actors.

13:15 Nicola: Exactly, right, and I was reading an article just this morning about where threat actors are using AI for compromising credentials, right? So if you think about something like a password spray attack, right? You've stolen, they've stolen credentials. And they're going to test them out, right?

And they're going to picture it like spray gun organizations to see if these credentials get them in the door somewhere. They can do that faster. They can power it by AI. They can do more, and they can do it faster. So, you can see how the threat actors are using it to speed up what they do.

13:49 And in some cases, they use it to get more sophisticated as well, right? I don't know about you, Corey, but I would think the days of seeing a phishing email that has a spelling mistake, they're kind of gone, right? Because AI allows the threat actors to have really what look like very genuine communication with people. And then you've got to fight harder to be able to spot those malicious activities as well.

14:12 Dave: Yeah, so big job today still on the threats opportunity. So, maybe, we've talked a lot today about the risks associated from a cybersecurity perspective, but clearly as an industry, I think we're not doing too badly in Australia. So, talk to me about some of the things that we're doing well. Maybe start with you, Cody. What are you observing?

14:32 Cody: Yeah, I think the fact that cyber is a board-level and executive-level conversation is a win in itself because it's an acknowledgement of the problem and also commitment to solving it. I think, you know, we referenced Team Australia earlier. So, I think the increased collaboration is also a win that I see working well here.

14:51 Nicola: Yeah, and I agree. And even if you look at it through the national lens, like the national cyber strategy, You know, the government has set out to make Australia world-leading in this space and make it really safe and secure for our citizens, for our small businesses in Australia. And I think that's critical. And there's some of the recent updates that have been introduced by government in this space involve things like new reporting requirements for ransomware. 

And the reason for that is to get better handle on what is actually happening, you know, how many businesses are actually subject to a ransomware attack? What are they doing? Are businesses paying? What does that look like? There's also the setup of the new Cyber Incident Review Board, which is designed, you know, to step into situations where there have been some sort of material breach, so we can all learn from it, right? And I think that learning culture is getting really embedded in, you know, how we think about cyber at a national level.

15:48 Cody: And yeah, I guess I'd be remiss, I don't know, if we're allowed to plug our own products, but even if you think of Connect ID, it's designed to minimize the privacy information that's shared around the Australian economy. So, that in itself, I think, is a win in terms of, hey, let's think of how we can architect out some of these weaknesses.

16:10 Nicola: Yeah, and I like that architect out, right? Back to the trust comment in the beginning, right? How you can start to embed trust, think about, you know, building in security, by default, some products and services, and that really helps the ecosystem as a whole.

16:22 Dave: I mean, I think this whole topic is so linked to trust. I mean, we as an industry, if we get this wrong, we'll lose trust, but as long as we keep doing our jobs, we'll keep the trust as it is or hopefully build trust into the future. So I think that was a great conversation. I just want to thank you both for coming on today and sharing your perspectives. It's appreciated. Thank you.

16:43 Nicola: Thank you.

16:43 Cody: Thank you.