Telstra released its 2017 Cyber Security Report ^[1] this week, and it seems that cyber threats are continuing to grow at a considerable clip. The report, based on Telstra’s own data and results from 360 business surveys conducted across Australia and Asia, notes that 59% of businesses detected a serious cyber incident in 2016, more than double the 2015 figure of 24%. Ransomware was the most common type of malware, with 60% of respondents admitting it has affected them at least once in 2016, of which 57% paid the ransom. Of that 57%, one third didn’t receive their files after making the deal. Promisingly, research found that C-suite executives are apparently taking greater responsibility ^[2] for cyber incidents, and IT security spending increased in 95% of responding organisations.

In a new step to address cybercrime, ANZ has announced a pilot of voice biometrics ^[3] to authorise high value payments through the bank’s mobile app. ANZ has worked with Nuance ^[4] to introduce the technology, building on that company’s work with Domino’s Pizza ^[5], which in a further indication of civilizational decay has enabled customers to order pizza through voice commands. ANZ also offers customers the option of using Apple Pay, the only Big Four bank to do so.

This week the other three big banks lost their bid to the Australian Competition and Consumer Commission (ACCC) ^[6] to allow collective negotiations with Apple on Apple Pay. Commonwealth Bank, NAB and Westpac, along with Bendigo and Adelaide banks, wanted access to the near-field communication chips (NFC) ^[7] in iPhones, with a deal they already have in place with Android. They were also hoping to use their collective bargaining power to overcome Apple’s restriction on banks passing on Apple Pay fees to customers. The ACCC listed ^[8] negative implications for how Apple competes with Google, and that open NFC access may inhibit innovation as reasons for rejecting the application.

Germany announced the establishment of a new Cyber and Information Space Command ^[9] within the Bundeswehr. The new command, to be based in Bonn, will employ 13,500 personnel by July this year, before reaching 14,500 by 2021. The command will be responsible for the security of Bundeswehr networks, cyber threat intelligence and the development of offensive cyber capabilities which can only be used with parliamentary approval ^[10]. The Command’s announcement comes at the same time as increasing concerns in Germany about Russian cyber interference in German critical infrastructure and democratic processes, ^[11] with the defence ministry citing the 284,000 complex cyber incidents recorded in 2017 so far on Bundeswehr networks.

Singapore’s Ministry of Defence has admitted that a cyber security breach on its network, which was noticed earlier this year, lasted several weeks before it was detected ^[12]. The breach, which previous reporting has suggested was probably state sponsored ^[13], affected the Ministry’s personnel system, stealing the personal information of 850 military and civilian employees. And the US Department of Defense has been slammed by Democrat Senator Ron Wyden ^[14] for failing to implement STARTTLS ^[15] encryption for email. STARTTLS has been adopted by the FBI, NSA, CIA and Director of National Intelligence, but it’s only effective when both recipients use the technology.

Also in the US, the Department of Commerce has removed Chinese IT company ZTE ^[16] from an export blacklist after it admitted to violating sanctions on Iran. Commerce has been investigating ZTE for five years, threatening the company’s access to US supply chains, after it discovered an elaborate scheme to evade sanctions. The company’s former CEO was accused of using shell companies to import US made equipment, integrate it with ZTE products ^[17] and sell it to Iran in direct violation of US sanctions on technology transfer. ZTE agreed to pay US$900 million in fines and to a three year probation period. If you’re after a bit of additional reading on China, The CipherBrief has a great series this week on Chinese cyber capability, including pieces from RAND’s Martin Libicki ^[18] and FireEye’s Christopher Porter ^[19].

In brief news this week, Kaspersky Lab has added to the growing suspicion ^[20] of North Korea’s role in last year’s SWIFT cyber heist, releasing a new report on the Lazarus group ^[21]. The report directly links the group to an IP address in North Korea, noting that it’s the most direct evidence they’ve seen of the link between Lazarus and the DPRK. Singapore updated its cybercrime legislation on Monday ^[22], adding new offences for dealing in personal information gained through hacking and dealing in hacking tools, while the New Zealand government has been criticised ^[23] for withdrawing the sole NZ Police representative from Interpol’s Global Complex for Innovation in the city-state. And finally the IAAF has pointed the finger at Russian hacking group Fancy Bear ^[24] for the theft of athlete information in February, however Reuters noted that ‘Fancy Bear could not be immediately reached for comment.’