The hidden cyber risk – Understanding the data that malicious actors target

A major trend in cyber attacks over recent years has been the extent to which threat actors target an organisation’s sensitive financial, personal and corporate data, in order to commit future cyber extortion attacks and conduct social engineering fraud.

With the growing trends seen in regulatory and privacy liability, these data records, and how they are collected, stored and managed, is a key driver of an organisation’s underlying cyber risk exposure, and the consequential financial harms that will result from a cyber-attack.

Currently few organisations and cyber security professionals understanding how to identify and assess these data retention risks, or the important role played by risk of harm assessments during cyber incident response and triage steps. This session will provide guidance on these key issues and also draw on insights obtained from real world cyber incidents that impacted Australian and global organisations.

The session will be led by David Rudduck, whose team developed one of the first purpose-built data breach assessment solutions in 2018, which was later acquired by a leading global cyber insurer in 2021. By sharing insights obtained from thousands of data breach assessments, David will guide audience members through the common ways in which sensitive data is targeted by malicious actors, the repositories they focus on, and issues that regularly result in organisation’s over-retaining highly sensitive data types. David will also touch on how these issues can give rise to significant incident respond and forensic investigations challenges.

David will be joined by Ben Di Marco from WTW, who specialises in insurance, cyber risk, technology law, privacy and data governance. Ben will also provide insights into the common legal and regulatory challenges that arise with data risk assessments and how these issues can influence the concerns and focus areas of the cyber insurance market.

The session will examine how organisations can effectively perform pre-breach assessments of their own environment and key systems, to better understand their sensitive data retentions risks, and how they can design effective cyber security strategies to minimise potential cyber harms.

The session will conclude with practical guidance on the tools and processes which businesses can adopt to manage these issues, as well as guidance on how changing trends in the cyber threat landscape can also be examined in the context of pre-breach assessments.