Businesses ill-prepared for cyber attacks

Australian businesses are ill prepared for cyber threats, which are becoming increasingly damaging, according to professional services firm Deloitte.

Deloitte's Asia-Pacific cyber risk leader James Nunn-Price says not everything can be secured, but vigilance is important.

Extortion, where businesses were forced to pay a ransom to be allowed access to their systems or threatened with service attacks, was the most common form of attack in Australia.

But stealing and destroying data - a la the devastating hack of Sony a year ago - may be the next frontier.

"I'm seeing far more of that malicious, dangerous attack happening globally, not seeing too much of that here in Australia, but that's certainly on the horizon," Mr Nunn-Price said.

This week Deloitte launched an Australian arm of its chain of Cyber Intelligence Centres.

Mr Nunn-Price said financial services, including banking, finance and superannuation, was the sector most concerned with cyber security, followed by retail.

Energy and infrastructure were the fastest-growing sectors for cyber attacks in Australia.

According to a 2014 Ponemon Institute study, the average cost of a data breach per Australian organisation is more than $2.5 million a year and rising.

For too long Australian companies have relied on looking at internal cyber security, rather than examining potential threats, Mr Nunn-Price said.

"It's like having CCTV inside your house. It's only going to pick up a burglar once they're already inside," Mr Nunn-Price said.

"We're looking not just in the street, but the neighbourhood, the countries around the globe because cyber (security) is this kind of boundless phenomenon."

He said most of the business spend has been on technology solutions like firewalls and anti-virus software.

"Not much has been going into being vigilant and monitoring or responding, and that's the shift businesses here need," Mr Nunn-Price said.