Cyber security, April 2025

You’ve likely heard about a recent surge in suspected cyber attacks on super funds. The good news is that ESSSuper has had multiple layers of protection in place through Members Online since 2022, and we remain vigilant in protecting your money and personal information. In this podcast, our Senior Cyber Security Manager Yunus Algun shares an expert look into what cyber security is, what the risks are and tips to keep yourself safe.

__

This podcast is of a general nature only and does not consider your personal circumstances, financial needs or objectives before acting on any advice contained in this podcast. Please download and read the relevant product disclosure statement and target market determination found on our website, esssuper.com.au.

Transcript

Transcript 

00:00:02 

You're listening to Exploring Super, the exclusive podcast for ESS Super members. 

00:00:11 

Welcome to Exploring Super, the exclusive podcast for ESS Super members. 

00:00:16 

My name is Christian Kueng, and I'm the Manager of Member Education. 

00:00:19 

And I'm Felicity Brasher. 

00:00:20 

I'm the Group Executive of Member Engagement. 

00:00:23 

In this episode, we delve into the cybersecurity challenges faced by ESS Super, explore the strategies implemented to safeguard funds, and share valuable tips for members to keep their accounts secure from cyber threats. 

00:00:34 

Joining us today is Yunus, our Senior Cybersecurity Manager. 

00:00:39 

Thanks for coming in today, Yunus. 

00:00:41 

Thanks for having me. 

00:00:42 

Great. 

00:00:42 

So, 

00:00:43 

It's a very topical topic that we're talking about here today. 

00:00:48 

So we might start from the top. 

00:00:50 

Cybersecurity. 

00:00:51 

What is it? 

00:00:52 

Cybersecurity refers to the practice of protecting systems, networks, and programs from digital attacks. 

00:00:59 

These cyber attacks are usually aimed at accessing sensitive information, interrupting normal business processes, or extorting money from users or businesses. 

00:01:08 

Right. 

00:01:09 

Okay. 

00:01:10 

So what are some examples of high-profile breaches, and what did we learn from them? 

00:01:13 

from them. 

00:01:14 

Medibank is a good one to start discussing. 

00:01:17 

On October 12, 2022, Medibank detected some suspicious activity on their network. 

00:01:23 

The very next day, they announced a potential cyber attack, but initially found no evidence that the customer data had been compromised. 

00:01:30 

Okay. 

00:01:31 

Fast forward to October 14th, Medibank started contacting its customers who might have been impacted. 

00:01:37 

And by October 28th, they confirmed that customer data has been compromised. 

00:01:43 

The situation escalated on November 7th when it was revealed that a staggering 9.7 million customers were infected. 

00:01:51 

Wow. 

00:01:52 

To make matters worse, hackers began publishing segments of the stolen data on the dark web. 

00:01:57 

This included highly sensitive information to push Metabank into paying the ransom demands. 

00:02:04 

Wow. 

00:02:04 

Another one worth mentioning about is the Optus Bridge. 

00:02:07 

Yes, I remember that one. 

00:02:09 

This was happened in September 2022. 

00:02:12 

Optus, being one of Australia's largest telecommunication company, detected some suspicious activity on their network. 

00:02:19 

And by September 22nd, the company confirmed a significant data breach affecting up to maybe 10 million current and former customers were impacted. 

00:02:29 

It's important to keep in mind that this is almost 1/3 of Australia's population. 

00:02:34 

I know lots of people. 

00:02:35 

People I'm related to here are impacted. 

00:02:37 

Yeah. 

00:02:38 

The compromised data include names, date of birth, home addresses, telephone numbers, e-mail contacts, and even in some cases, 

00:02:47 

passports and driving license numbers. 

00:02:49 

That's scary. 

00:02:50 

Optus initially described this attack as a sophisticated one, but further investigation by cybersecurity professionals revealed that this was actually as a result of a coding error in Optus internet facing systems. 

00:03:03 

Right. 

00:03:04 

Okay, so they're really great examples, Yunus, in terms of the threats and things that have gone out. 

00:03:11 

in the big wide world out there. 

00:03:13 

If we're thinking about the super funds, what sort of threats are the super funds working against at the moment? 

00:03:20 

There are a variety of attacks that we see in our perimeter. 

00:03:23 

Today I would like to talk about four top threats. 

00:03:26 

Yeah, okay. 

00:03:27 

I would like to start with commodity malware. 

00:03:31 

Commodity malware refers to widely available malicious software that can be used by even relatively unskilled threat actors to carry out cyber attacks. 

00:03:41 

This type of malware is often sold in illicit websites and can include a variety of tools such as ransomware, phishing boats, and remote access tools. 

00:03:51 

The term commodity highlights that these malware tools are not custom built for specific targets, but are instead mass produced and sold to multiple buyers. 

00:04:02 

This makes them really accessible to a broader range of cyber criminals who can use them to launch attacks without needing advanced technical skills. 

00:04:10 

Okay. 

00:04:11 

The second type of threat we see is the state actors. 

00:04:15 

State actors in cybersecurity refer to government-sponsored groups or individuals who engage in cyber activities to achieve national objectives. 

00:04:24 

These actors are often very well resourced and highly skilled, making them capable of conducting really sophisticated attacks. 

00:04:32 

Sounds scary. 

00:04:33 

It. 

00:04:34 

Is. 

00:04:35 

The third one I wanted to discuss is DDoS attacks, which refers to a distributed denial of service attack. 

00:04:42 

I have never heard of that one. 

00:04:44 

Neither. 

00:04:45 

It's basically a type of malicious attempt to make a web-based service unreachable. 

00:04:50 

In DDoS attacks, a hacker uses thousands of compromised computers to send fake traffics to overwhelm internet-facing IT systems, making them slow or completely unavailable for real users. 

00:05:05 

Okay. 

00:05:05 

Yep. 

00:05:05 

And #4, Yunus, you said there were four. 

00:05:08 

Yeah, the last one is phishing, and this is one of the... 

00:05:10 

I know that one. 

00:05:11 

Yes. 

00:05:12 

I think everyone is familiar with the phishing one. 

00:05:14 

This is a type of attack where a hacker tries to trick you into giving away your sensitive information, like your password. 

00:05:21 

Yeah. 

00:05:22 

Or install malicious software on your system to spread and infect corporate databases or systems. 

00:05:28 

Yes, know about that one. 

00:05:30 

Definitely, Thanks, Yunus. 

00:05:32 

There was a lot of detail there. 

00:05:33 

So some of our members really want to know what we do to provide better security on their funds. 

00:05:39 

Can you explain our approach for cybersecurity, please? 

00:05:41 

Yeah, sure. 

00:05:42 

At ESS Super, we treat cybersecurity and member data security as high priority. 

00:05:48 

Hence, our approach is holistic rather than episodic. 

00:05:52 

What that translates to on the ground is having a multi-layered security posture, as known as defense in depth. 

00:05:59 

For example, at network layer, we have controls like geo-blocking, firewalls, access control gateways, antivirus, et cetera. 

00:06:09 

Right. 

00:06:10 

At application layer, we have multi-factor authentication, where a combination of member-specific data 

00:06:16 

password, and sometimes one-time PIN is required. 

00:06:19 

Yes, we use that internally too. 

00:06:21 

Yeah, we do, yeah. 

00:06:22 

Furthermore, key financial transactions require a 100-point check to be completed by the member. 

00:06:28 

These are just some of the controls we put in place to secure our members' access. 

00:06:33 

And they are also complemented by internal controls such as rigorous background checks for our employees. 

00:06:39 

There's a dedicated cybersecurity team with board oversight. 

00:06:44 

ESA Super Board meets periodically to discuss cyber risks to the font, and cybersecurity team performs periodic security tests to assess our security posture. 

00:06:54 

When viewed in its entirety, this is a very comprehensive cybersecurity program, and we keep reviewing it periodically. 

00:07:01 

That's great, Yunus. 

00:07:02 

If we think about the members, what can members do outside of *** Super for their own personal cybersecurity hygiene, if you like, for their personal devices or PCs or things that they're using? 

00:07:16 

Really good question. 

00:07:18 

I think it's really important to use strong passwords and change them regularly. 

00:07:23 

Yeah, that's a tricky one, isn't it? 

00:07:25 

Is. 

00:07:25 

It is hard to remember strong passwords, but you can always use a password manager to help you create unique passwords. 

00:07:31 

That doesn't open you up to... 

00:07:34 

That being hacked if your password manager gets hacked? 

00:07:37 

Because I've thought about that myself. 

00:07:39 

There are a variety of different password managers. 

00:07:42 

Some of them are cloud-based and others you can install it on your laptop. 

00:07:46 

Right. 

00:07:47 

OK. 

00:07:48 

Choosing a strong password is really important. 

00:07:51 

Yeah. 

00:07:51 

Because research shows that most passwords are guessable. 

00:07:55 

Yeah. 

00:07:55 

That's why it's important to create strong and unique passwords and change them regularly. 

00:08:01 

Second one I would like to discuss is enabling multi-factor authentication for an extra layer of security on your e-mail account and social media profiles. 

00:08:10 

Okay, so I think this one's going to be of some interest definitely to the members. 

00:08:15 

Certainly of interest to me. 

00:08:16 

If I wanted to do that on one of my social media platforms that I use, how could I go about doing that? 

00:08:24 

It's very simple. 

00:08:25 

What you need to do is that you can download one of the multi-factor authenticator apps from the App Store. 

00:08:30 

Sure. 

00:08:31 

And log into your social media platform and configure it. 

00:08:36 

Right. 

00:08:36 

For ESS, you can contact our member services and they can set up the multi-factor authentication on your ESS Super account. 

00:08:42 

Yes, of course, we do do that. 

00:08:44 

Yeah. 

00:08:45 

The third most important thing is to make sure that your desktop operating systems are always up to date with the latest security patches. 

00:08:53 

For example, some organizations publish new security updates on a monthly basis. 

00:08:59 

Don't skip or delay these updates. 

00:09:01 

Apply them immediately and make sure you restart your laptop. 

00:09:05 

That's good advice. 

00:09:05 

Yes, that is a good tip. 

00:09:07 

These are the type of controls you can put in place to secure your identity or your laptop. 

00:09:14 

On top of that, you can also take regular backups to a cloud storage or a USB stick just in case. 

00:09:21 

On top of that, I would highly recommend 

00:09:23 

avoiding public wi-fis. 

00:09:26 

I better tell my kids. 

00:09:27 

Okay. 

00:09:28 

Yeah. 

00:09:29 

I think it is important to understand that public wi-fis are accessible by anyone, and you don't necessarily know who actually sets it up in the 1st place. 

00:09:38 

Yeah. 

00:09:39 

My recommendation is, where possible, try to hotspot from your own mobile phone. 

00:09:43 

Okay. 

00:09:43 

Yeah, my kids do that thing too. 

00:09:46 

Don't love that, Yunus. 

00:09:48 

Yeah. 

00:09:48 

I think last recommendation I would be able to give is to use a private VPN service. 

00:09:54 

This can help you secure your system and monitor your laptop for suspicious activities. 

00:10:00 

Right. 

00:10:01 

Consider subscribing to a security bundle or a package to protect your system from unauthorized access. 

00:10:06 

That's another really good tip. 

00:10:08 

Yeah. 

00:10:08 

So, what would you recommend people do if they actually are the victim of a scam or breach? 

00:10:13 

I would say call member services immediately. 

00:10:16 

If you believe your superannuation account has been compromised, our team can help you to validate your financial activity. 

00:10:23 

on your account and ensure your details are up to date. 

00:10:26 

Yes, I should definitely do that. 

00:10:28 

If you suspect that your account might be compromised, change your password immediately and make sure your details are up to date in your member portal. 

00:10:37 

Yeah. 

00:10:38 

I think the third one is if you receive a call or an SMS from ESS Super and you're unsure, just simply take the details of the person you are talking to and contact our member services from 1300 650. 

00:10:53 

Yeah, that's great because we will be able to track whether it was a legitimate call or not. 

00:10:58 

Yeah, that's a really good piece of advice. 

00:11:00 

You can go all day, but I think if you would like more about it, I would recommend going to idcare.org. 

00:11:07 

There are some really useful tips there. 

00:11:09 

Yeah, okay. 

00:11:11 

And if you'd like to know more about how scams are carried out, you can also go to scamwatch.gov.au. 

00:11:18 

Great. 

00:11:18 

Yunus, we have covered a lot in the cybersecurity space today. 

00:11:24 

Is there anything else worth noting or mentioning while we've got you? 

00:11:29 

Yeah, I think it's worth mentioning that all superannuation funds strive to ensure the security of your future. 

00:11:36 

ESS Super has a dedicated cybersecurity team which uses repeatable third-party organizations to regularly test our methods of protection and embroach. 

00:11:46 

But it is essential for our members to take proactive steps on their end as well. 

00:11:51 

Make sure the information you share on social media cannot be used for identity theft. 

00:11:57 

Be cautious with friend requests. 

00:11:58 

Yes. 

00:11:59 

Only accept friend requests from people you know and trust. 

00:12:03 

Avoid sharing sensitive information. 

00:12:05 

Refrain from posting personal details such as your full address, your phone number, or financial information on publicly accessible forms. 

00:12:13 

Oh, wow. 

00:12:14 

I can't believe people would do that. 

00:12:16 

But yes, I'm sure it goes on, Yunus. 

00:12:18 

That's it. 

00:12:19 

Yunus, thank you so much for coming in today and sharing your insights and all your valuable knowledge with cybersecurity. 

00:12:26 

It's been 

00:12:27 

great. 

00:12:27 

And we really look forward to having you on here again. 

00:12:30 

Thanks for having me. 

00:12:31 

That wraps up our episode today of Exploring Super, the exclusive podcast for ESS Super members. 

00:12:37 

We look forward to producing more content for you at ESS Super, proudly serving our members. 

00:12:43 

If you'd like more information about our investment and products, please go to esssuper.com.au. 

00:12:54 

This podcast is of a general nature only and does not consider your personal circumstances, financial needs or objectives. 

00:13:00 

Before acting on any advice contained in this podcast, please download and read the relevant product disclosure statement and target market determination found on our website, esssuper.com.au. 

00:13:12 

The board recommends that you seek financial advice before acting upon this information. 

00:13:16 

Benefits in ESS Super's accumulation plan, income streams and beneficiary account products are not guaranteed or underwritten by the Victorian Government 

00:13:24 

ESS Super.