Matthew Gribben

The Office of the Australian Information Commissioner (OAIC) yesterday released guidelines for organisations using third-party tracking pixels on their websites. Important for all business to have their pixel house in order and audit what all these third party tags do, what they collect and know where this data goes. Key points from the guidelines summarised below : Due Diligence: Ensure they are in compliance with the Privacy Act 1988 and Australian Privacy Principles (APPs). Data Minimisation: Collect only the necessary personal information as mandated by (APP 3). Sensitive Information: Obtain explicit consent for collecting sensitive data in accordance with (APP 3). Transparency and Fair Collection: Clearly outline the use of tracking pixels in privacy policies as required by (APPs 1 and 5), avoiding covert data collection. Purpose Alignment: Use collected data solely for its intended primary purpose or a permissible secondary purpose (APP 6). Cross-border Data Flow: Ensure overseas data transfers comply with (APP 8). Direct Marketing Compliance: Enable a straightforward opt-out process for targeted advertising in line with (APP 7). Conduct Audit : of the tracking pixels deployed on your website. Regularly ongoing reviews to maintain compliance and protect user privacy. For further information, visit the OAIC’s official page https://lnkd.in/g_M4dqAB Fitzpatrick Media & Advertising Consultancy #PrivacyLaw #DataProtection #Compliance #DigitalMarketing #TechEthics #CyberSecurity #PrivacyAct #AustralianPrivacyPrinciples #OAIC #DigitalPrivacy #OnlineAdvertising #MarketingTech #RegTech #AdTech #AIGP #AIGovernance

5

Cybersecurity Made Simple for Australian Businesses  Worried about cybersecurity costs? At CisoZen, we believe every Australian business, regardless of size, deserves top-notch protection. That’s why our core plan is completely free, offering easy-to-use self-service tools to quickly boost your cyber health.  For businesses seeking extra support, our paid plans unlock advanced services like Vulnerability Management and Virtual CISO services through our expert partner, Securemation. Whether free or paid, our goal is to make security accessible and effective.  Backed by global certifications like ISO/IEC 27001, OffSec (OSCP, OSEP), and ISA Cybersecurity Fundamentals, you can trust that CisoZen's risk management approach aligns with international standards. Plus, with trusted partnerships like Microsoft and Sophos, our solutions are cutting-edge and dependable.  Let’s work together to make Australia the most secure country by 2030. 💼  🌐 Get started today: https://www.cisozen.com.au #AffordableCyberSecurity #SmallBusinessSecurity #CyberProtection #CisoZen #StaySecure 

7

🚨 Cybersecurity Alert: A staggering 5% of all Adobe Commerce and Magento stores have been hacked, including major brands like Ray-Ban and Cisco. Researchers from the Sansec Forensics Team identified a critical vulnerability, “CosmicSting,” affecting unpatched versions of these platforms. This flaw allows attackers to execute arbitrary code, leading to the installation of web skimmers that capture payment information undetected. Despite warnings, many stores remain vulnerable. If you’re using Adobe Commerce or Magento, ensure your systems are updated and consider key rotation to safeguard against unauthorized access. Stay vigilant! #Cybersecurity #DataProtection #EcommerceSecurity

4

Will be interesting to see how this plays out. 🤔 Australian eSafety regulator gives Internet content/app providers 6 months to come up with an enforceable code to prevent children from accessing inappropriate content, or have a code enforced upon them. “The code should set standards for how app stores, websites including pornography and dating websites, search engines, social media platforms, chat services and even multi-player gaming platforms check that content is suitable for users, the commissioner said.” #onlinesafety #filtering #regulation #netgov #australia #esafety #socialmedia #gaming https://lnkd.in/gxZKbwiw

10

Did you know that most #app #developers in Australia don't give customers ownership of the IP they pay them to develop. They might say you have "the rights" but without "the ownership" they can sell those rights to somebody else. This is not what we do at Aviato Consulting, if you pay us to develop code for you, then you own it. #Fair #IP #flutter #aviato #tech #apps

28

In a time of an increasing volume cyber-attacks, the Bureau of Meterology an Australian Government website still doesn't support HTTPS. 🔓 Sure most of the weather information is non-sensitive but is this acceptble for a government website in 2024? Who knows what backdoor API, or authentication data in plain text is lurking deep within our treasured rain-radar . . . 🤔 🌧 💻 To read up on the differences and security gaps between http and http-ssl/tls, have a read of this article: https://lnkd.in/gy7M7WZF

10

10 Comments

Yesterday I bit the bullet and paid $200 for a plugin for the notetaking app Obsidian. The plugin is free and open source, and the cost is 100% optional. Obisidian is also free, but I paid $100 for a VIP supporter tier....which apparently has some benefits but I don't know what they are! I think I get access to new versions quicker? I don't use it. Some people think I'm nuts for paying $300 for free software, but someone has to pay for these things, or they dissappear. And then no one gets them and we're all worse off for it. Obsidian, and the Smart-Connections plugin, have added literally incalculable amounts of value to my life. I want a world with more cool stuff in it. And my paying for it means other people can get the same benefits even if they have no money at all. That's pretty cool. If you want good things, do your best to pay for them.

20

8 Comments

It might be time the Privacy Act needs an update. Everyday thousands of companies received data on every available ad slot on Australians’ devices, which they could copy to build their own databases about Australians and resell the information over and over again. Data included information about people’s movements, sexual interests, financial concerns, service providers, personal problems, gambling, drinking habits and online purchases. Currently, Australia has no limits on how this sensitive information is used which means residents’ private information can be sold to scammers and foreign-state actors. #cybersecurity #privacy #australia #advertising https://lnkd.in/gv9cJSTP

4

One of the layers we use to protect your business

1

My colleague Adam Cassar has just published the results of his #AccountTakeover survery of Australian businesses. Its more than just a survey, it provides an overview of the tactics attackers use, and the defences you need to prevent these attacks. Spoiler alert, 13% of businesses surveyed say they use residential proxy detection to combat credential stuffing and account takeovers. Stay tuned because I'm writing a post outlining why the proxy detection they're using sucks. #resip #credentialstuffing

8

🚨 The Australian Government is cracking down on non-compliant businesses! Cybersecurity is no longer optional. With hackers getting smarter, your business could face hefty fines or legal action if you’re not meeting standards. Don’t wait—get compliant before it’s too late.🔐 Partner with inSUPPORT by Real Innovation Group and safeguard your business from cyber threats today. #CyberSecurity #DataProtection #GovernmentRegulations #BusinessCompliance #CyberThreats #inSUPPORT #Hackers #AustraliaBusiness #ITSecurity #CyberCrime #DigitalSecurity #SmallBusinessSafety

4

Did you know? The Australian Signals Directorate (ASD) have a number of recommended configurations for Cloud Solutions that any business can implement. Small business can use these to ensure protections and best practice configuration for your cloud solution, whether you have 1 user or 100! PECyber can support these configuration implementations or Implement them directly for you - Reach out today! #cybersecurity #securecloud #cyber #pecyber #australiancyber

3

Residential proxies pose a growing threat to Australian businesses. These proxies use IP addresses assigned to real homes, making malicious traffic appear legitimate. Traditional security measures struggle to detect this threat. IP-based rate limiting and geolocation filters prove ineffective. Attackers rotate through thousands of residential IPs, bypassing common protections. The impact on businesses is severe. Credential stuffing attacks using residential proxies succeed more often. The recent wave of account takeovers at Australian retailers demonstrates their effectiveness. Specialised detection methods become essential. Businesses need solutions that can identify residential proxy traffic and mitigate the associated risks. Key strategies include: - Advanced network fingerprinting - Going beyond traditional Rate Limiting - Dynamic Credential Abuse Detection How well can your systems detect and block residential proxy traffic? Take our credential stuffing scorecard to find out: https://lnkd.in/gwfHNg3a Learn about why existing solutions struggle to detect residential proxies in our latest blog post: https://lnkd.in/gQJturRR #CyberSecurity #ResidentialProxies #AustralianBusiness

15

8 Comments

implementing poor.onboarding or applicant form storage lead to this mess.. companies do not.pay attention to.how.data is.stored .. simple 20-25k one time.security audit should have caught this.. it's sad to.see.secuirty as after thought or no thought by companies.. Victoria’s largest childcare org discloses data breach, ID document scans stolen https://lnkd.in/gkAwVrDE

3

#NDIS app with blockchain technology raises a multitude of ethical, technical & governance concerns, particularly given the controversial background of its developers who were previously involved with the robo-debt system. This initiative indicates a continued push towards automating compliance & accountability, which could potentially replicate past issues associated with #robodebt #Blockchain, while known for its security & immutability, can present significant challenges in #privacy management, especially concerning sensitive personal data of PWD. The lack of clarity about how data will be handled, who has access & how privacy is safeguarded is a major concern. The use of #algorithms to determine eligibility & the level of aid could replicate biases if not carefully designed & constantly monitored. This is particularly worrying if the algorithm's decision-making process is not transparent to the users or if they cannot contest its decisions effectively. The design of technological #solutions should prioritize the rights & needs of the end-users. This means designing with a focus on enhancing the autonomy & support for PWD, rather than merely streamlining government processes or cutting costs. Implementing blockchain technology in a #complex system like the NDIS involves significant challenges, not just in terms of technology integration but also ensuring that the system is user-friendly for people with varying levels of technical ability. Blockchain systems can face issues with latency & #transaction throughput, especially when scaled to accommodate the needs of all NDIS participants. This could impact the timeliness & reliability. Collecting & managing data across different #stakeholders within the NDIS ecosystem, such as healthcare providers, caregivers & government, requires a robust framework that ensures accuracy & timely updates of records. NDIA must maintain transparent about how the blockchain application was/is developed, deployed, & managed. Establishing an independent #ethical oversight committee would help address potential ethical issues arising from the use of blockchain & other tech. This should include representatives from the #disabled community, ethicists, technologists, & legal experts. The system should be continuously monitored & evaluated against #performance indicators not just related to technical performance but also user satisfaction & impact on service delivery. This should include mechanisms to quickly address any issues or failures in the system. Blockchain technology, while innovative, must be approached with caution to avoid repeating past mistakes associated with #automated decision-making in government services. The focus should always remain on improving the welfare & rights of PWD, ensuring they receive the support they need in a manner that respects their dignity & autonomy. Marie J. https://lnkd.in/g2a9Xetw

1

8 Comments