International Cybersecurity Expert Finds NZ Infrastructure Vulnerable to Hackers

Recent findings from an international cybersecurity expert indicate that New Zealand's critical infrastructure is currently at risk of being compromised by hackers. Over the past few months there have been numerous attacks on New Zealand's IT sector, including one in Decemember 2022 that attempted to bring down the Ministry of Justice and Te Whatu Ora.

Marty Edwards, a former US Homeland Security director, stated that one of the key reasons that criminals are able to exploit vulnerabilities is that many companies are under-investing in their cybersecurity defence. "Many of the vital services that we depend on in our day-to-day lives such as food supply, those systems are increasingly run by small black-box computers that are sprinkled around in things like power grids and water treatment systems. Those systems really were never built with security in mind, and we need to take a hard look at how we secure those types of systems."

As a result of this under-investment, Edwards believed that consumers would end up facing increased costs while firms upgrade their systems. "Ultimately, companies are going to pass along the costs of whatever improvements they're required to make in the cost of their end product. If you're an energy producer that's sending electricity to homes in New Zealand, the cost of the electricity should include some cyber security expenses."

In addition to the usual types of cyber crime seen around the world, Edwards also warned of a potential increased level of 'hacktivism' - a form of Internet-based activism where groups hack websites with the intent of promoting a political agenda or social change. Previous hacktivism attacks included the likes of Operation Payback in 2010, which saw the Anonymous group cripple both Mastercard and PayPal, bringing down many of New Zealand's payment gateways as a result.

According to Edwards, hacktivists commonly work with groups like Anonymous. "These criminal organisations - they just want to make money. If the one way they can make money is by selling their ransomware as a service, they basically put together tool kits. These criminal organisations are run like small companies. They have payroll departments, they have tech support - if the malware or the ransomware that you purchase from them doesn't work, you call their toll free phone number."