The Fortify program will implement cybersecurity controls on staff laptops and workstations in three waves over the coming months:

Wave one: Software update automation
Wave two: Secure Microsoft Office macro use
Wave three: Centralised software installation and mgmt.

Our goal is to implement these updates with minimal disruption; however, some staff might observe slight modifications to their systems. We appreciate your support and understanding as we work together to bolster our cybersecurity defences, ensuring the continued safety and integrity of our digital environment.

Upcoming change: Software update automation will enable automatic updates for operating systems and crucial desktop applications such as Office suite, web browsers, email clients and PDF viewers on University-managed laptops and workstations running Windows.

Timeline: Starting June 2023

Impacts for staff:

• Patch updates will be performed automatically and seamlessly in the background, requiring no user intervention.
• System restart alerts may be received occasionally.
• You will occasionally receive prompts to re-login to your Windows account and office apps using your staff email, password and MFA code from your phone’s authenticator app.

More detailed communications will be sent to those directly impacted, outlining specific changes and providing clear instructions as needed. We welcome and encourage questions during this process: If you have any questions, concerns or feedback, you can reach the project team through the dedicated OneHelp form .

We appreciate your support and understanding as we work together to bolster our cybersecurity defences, ensuring the continued safety and integrity of our digital campus.

The shift, part of the University’s ongoing program of work to protect Macquarie from cyber threats, will provide staff and students with a higher level of protection from account compromise.

The University is communicating this change to students. Students are being encouraged to set up their MFA by visiting this webpage.

Staff seeking more information or assistance with MFA can visit the FAQs here.

Data breaches experienced last year by large Australian organisations exposed the personal details of millions of Australians, releasing identification details into the cyber-fraud community and allowing fraudsters to construct elaborate scams.

While University systems block a large number of scams, many are also delivered through phone calls, text messages and social media. Protect yourself and Macquarie from scams by remembering these steps:

1. Stop before responding to a request for information or an urgent alert.
2. Check the request is genuine through a trusted channel.
3. Report and block scams sent to you on social media. Forward email scams to spam@mq.edu.au.

A note for LastPass users

The recent LastPass data breach may allow attackers to obtain credentials if a LastPass account password can be guessed. While it is still unclear if the LastPass breach will lead to account compromise, as a precaution, it is recommended that LastPass users reset all passwords that are stored in LastPass, as well as their LastPass master password.

For more information about cyber security for Macquarie staff please contact cybersecurity@mq.edu.au.

COVID-19 has made Cyber Security a hot topic, with privacy concerns around the Government’s COVIDSAFE app, accusations of hacking of COVID-19 vaccine research and millions flocking to e-retail sites as physical stores close.

“Our work has never been timelier,” says Professor Dali Kaafar, newly appointed Executive Director of the Optus Macquarie University Cyber Security Hub. “We have to enable explicit trust in the digital economy amidst COVID-19, and we have a talented and multi-disciplinary team of researchers  from across the university who are working hard to make this trust possible.

“Working with Optus, we are partnering to seed secure cyber-driven industries as a means of growing the economy and create the new generation of jobs for the industry”.

Pro Vice-Chancellor (Research Innovation) Professor Dan Johnson, who recently joined the Hub’s leadership team, says it’s an exciting time for the many Macquarie staff involved in the centre’s research.

“Our Cyber Security Hub is in a really exciting phase of reinvigoration,” he says. “We’ve structurally integrated our multidisciplinary research with industry leadership, which is allowing us to respond to these real-world market challenges and opportunities and enable change that adds real value – the very definition of innovation.”

And it’s not just Australian businesses that are benefitting. Director of International Programs Professor Philomena Leung says there is growing international interest in the Hub. 

“Following the overwhelming success of the Cyber Exchange mission in India last year, our reputation as international hub for information integrity has been strengthening, with more partnership opportunities and two-way flows of talent, research and analytics,” Professor Leung says.

Education, Training and Digital Cyber Upskilling lead Professor Anne Cooper says their revitalised cross-faculty focus is also benefitting students, with the Hub’s multi-disciplinary research programs and expertise having been successfully synthesised into an integrated education, training and outreach program.

The Hub’s multi-disciplinary approach is creating exciting opportunities, agrees Professor Elizabeth Sheedy, who is leading one of the research programs.

“The opportunity for cross-faculty collaboration is one of the most attractive features of the Hub,” she says. “We’re learning a great deal from each other.”

Here are six cross-faculty Cyber Security Hub research programs that are shaping the future of Cyber Security. Academics with an interest in these areas are encouraged to contact the relevant program director.

Software and Cyber Physical Systems Security (SCPSS)

Professor Kaafar is directing the Ditno Project, with research led by Dr Muhammad Ikram in the Department of Computing. The team is using data-driven analysis to develop machine-learning algorithms aiming at improving privacy and security across web and mobile, as well as detecting fraud in online services.

Data Security and Privacy (DSP)

Also directed by Professor Kaafar, this program includes two projects led by Dr Ikram and Dr Hassan Asghar in the Department of Computing. Dr Ashgar’s work is centered around building privacy-preserving systems for data sharing and enabling trustworthy machine learning with applications for Health Datasets combining expertise from three different faculties.

Risk Management Governance and Control (RMGC)

Professor Elizabeth Sheedy (pictured) in the Department of Finance is directing three projects led by Professor Norma Harrison, Dr Stephanie Huang and Professor Pavel Shevchenko, and bringing together researchers in both the Macquarie Business School and Faculty of Science and Engineering.

An acclaimed risk-management expert, Professor Sheedy says managing cyber-risk is a huge challenge for both organisations and consumers.

“Complex supply chains mean that cyber-risks in one firm can flow through to others, like a virus,” she points out. “We’re investigating risk management solutions including ways that consumers can make better and smarter purchasing decisions in the online marketplace and avoid cyber-fraud.”

Legal and Ethics of Cybersecurity (LEC)

Directed by Professor Niloufer Selvadurai (pictured), who is leading research along with Dr Doron Goldbarsht, this interdisciplinary program integrates legal, technical and business perspectives to address critical digital governance issues.

The team are looking at issues including:

• how systems and networks can be designed to better support data privacy and data security and prevent cybercrime
• potential law reforms governing the use of artificial intelligence
• improvement to telecommunications laws in respect to industry and customer interests
• liability of telecommunications carriers and carriage service providers in respect to harmful third-party content
• the role of new payment products and services (NPPSs) in the mobile industry, including potential anti-money laundering (AML) risks

Human Centric Security (HCS)

Directed by Professor Mark Wiggins (pictured) of the Centre for Elite Performance, Expertise and Training, alongside Deputy Director Associate Professor Shlomo Berkovsky of the Australian Institute of Health Innovation. Two research projects are being led by Berkovsky and Dr Piers Bayl-Smith, focusing on issues around the behaviour of human users and their interaction with cybersecurity technologies, with a particular focus on models for incident investigation and security of health data and applications.

Cyber Strategy, Foresight and Policy (CSF&P)

Professor Ben Schreer (Head of the Department of Security Studies and Criminology, pictured) directs this program, with research projects led by  Adjunct Fellow Gary Gill and Dr Stephen McCombie.

[We’d tell you more about this program, but we’d have to kill you! – Ed]

The research programs above represent a new chapter for the Cyber Hub. Its work over the last three years has focused on substantial projects with a range of partners, including: CSIRO, Data 61, the Department of Defence (DST), Ditno, and the NSW Government. The hub has attracted several million dollars in research funding for these projects. For more information please see the Hub’s webpage.

The Hub is looking for a broad range of academic expertise applicable to cyber security to contribute to the Hub’s education offerings, short courses and executive education. Please get in touch if you’re interested.

Every month we take time to celebrate staff and students who are making an impact and driving collaboration in the Macquarie spirit of human-powered innovation.

Got something to share for next month? Tell us.

Fulbright Scholar Harvard bound

Congratulations to Timothy Yee – PhD student in the Department of Media, Music, Communication and Cultural Studies – who has been successful in securing a prestigious Fulbright Scholarship to join the metaLAB research group at Harvard University.

Read more >

Cyber strength sees PETS heading our way

The Optus Macquarie University Cyber Security Hub and CSIRO’s Data61 have combined for a successful international bid to host PETS – the 21^st annual meeting of the Privacy Enhancing Technology Symposium.

It will be the first time that the convention – which brings together privacy technology experts from around the world – will be held in the Southern Hemisphere, cementing Macquarie’s reputation as a leader in the dynamic and future-focused field of Cyber Security.

MQ Quantum on the rise

Macquarie University has formed the Quantum Excellence Network (QEN) with key strategic partners from the University of Hamburg, the University of Strasbourg and the University of Sherbrooke in Quebec. The QEN will generate world-leading research in Synthetic Quantum Matter.

The new partnership follows last year’s establishment of the Sydney Quantum Academy – a collaboration of four leading quantum institutions in NSW, of which Macquarie is an inaugural member.

Both partnerships position Macquarie as a key partner and place for quantum research, with the University uniquely positioned to offer a very broad range of expertise, from theory through to experimental testing of novel engineered quantum materials.

New partnership to drive medical technology innovation

A new partnership with FLEDGE Innovation Labs will see Macquarie students working on the development of new medical technologies to improve lives.

Based in the Macquarie University Incubator, FLEDGE provides project-based learning experiences where aspiring MedTech entrepreneurs can develop real products under the leadership and guidance of mentors and an extensive network of experienced med-tech advisors.

Read more >

DECRA Fellow to join Doha Debates

Dr Randa Abdel-Fattah, DECRA Research Fellow in the Department of Sociology, has been invited by the Qatar Foundation to participate in Doha Debates next month.

She will be joining international guests on a panel debating the use of gender quotas in academia and business, during which she will draw on her current DECRA research project findings. The Debates reach a global audience of over 4 million viewers, with a focus on young people aged 18-24.

Dr Abdel-Fattah is widely respected for her research and commentary around the topics of race, intersectionality and gender, having won Australian Book of the Year for Older Children for her novel Does my head look big in this?.

Christophe Doche is the Executive Director of the Optus Macquarie University Cyber Security Hub and architect of Macquarie’s cyber security degree programs. He recently sat down with 2SER’s Sean Britten to explain why Australia desperately needs more cyber professionals. 

How would you characterise the current need for cyber security workers?

The need for cyber security workers is huge. It’s a big problem, both in Australia and worldwide – we are losing the battle against cybercriminals at the moment.

The cost of cybercrime is estimated to be $4.5 billion in Australia last year. Worldwide, the cost was estimated to be US $450 billion in 2016 and is projected to reach US $2 trillion this year.

So the risks are there. The costs are enormous. And at the same time, we don’t have enough people – there’s a shortfall of skilled people of about 1.5 to 2 million jobs worldwide.

The image that pops into a lot of people’s minds when we talk about cyber security would be Russian hackers interfering in the last US elections, or fears that China could do the same here in Australia. Is the web becoming the new battleground for nations?

Absolutely. It is the battleground right now. It’s much more convenient to do a ransomware attack than it is to go and rob a bank with a gun.  Why would you send troops when you could send a virus?

In 2010, for example, there was a virus called Stuxnet that was used to take out nuclear capabilities in Iran. It’s very hard to know who was responsible for the attack – was the US, was it Israel? We’re still not sure. Similarly, a couple of years ago, before Russia invaded Ukraine, they first took out all the critical infrastructure with a cyberattack.

So, is digital the new battleground? Absolutely, and it’s only going to get worse.

How equipped is Australia, as a country, to deal with this new battleground?

I would say that Australia is not any different to other countries in the world – struggling with these very complex issues.

What we see is that people in Australia are not very prepared. I talk to a lot of people and I think it probably comes from the fact that we live in a relatively safe country – we are on an island, separated from the rest of the world,  and we tend to translate our physical security into digital security, which is completely not applicable. Digitally, we’re at the doorstep of Russia, of China. So we’re not at all safe in the digital world, and our behaviour needs to change.

There are some positives – for instance, the NSW Government has a new Cyber Security policy that’s a first step in the right direction. We’ve seen lots of investment coming from Federal government, with the launch in 2016 Cyber Security Strategy which was the first step to develop this industry.

So, there’s lots of work to do, but I see lots of positives as well.

Currently, most current cyber security workers have come from different areas of IT. Does this present a problem, not having a specific security background?

I think the best mix includes some strong technical capabilities, but that’s not enough. Because cyber security is not just an IT issue – it’s a business risk. So, you have to add something else – it could be law, business acumen, financial risk understanding. criminology, psychology…

Psychology is very interesting because the human factor is crucial. Studies have shown that more than 60 per cent of breaches have come from a human error – whether it is intentional or an accident ­– from the people working in the organisation. If you understand the way humans behave, you have a chance to design safer systems.

All these characteristics [of cyber security] lead to a very broad range of careers, and people from a very broad range of backgrounds can be successful in these industries.

The good thing about the Cyber Security Hub at Macquarie is that all disciplines are connected, so we can teach both the technical and soft skills in an integrated way. For example, in our Introduction to Cyber Security unit, students are taught by academics from three different disciplines – computing, business and criminology. We really want to tackle cyber security as a complex and interdisciplinary issue.

To learn warfare, people would often play war games. If we’re talking corporate and governmental warfare here, I’m wondering if there’s a comparison there…?

Absolutely. Simulation is a very powerful way to make people realise the impact of a potential breach. We’re working on an event at the end of the year where we will do exactly that – bring people from corporate to go through a full-day simulation of an attack, and then learn from that.

You’re training students to hack, in order to teach them how to defend against hackers. Is there a fear that they could cross to the ‘dark side’ and become black hats themselves?

There is absolutely this fear – it’s real. We are equipping students with scary skills.

One way to respond to that is to bring the question of ethics absolutely every time, everywhere – we reinforce the importance of ethics at every opportunity.

But actually, what I’ve seen is quite the opposite. We’ve managed to rescue a few students who might have crossed that line in the past. But everything changes once they see that they can apply those skills for the greater good, once they realise that there is a possible career in what they enjoy doing. They see the incredible demand. We have industry speakers coming to our lectures and presenting their work and company to our students and they say, “we have ten jobs to be filled tomorrow – we need people right now.”

Given the large gap in the cyber security workforce, how are you going about attracting students into this area?

We’re quite successful – or programs have grown very rapidly. In 2017 we had 70 students across the whole year and this year we have 140 in Session 1 alone. So, there’s a lot of interest.

The tougher question is how to attract more females. The good news is we went from 10 per cent to 20 per cent female in our programs, but it’s about the tireless work of explaining the opportunities and having role models that can show them there is a pathway. Out of our six Optus-sponsored scholarship holders, four are women, and we have PhD students and of course academics that are women. We can use these good stories to bring more women into the mix.

There will be enormous rewards for any student who is brave enough to take the leap.

On 24 June, news broke of a sustained attack on the UK’s parliamentary email system. Details are sketchy, as they always are with disclosures of security breaches – the victims don’t want to reveal particulars before they have had a chance to fix any vulnerabilities.

On the basis of publicly available information, a confident attribution will have to wait on an analysis of the tools, techniques and procedures (TTP) used by the attackers, such as any malware they have installed into compromised systems, or the internet addresses of command-and-control servers or phishing sites used in the attack. Analysts will also examine the timing of events and the time stamps on malware files – these often align with business hours in the time zone where the hackers are based.

However, hacking groups associated with Russia, such as FANCY BEAR (APT* 28) and COZY BEAR (APT 29) have previously shown strong interest in politician’s emails. The public statements and privately-expressed views of politicians are not always perfectly aligned, and emails might reveal juicy material which can be released to embarrass or compromise (Russian term: kompromat) either individuals or parties. These two groups are believed to be behind the breaches of the US Democratic National Convention and subsequent release of emails in an attempt to embarrass the Clinton campaign and to align Sanders’ supporters against Clinton.

In the case of the UK parliamentary email system, the attack has been described as ‘brute force’, in which the attacker simply uses a program to repeatedly attempt to log on, cycling through a long list of likely passwords. This is different from FANCY BEAR and COZY BEAR’s previous attacks, which have mainly relied upon phishing attacks, in which the victim is lured to a fake webmail site which is then used to capture his or her credentials. In the brute force attack, it seems many Members of Parliament had chosen weak and easily guessed passwords which were quickly compromised, leading to the entire email system being shut down.

In France, Emmanuel Macron’s election campaign staff expected that their emails would be targeted, so they deliberately created some fake emails. Then, when they were released to WikiLeaks, they could point to the fakes and ask which others are faked? And by whom?

However, at this stage, it would be premature to rule out other countries – many countries have offensive cyberwarfare capabilities (for example, PLA Unit 61938 and Israeli Unit 8200).

It would also be unwise to assume that these state-sponsored actors are only interested in high-profile targets like governments, political parties and defence institutions. North Korea’s Unit 180 is believed to be behind the recent WannaCrypt ransomware outbreak, using code they adapted from the NSA’s EternalBlue exploit recently leaked by the ShadowBrokers group. And just recently, yet another piece of ransomware called GoldenEye or Petya is rapidly spreading – once again, derived from EternalBlue, but this time, having started in Ukraine is probably of Russian origin.

No matter who is behind this, and no matter whether you are a direct target or just collateral damage, the defensive techniques are the same:

1. Implement two-factor authentication, using Security Keys like the YubiKey or authentication apps on phones – for example, Google Authenticator. This is particularly important for email accounts, since ‘password forgotten’ procedures typically work by sending a link to your email account, and if the attackers have access, they can reset passwords on other accounts. With two-factor authentication enabled, they might be able to get your password, but they don’t have the other factor.
2. Security education and awareness – not clicking on links in emails and not opening email attachments.
3. Filtering of emails on corporate firewalls. For small and medium businesses, use Google GSuite, Microsoft Office 365. They’re much better at detecting attacks than most companies can manage with their own resources.
4. Ensure you have a good backup regimen. That means any backup should be offline ­– unplugged and disconnected where the ransomware cannot get to it. Many cloud storage services (for example Google Drive) just looks like another drive to ransomware, so it will encrypt what it sees there. And take care with automated backups – you don’t want the encrypted files to be backed up, thereby over-writing the good backup copies.

*Advanced Persistent Threat. The different APT’s are numbered by the various private security companies as they are discovered. APT 1, for example, is a Chinese PLA unit in Shanghai.

“I clicked on the link in the email, which asked me to update my account details,” he says. “Before I knew it, hackers had my OneID password and other details.”

“Phishing is not only dangerous to organisations but also to individuals,” says Jeremy Koster, Information Security Manager at Macquarie University’s IT Department.

Phishing, in which a malicious communication attempts to obtain personal or sensitive information, is one of the most common cyber-attacks. Emails are often poorly worded, ask for a username and password, and provide a link that does not lead to an official website address like mq.edu.au.

“When criminals get access to valid usernames and passwords they may obtain access to confidential University information or even damage University systems,” says Jeremy.

He recommends taking the following steps when receiving a suspicious email:

• Immediately forward the email to help@mq.edu.au
• Do not click on any links or attachments
• Do not provide your OneID login details. Never share your password.
• If you have provided your login details, reset your password at the staff password portal and let the IT Service Desk know.

For more information, see the Information Security and Acceptable Use of IT Resources policies.

Stay tuned for more cyber security tips during 2017.

In an effort to ensure the cyber security of all staff and systems, staff will receive a link via an MQ Announcement on Monday 5 December to reset their OneID password. University devices, smart phones and tablets and any saved passwords will require updating after the password change, which must be done before 5pm Monday 12 December.

Josef Oduwo, Director of Policy, Compliance and PMO at the Macquarie University IT Department, says this reset will improve the cyber security of Macquarie’s systems.

“Computer Security is important,” he says. “The IT environment, platforms and systems are constantly evolving and we encourage staff to continue taking a risk-based approach to how they secure and use their computers at work and at home.”

These changes are part of a series of required improvements to cyber security endorsed by the Vice Chancellor’s Executive Group.

“The one-off password change to ensure a stronger password, coupled with the introduction of a new self-service password reset capability, is the first of these improvements concerning access management,” he says.

The recently updated Information Security Policy provides more information on the change. For a list of frequently asked questions and information on password requirements, see here. Extra staff will be on hand to assist those who do not change their password before 5pm Monday 12 December. Faculty/Office IT representatives will be on hand to answer any questions.

The IT department appreciates the continuing commitment of staff to cyber security and their cooperation with this change.

Macquarie University and Optus Business have joined forces to establish a multi-disciplinary cyber security hub to support businesses and government to recognise and protect themselves from increasing cyber threats.

Highlighted in yesterday’s Australian Financial Review, the ‘Optus Macquarie University Cyber Security Hub’ will be located on campus and provide research, professional courses and consultancy services to the private sector and government agencies.

The hub represents a $10 million investment by Optus Business and Macquarie that will draw on the expertise of Optus, other industry experts and leading academics from three key academic areas: Science and IT; Business and Economics; and Security Studies and Criminology. It will focus on providing a holistic approach to cybercrime, how it is perpetrated, how it affects the economy and how it impacts policy.

Supporting the Federal Government’s recent cyber security strategy – which outlines plans to make Australia a cyber-smart nation – the new hub will also include a range of initiatives to enhance our teaching and research offering, including degree courses.

Professor David Wilkinson, Deputy Vice-Chancellor (Corporate Engagement and Advancement) says education is the cornerstone of any cyber security strategy.

“Cyber security has become one of the defining issues of this decade, which is why Macquarie was one of the first in the country to establish a dedicated policing, intelligence and counter-terrorism degree,” Professor Wilkinson notes.

“The opportunity to partner with Optus, an organisation that deals with cyber threats and challenges on a daily basis, was something we welcomed as it enables us to improve cyber security education at all levels – from the C-level executive through to every employee.

By collaborating within both the University and with industry to tailor our study programs, we give our students a head start in their careers, placing them at the top of Australia’s cyber security talent pool. These initiatives will also work to support the wider expansion of cyber security training within organisations to better secure and protect their networks and infrastructure.”

Find out more about the Optus Macquarie University Cyber Security Hub.