@Slew confirm medicare or medibank?

Security is always a balance of defence level vs usability, as one increases, the other decreases, ie add more steps as a layer of defence, the service or thing becomes more difficult to use.

You can have extra pre paid mobiles/email accounts that ensure certain services have different contact details.

You can use 3FA if offered.

You can have a credit card with both visa and mastercard to protect against outages or fraud lockouts.

You can have bank accounts with different instuitions (anz and cba) to ensure you always have some funds available.

You can devise a fake family tree and backstory for yourself, so you don't answer 'mothers maiden name' or 'great grandpa's first name' with actual data that can be found.

You can go deep down the rabbit hole....

@reddogaustin

Thanks my mistake Medibank, but who knows re medicare.....

Yes, that is the issue, it is impossible to operate in this world without being super connected.

I'm actually already doing most of the above, I guess my main concern is identity theft accessing credit in my name and how I protect against that. I recall reading some time back this was a big chunk of online fruad.

Good discussion. The capitalist in me is actually more positive thinking about this issue than most.

I am a believer in the view that business traditionally performs better than govt, for myriad reasons. We want business to be motivated by self interest -- considering fresh ideas, pushing barriers to achieve technological innovation and genuinely trying to have a positive impact on the world. Govt struggles to do all of these things, particularly the first two points.

But I am also of the view that a business needs to be able to manage their own security and protect their customers -- and when they don't -- they must face the consequences and be held accountable. I remain of the opinion that a good portion of our business leaders in Australia don't fully understand the implications of a cyber attack, and the importance of protecting your customers. But the recent cyber attacks on Optus and Medibank have sent shock waves through industry and leads me to believe this is finally changing. The week after the Optus attack, we had 8common's CEO speaking on this very platform, indicating a primary risk to their business was a cyber attack. Leaders increasingly speaking about this is good for society. We want business to be petrified of the consequences and do everything in their power to prevent it. After all, they have a very good reason to do so: cyber attacks are incredibly damaging to one's brand and reputation, but are also bloody expensive (think class actions, legal battles, fines, criminal demands etc). Further to brand and financial implications, research suggests businesses impacted by cyber attacks underperform the market -- not just short term, but over 2, 3 and 4 years. This probably speaks more to how badly an attack can damage a business' reputation, but CEOs are bound to pay more attention to something that can have such a serious impact on the share price over the long term.

We should be happy that companies are currently scrambling to improve their online security mechanisms. It is long overdue, and they have a genuine duty of care to protect customer information in their possession. I also think it will lead to standardised encryption across the board, in time. But for now, we should watch with glee as businesses at last finally start to give data breaches -- and trying to prevent them -- the thought and resource it deserves. Even better, we are now starting to talk about how long a business should keep your data for -- I think we will reach a point where unnecessary storage of old customer information is forbidden, or at the very least regulated more closely.

But @Slew, on an individual level, my advice would be to give your data to only those who are reputable, innovative and progressive -- companies that devote staff and resource to protecting customer data and speak publicly about the issue. Easier said then done, I know. You can criticise the big-4 in Australia for many things, but they spend lots of time and money on protecting their customers. We have the luxury of being able to vet, pick and choose where we give our data. Pay particular attention to those that require passports, drivers licence and other important identifiers. Do they have a genuine need? I also agree with @slymeat, never click links over email, always use a reputable password manager/generator and only use businesses that will at the very least provide 2FA verification. Perhaps most importantly, protect your primary email like your life depends on it -- this should have 3FA and ideally use an authenticator app (as opposed to SMS verification).

I realise this is very much a rant now, but in short, I think we will look back on these cyber events in five years and acknowledge the importance of them -- because it will mark the point in time where we got serious about managing and protecting data online.

@Rocket6 good point on the wake up call to companies

I just listened into the VHT investor call, Cyber security was the 2^nd question in Q&A and received a detailed response.

Paraphrasing Terri:

• Major focus of company
• This is an area of the company she plays an active role in
• Internal company training in security measures including test phishing to gauge responses and regular security audits
• Meeting ISO/FDA regulation
• Consider smaller vendors main vulnerability
• US Customer feedback from vendors they work with consider their measure above the average.

Yep and point taken on the big 4 as well

I agree with @Rocket6 , regarding @Slew 's concern around id fraud/theft.

There is only so much the individual can do, as you don't hold/maintain the systems holding the data. I think government should threaten and enforce cyber security to the point where business will secure themselves, in addition to what they would want to do anyway, as a smart business genuinely understands 'risk'.

Some of the mitigations i suggesed above can help you id where the fraud is when it occurs and minimises the risk to your other digital components. I.e. having a different email and phone for banks vs super may limit the damage caused by a fraud event.

Choosing to never use your drivers licence as an id, and only use passport, as the number changes each expiry etc is a choice.

The data you share on social media, can be harvested and stitched together to steal your id.

The rabbit hole is deep. It may be easier to live off grid with a shot gun and chickens.

Funny enough, the area of most concern to me is the government apps and government systems. For example the new NSW service app which we used to covid check-in, and now they are asking us to link drivers license and pensioners card etc.

My concerns:

1) There is little I can do about protecting my privacy here. Fake names and fake dates of birth are not an option.

2) The system is huge and able to be accessed by thousands of employees and contractors across the board. It only takes one bad apple.

3) The systems are increasingly being linked up. Medical, Tax, Social welfare ... and now the newest covid info about where I shop and where I go.

4) Please correct me if I'm wrong, but I don't remember 2FA for my phone app. That should at least be a minimum.

@Hands you're right to worry. Ever met a government worker? Hahaha

I would offer you can't do a lot, except be vigilant for changes and try to shut down fraud attempts/actions early.

You can't use fake details for the account info true, but you can use fake details for security questions, and you can segregate your other financial and software systems by using separate accounts, emails, passwords, phone number etc, to further limit or contain damage during an incident. You can also rotate your details on a specific timeline, change your email and phone number every 6 months, meaning leaked data becomes less valuable... but I would direct you to my original post about balancing security vs usability.

But yes, other than a few actions, we the users must trust that governments are spending money on cyber security, and hiring, vetting, and training their government drones to not increase the risk surfaces for cyber atttackers.