Latest / Tech Talks With Kinsoft / NSW Treasury Insider Breach – 5,600 Sensitive Documents Exfiltrated

Transcript

NSW Treasury Insider Breach – 5,600 Sensitive Documents Exfiltrated · Tech Talks With Kinsoft

0:00
Welcome to Tech Talks with Kinsoft. So picture
0:03
this, you know, it's a quiet Sunday afternoon.
0:06
Right, the time when absolutely nothing is supposed
0:08
to be happening in a government office. Exactly.
0:10
But suddenly, the New South Wales Treasury's
0:13
internal security alarms just, well, they go
0:16
off. Which is never a good sign on a Sunday.
0:18
Oh, definitely not. Yeah. But here's the really
0:20
wild part. The threat they detected, it wasn't
0:23
coming from like a Russian server farm. Right.
0:26
It wasn't some dark web syndicate trying to...
0:29
brute force of firewall, the call was actually
0:32
coming from inside the house. Yeah, the worst
0:34
kind of call. Totally. So today we are unpacking
0:37
this massive cybersecurity incident where a trusted
0:41
insider, I mean, someone who already worked there,
0:43
almost walked out the front door with over 5
0:45
,600 highly sensitive government files. And,
0:48
you know, we're going to talk about why it took
0:50
a lightning fast, like a 24 -hour multi -agency
0:53
strike force to actually stop him. Because it's
0:56
a case that really... fundamentally rewrites
0:58
how a lot of organizations need to think about
1:01
their threat landscape. I mean, traditionally,
1:03
we think of cybersecurity like a medieval castle,
1:05
right? Oh, absolutely. You build the walls as
1:08
high as possible. Right. You build high, impenetrable
1:10
walls. Yeah. But this incident isn't about someone
1:13
breaching the walls. What happens when the threat
1:15
is just, well, someone who already has the keys
1:17
to the castle? Well, when the attacker already
1:20
has legitimate credentials, all those external
1:22
defense mechanisms you've spent millions of dollars
1:25
on, they instantly become totally irrelevant.
1:29
Which is exactly why we need to talk about this
1:32
today. Because if you are managing an IT stack
1:35
or, I mean, even just running a business where
1:37
your employees handle sensitive data, this scenario
1:40
is your absolute worst nightmare. Oh, without
1:43
a doubt. So let's look at the facts based on
1:45
the public statements from the NSW police and
1:48
the state's treasurer, Daniel Mookie. We're looking
1:51
at an incident where a 45 -year -old man, an
1:53
employee, allegedly executed this massive data
1:57
exfiltration to an external server. Right. And
2:00
we should point out he had been with the Treasury
2:01
for about three years. Three years. So not a
2:03
newbie. No, not at all. And that three -year
2:07
tenure is a critical detail, you know? This wasn't
2:10
a new hire making some clumsy mistake during
2:13
their first week of onboarding. Yeah, clicking
2:15
the wrong button or something. Exactly. This
2:17
was someone with an established track record,
2:19
a known entity within the organization. So they
2:22
had a history, right? A baseline of normal behavior
2:24
and established relationships with the actual
2:27
systems they were using every day. Which makes
2:29
the whole detection part of this event so fascinating
2:32
to me. Because the treasurer... specifically
2:35
revealed that this wasn't caught by like the
2:38
perimeter defenses blocking a hacker. Right.
2:41
It wasn't the firewall. Yeah, it was flagged
2:43
by what they called internal security monitoring.
2:46
But I kind of want to push back on the simplicity
2:47
of that phrase because. Internal security monitoring
2:51
sounds like a security guard just watching a
2:53
CCTV feed, you know. Yeah. Sipping coffee and
2:56
staring at a screen. Exactly. Yeah. But technologically
2:59
speaking, I mean, if an external firewall is
3:02
like a bouncer at the front door, is internal
3:04
monitoring more like a bank vault alarm? Yeah.
3:08
Like it triggers not when someone breaks in,
3:10
but when a trusted employee tries to carry too
3:13
much cash out. That's a really great way to put
3:16
it, because it is incredibly complex. The traditional
3:19
security model is essentially, as you said, border
3:21
control. Right. You check the passport at the
3:24
perimeter. And if the passport is valid, meaning
3:26
the username and password are correct, the person
3:30
is just allowed in. They're in the country. They're
3:32
in. But insider threat monitoring operates entirely
3:36
differently. It doesn't care about your passport.
3:38
It cares about your behavior once you're inside.
3:41
It's more like it's like the IRS audit. your
3:44
spending habits after you already live in the
3:46
country. Oh, wow. OK. Right. Like it doesn't
3:48
care that you're a citizen. It cares that a mid
3:51
-level manager suddenly bought like three luxury
3:54
yachts in cash. OK. That makes perfect sense.
3:57
So the system isn't authenticating identity anymore.
3:59
It's authenticating behavior. Precisely. And
4:02
the technology driving this is typically called
4:04
user and entity behavior analytics or UEBA. UEBA.
4:08
Yeah. And these systems. They spend weeks or
4:12
even months purely observing. They just watch.
4:14
And they build a unique behavioral fingerprint
4:17
for every single user on the network. So it's
4:19
basically learning everyone's daily routine.
4:21
Exactly. It learns that, say, employee A logs
4:24
in at 8 .30 a .m., typically accesses the HR
4:27
database, maybe downloads 10 megabytes of PDF
4:31
files a day, and then logs out at 5 .00 p .m.
4:35
That is their established baseline. Right. So
4:37
if employee A suddenly logs in at, I don't know,
4:40
2. a .m. on a Sunday and starts pulling gigabytes
4:43
of data from a completely different department.
4:45
The system sees the yachts. Right. The system
4:47
sees the three luxury yachts. Exactly. It flags
4:49
the anomaly immediately. And in this specific
4:52
NSW Treasury case, the trigger was the alleged
4:55
transfer of a substantial cache of documents
4:57
around 5 ,600 files actually to an external server.
5:01
5 ,600 files? I mean, that's a lot. It's massive.
5:04
Opening 50 files over in an eight -hour shift
5:07
on a Tuesday? That's normal workflow. but packaging
5:10
5 ,600 files and attempting to route them to
5:13
some unrecognized external IP address on a Sunday
5:17
afternoon. Yeah, that's not normal. No, it's
5:19
a critical deviation from the baseline. Okay,
5:22
but let me play devil's advocate here for a second,
5:23
because I can hear IT administrators listening
5:26
to this, and they're probably thinking about
5:28
false positives. Oh, the bane of every IT admin's
5:32
existence. Right, because if you tune an algorithm
5:34
to flag anomalies, doesn't the security team
5:37
just get absolutely burnt? Buried in alerts every
5:40
time someone has to, like, do a massive quarterly
5:43
report or archive a giant project folder? Yeah,
5:46
they do. So how does the system know this specific
5:48
external transfer was actually malicious and
5:52
not just, you know, an employee trying to catch
5:53
up on work from home over the weekend? Well,
5:55
that is the exact friction point of internal
5:58
monitoring. If the system is tuned to be too
6:00
sensitive, you get alert fatigue. Right. The
6:03
boy who cried wolf. Exactly. And then the security
6:05
team just starts ignoring the warnings. But if
6:08
it is too loose, well, 5 ,600 files just walk
6:12
right out the door. So how do you find that balance?
6:14
The way modern systems solve this is through
6:16
context and risk scoring. It isn't just one single
6:20
metric that triggers the big alarm. It is the
6:22
confluence of multiple high -risk indicators
6:25
happening all at once. Okay. What kind of indicators
6:27
are we talking about? Give me an example. Well,
6:29
think about the data itself. A robust environment
6:31
also uses data loss prevention or DLP tagging.
6:35
Okay. So every file is basically tagged based
6:38
on its sensitivity level. The system isn't just
6:40
saying, hey, this user is moving 5 ,600 files.
6:43
Right. It's more specific. Much more specific.
6:45
It's saying this user is moving 5 ,600 files
6:48
and 80 % of them contain metadata tagged commercial
6:52
and confidence. Oh, wow. Yeah. And it's also
6:55
saying the destination IP address has absolutely
6:58
no known association. with our authorized government
7:01
vendors, and this is all happening outside of
7:04
typical business hours. I see. So it's the compounding
7:07
factors that create the conviction. It's the
7:09
sheer volume plus the high sensitivity of the
7:11
tags plus the weird destination plus the weird
7:14
timing. Exactly. Each of those individual factors
7:18
adds points to a total risk score. And when that
7:22
score crosses a certain critical threshold, the
7:25
alert isn't just a passive log entry that someone
7:28
might check tomorrow. It's a flashing red light
7:31
right now. It's alarms ringing everywhere. Well,
7:33
let's talk about the specific data involved here,
7:36
actually, because that really explains why this
7:38
alert was treated with such intense urgency by
7:41
the government. Definitely. This employee, the
7:43
45 -year -old guy, he wasn't working in just
7:46
some generic administrative role. He was actually
7:49
part of the Treasury's commercial team. Right.
7:52
So what does that actually mean in terms of the
7:54
kind of information he had legitimate access
7:56
to? Well, the commercial team within a state
7:58
treasury, I mean, they are the financial engine
8:00
room for government operations. OK. They do not
8:03
just manage like internal payroll or office supplies.
8:06
They're intimately involved in the state's commercial
8:09
relationships and their biggest transactions.
8:12
We are talking about highly delicate, high stakes
8:15
negotiations with the private sector. So basically
8:18
the financial blueprints of exactly how the state
8:20
does business. Yes, exactly. And Treasurer Mookie
8:24
emphasized that these files spanned multiple
8:26
NSW government departments and various massive
8:29
projects. This team handles 10. I mean, if you
8:41
were an outside commercial entity, right, like
8:43
a private company bidding for a billion dollar
8:46
government contract, knowing the states. internal
8:49
pricing models and their bottom line leverage,
8:51
it's basically a cheat code. Oh, it's incredibly
8:54
valuable intelligence. It is an absolute goldmine.
8:56
And honestly, that brings us to the hardest problem
8:58
in all of information security. Which is? The
9:00
dilemma of authorized access. Because of his
9:03
specific role on the commercial team, this employee
9:06
had legitimate, completely required access to
9:09
these files. He literally needed to open them,
9:11
read them and process them just to do his daily
9:14
job. I'm just trying to wrap my head around how
9:17
difficult that makes the IT team's job. Because,
9:20
you know, to the operating system, his login
9:22
is perfectly valid. His permission levels are
9:25
completely correct. The computer is just saying,
9:26
yes, you are authorized to view this tender document.
9:30
Exactly. So the line between an employee diligently
9:33
doing their job by reading a contract and an
9:36
employee stealing the state's financial leverage
9:39
is just. It's paper thin. It is entirely behavioral.
9:42
That's the only difference. You cannot use a
9:44
traditional padlock to stop this because the
9:46
employee holds the master key to the padlock.
9:48
Right. And this is exactly why the suspected
9:51
transfer to an external server is the defining
9:53
action here. The security system doesn't necessarily
9:56
flag the fact that he accessed the files. It
9:58
flags the exfiltration. Moving of the file. Yes.
10:01
It notices the digital supply chain suddenly
10:03
rerouting to some unauthorized unknown warehouse.
10:06
And because this data held the literal fight.
10:09
leverage of the state, an anomaly like that wasn't
10:12
going to just generate some generic IT ticket
10:15
to be reviewed over coffee on a Monday morning.
10:17
No, absolutely not. It triggered an immediate
10:19
crisis, which really explains the sheer velocity
10:22
of the government's response. Because when you
10:25
look at the timeline provided in the public statements,
10:28
it is genuinely staggering. The timeline is a
10:31
literal masterclass in incident response. I mean,
10:34
the internal monitoring system detected the transfer
10:37
and the breach was reported to the NSW police
10:40
on a Sunday. And we really need to pause on that
10:43
for a second. A Sunday. Yeah. Usually you think
10:45
of massive bureaucratic government processes
10:48
just grinding to a complete halt over the weekend.
10:50
Like you assume an alert on Sunday afternoon
10:53
just sits in an email queue until nine zero zero
10:56
a .m. Monday. Yeah. In a legacy system. Sure.
10:58
But. Not in a mature security operations center.
11:01
An alert of this severity involving commercial
11:04
treasury data triggers an automated escalation
11:07
immediately. And the response from law enforcement
11:10
was just as immediate. By Monday, literally the
11:13
very next day, the NSW Police Cybercrime Squad
11:16
and a specialized unit called Strike Force Civic
11:19
were fully operational. That's crazy fast. It
11:23
is. They tracked down and arrested the 45 -year
11:25
-old man right in the middle of Sydney's CBD.
11:28
I mean, to go from a system alert on a Sunday
11:30
to a physical arrest in the city center on Monday
11:33
is practically unheard of. It really is. Because
11:36
we constantly see... headlines about these infamous
11:38
corporate breaches where attackers just linger
11:41
inside a network for six, eight, sometimes 12
11:44
months. Yeah, just dwelling in the network. Exactly.
11:46
They quietly siphon off data and the company
11:49
only finds out a year later when the FBI knocks
11:52
on their door or, you know, worse, when their
11:54
data pops up for sale on the dark web. So how
11:57
does a government agency actually achieve a 24
11:59
-hour turnaround like this? Well, it proves the
12:02
absolute necessity of preparation and automation.
12:05
You do not execute a Sunday to Monday takedown
12:07
involving the Treasury, the Cybercrime Squad,
12:10
and a dedicated strike force simply by winging
12:13
it. Right, you can't just make it up on the fly.
12:15
No. This requires highly sophisticated security
12:18
orchestration, automation, and response platforms.
12:22
Or SOR platforms. Okay, SOR. Break that down
12:26
for us. What does an automated response actually
12:29
look like in those critical first few minutes
12:31
after the alarm goes off? Sure. So when that
12:34
UB best system we discussed earlier flags the
12:36
critical risk score, it doesn't just send an
12:39
email to an admin. A SO platform will automatically
12:42
execute a predefined containment playbook. And
12:46
without waiting for a human analyst to wake up
12:48
and approve it, the system likely isolated the
12:51
employee's endpoint right then and there. So
12:53
it just cuts them off. Exactly. It severed the
12:55
machine's connection to the broader network and
12:57
the internet, immediately stopping the external
12:59
transfer in its tracks. Wow. So it essentially
13:02
freezes the device in time. Yes. It quarantines
13:04
the threat instantly. And then it alerts the
13:07
on -call security leadership. The fact that the
13:10
NSW chief cybersecurity officer could immediately
13:12
step in and coordinate a whole of agency response
13:14
means the connective tissue between the IT department,
13:17
the agency leadership, and law enforcement was
13:20
already built. They had run the drills. Exactly.
13:22
They had run the drills. Everyone knew their
13:24
role. The literal second the alarm went off.
13:28
And I think the physical law enforcement action
13:30
is just as crucial as the digital containment
13:33
here. Because while Strike Force Civic was arresting
13:37
the suspect in the CBD, police were actually
13:40
simultaneously executing a search warrant at
13:42
a home in Homebush West. Right. And during that
13:46
raid, they seized electronic devices. Right.
13:48
And the police statements explicitly noted. they
13:51
seized a hard drive. And that is the physical
13:53
manifestation of neutralizing the threat. Because
13:56
in cyberspace, data can be infinitely replicated.
13:59
Yep, just copy and paste. Exactly. You can lock
14:01
down the network all you want, but if the exfiltrated
14:03
data is already sitting on a hard drive in someone's
14:06
living room, well, the breach is still active.
14:08
Yeah, you can't just delete a server log to hide
14:11
your tracks when the police physically kick in
14:13
the door and confiscate your actual storage media.
14:15
Precisely. Securing the physical hardware is
14:18
really the only way to ensure the data doesn't
14:21
make it to a secondary buyer or get leaked publicly
14:23
online. Right. And following the raid, the man
14:26
was officially charged with accessing and modifying
14:29
restricted data held in a computer. He was granted
14:31
conditional bail and he was scheduled to appear
14:34
before the Downing Center local court on June
14:36
3. But, you know, the police action is really
14:39
only half the battle. While Strike Force Civic
14:42
is handling the suspect and bagging the physical
14:44
drives, what is actually happening back at the
14:47
Treasury? Because if I'm a citizen or a private
14:50
business currently negotiating a big contract
14:52
with the state, I am terrified about the fallout
14:55
of this. Of course. But the government's containment
14:58
response was incredibly reassuring on that front.
15:01
First off, police stated they believe all the
15:03
alleged stolen data was located and is now fully
15:05
secure. Which is the best possible outcome. Absolutely
15:08
the best outcome. Second, they confirmed there
15:10
was no external compromise to the agency's systems
15:13
at all. Meaning while all these internal alarms
15:16
were ringing and chaos was happening inside,
15:18
no outside opportunistic hackers managed to,
15:22
like, slip through the perimeter in the confusion.
15:25
Right. The external defenses held strong the
15:28
entire time. And furthermore, the NSW chief cybersecurity
15:31
officer executed the containment strictly according
15:35
to the state's existing cybersecurity plan. OK.
15:37
And the ultimate result of that highly coordinated
15:40
effort is that they could confidently announce
15:42
there was no current impact on any NSW government
15:46
services. The citizens relying on the state weren't
15:49
disrupted. The infrastructure didn't falter.
15:51
Which really highlights that rapid containment
15:54
is just as critical as prevention. if not more
15:57
so. Definitely. I mean, you might not be able
15:58
to stop a trusted employee from deciding to act
16:00
maliciously on a random Sunday afternoon. But
16:04
if your systems can detect it instantly, freeze
16:06
the endpoint, and get police to secure the physical
16:09
data within 24 hours, you have successfully neutralized
16:12
the threat before the real damage is realized.
16:15
It is a textbook example of organizational resilience
16:17
because resilience isn't about never having a
16:20
security incident. That's impossible. Right.
16:22
It is about your organization's ability to absorb
16:25
the shock, contain the blast radius, and just
16:27
maintain operations without skipping a single
16:30
beat. So synthesizing everything we talked about
16:33
today, What are the core technical realities
16:36
that, you know, every single organization needs
16:39
to take away from this Treasury incident? Well,
16:42
I think there are three primary takeaways here.
16:44
First, the perimeter is no longer the sole battleground.
16:47
The people inside your organization, precisely
16:50
because of their authorized access, pose a massive
16:54
and highly complex risk. The call is coming from
16:57
inside the house. Exactly. Second, it proves
16:59
the absolute necessity of contextual behavioral
17:02
monitoring. Simple rule -based security just
17:05
fails against insider threats. Yeah, because
17:07
they have the right passwords. Right. You need
17:10
systems like UEBA and DLP that actually understand
17:13
what normal workflow looks like so they can immediately
17:15
flag high -risk deviations based on volume, sensitivity,
17:19
and destination. And the third takeaway. Third,
17:21
detection is entirely useless without an automated
17:24
coordinated response. If you detect a breach
17:26
on Sunday but you don't act until Monday morning,
17:29
the data is already gone. Yeah, you need those
17:31
automated SR playbooks to freeze the threat instantly
17:34
and the organizational muscle memory to rely
17:37
on law enforcement right away. It really forces
17:40
a complete paradigm shift in how you view data
17:43
protection. It really does. And you know, that
17:45
actually brings me to a final lingering thought
17:47
for you, the listener, to ponder on your own.
17:50
We have spent the last 30 years in the tech industry
17:53
obsessively focusing on building taller and thicker
17:56
digital walls to keep the bad guys out. Yep.
17:59
But as those parameters become more and more
18:01
impenetrable, the easiest way out is through
18:04
the people who already hold the keys. So will
18:07
the entire future frontier of cybersecurity simply
18:10
become about monitoring the behavior of the people
18:12
we have already decided to trust? It is a really
18:15
challenging reality to confront. But honestly,
18:18
when the technology is perfectly secure, the
18:20
human element becomes the primary vulnerability.
18:23
Trust, but verify, has never been more relevant
18:25
than it is right now. It really hasn't. Well,
18:28
we want to warmly thank you for joining us on
18:30
this episode of Tech Talks with Kinsoft. We hope
18:32
this discussion gave you a sharper perspective
18:34
on the mechanics of insider threats and the reality
18:37
of modern incident response. Yeah. Understanding
18:40
the specific tactics and technologies involved
18:42
is really the crucial first step in evaluating
18:45
your own defenses. Absolutely. And if today's
18:48
conversation has you thinking about the visibility
18:50
within your own networks, we warmly encourage
18:52
you to visit www .kinsoft .com .au. Whether you
18:57
are looking to discuss your personal security
18:59
architecture or you need to explore comprehensive
19:01
IT and security solutions for your business to
19:04
prevent exactly these kinds of blind spots, the
19:06
team at Kensoft is ready to help you build that
19:08
resilience. Thanks again for listening, and we'll
19:11
catch you on the next one.