Cybersecurity Policy Report, Australian Regulator Sends Letter on Common Weaknesses in Cyber Control, (Aug 15, 2024)
By Tony Foley
The Australian Prudential Regulation Authority (APRA), the regulatory agency responsible for the country’s financial services industry, announced today that it had sent letters to all regulated entities providing insights and guidance on common cyber control weaknesses as part of its ongoing commitment to supervising cyber resilience across the sector.
According to today’s announcement, the guidance details the common issues observed in terms of security in configuration management, privileged access management, and security testing. The APRA expects that regulated entities will review their control environment against the common weaknesses listed in the letter and will promptly address any identified gaps.
Specifically, the letter identifies the following specific items regulated entities should examine in each of the areas outlined above:
Configuration management: Entities should ensure that the configuration of information assets minimizes vulnerabilities, including maintaining controls to manage changes in such assets identifying existing and emerging information security vulnerabilities;
Privileged access management: Entities should maintain complete and accurate records of all privileged accounts and ensure that access is granted only where a valid business need exists and for as long as access is required;
Security testing: Entities should ensure that their security testing program references the population of information security controls across the entity, enables the validation of the design and effectiveness of the controls over time, and leverages a variety of testing approaches informed by contemporary industry practices, and should report testing results to the appropriate body or individual.
News: InternationalLegislation DataSecurity DataPrivacy