TRANSCRIPT 🔗
WEBVTT
00:00:01.919 --> 00:00:04.080
Welcome to Cross Examining Cyber.
00:00:04.160 --> 00:00:07.599
This is a podcast brought to you by Herbert Smith Free Hills Kramer.
00:00:07.839 --> 00:00:15.439
In this podcast, we look to speak to individuals across the industry who are at the coal face of our cyber incident response.
00:00:15.679 --> 00:00:18.719
But in this particular series, we're taking a slightly different slant.
00:00:18.960 --> 00:00:29.600
We're going out and speaking to our top directors to talk about governance, how to be a good director during a cyber crisis, and what it means to be a director in an ever-changing digital world.
00:00:29.760 --> 00:00:39.520
We've already spoken to David Moffat, we've already spoken to Ann Templeman-Jones, and now we have Catherine Brenner and John Mullen, two of our most distinguished chairs.
00:00:39.759 --> 00:00:40.799
Thank you for joining us.
00:00:40.960 --> 00:00:42.880
This is Cross-Examining Cyber.
00:00:43.039 --> 00:00:44.079
Here we go.
00:00:45.280 --> 00:00:46.640
So welcome to my board.
00:00:46.880 --> 00:00:48.320
If only boards were this small.
00:00:48.560 --> 00:00:48.880
I know.
00:00:49.119 --> 00:00:50.240
A quorum of three.
00:00:50.320 --> 00:00:50.399
Yeah.
00:00:50.880 --> 00:00:52.880
The subcommittee to deal with the crisis, Louis.
00:00:53.119 --> 00:00:57.039
Yeah, so it's a unique boardroom, but I'm going to suggest that we open the meeting.
00:00:59.920 --> 00:01:00.079
Yes.
00:01:00.479 --> 00:01:01.520
All the time.
00:01:01.679 --> 00:01:01.920
Terrific.
00:01:02.159 --> 00:01:03.119
Yeah, all on Favor.
00:01:03.280 --> 00:01:03.840
Fantastic.
00:01:04.159 --> 00:01:09.519
Before we start, I think the most important thing, and quite often for many of our listeners, is who we're actually speaking to.
00:01:09.760 --> 00:01:16.159
So maybe Catherine, if I can start with you, just a brief description of your background and the positions that you hold today.
00:01:16.560 --> 00:01:16.799
Great.
00:01:16.959 --> 00:01:17.760
Thanks, Cam.
00:01:18.000 --> 00:01:26.719
I sit on a number of boards, and I've been a non-executive director for about 20 years, and I was an investment banker for a long time.
00:01:26.879 --> 00:01:46.400
And the boards I sit on at the moment span critical infrastructure, so the domestic payment rails, AP Plus, F POS, NPP, BPAY, Connect ID, Centre Group, the owner and operator of Westfield, a listed investment company, part of the AFIC family, and some other private not-for-profit board roles.
00:01:46.799 --> 00:01:47.120
Great.
00:01:47.280 --> 00:01:48.799
What do you do on the weekend?
00:01:50.000 --> 00:01:51.840
Still school sport and those sorts of things.
00:01:53.200 --> 00:01:54.879
You're still in that taxi phase, are you?
00:01:55.120 --> 00:01:55.359
Indeed.
00:01:55.599 --> 00:01:55.840
Yeah.
00:01:56.799 --> 00:01:57.120
Great.
00:01:57.200 --> 00:02:01.040
So I'm sort of probably the older participant in the discussion.
00:02:01.200 --> 00:02:03.599
So I've I've been had a pretty varied career.
00:02:03.680 --> 00:02:07.200
I've lived and worked in, I think, 13 countries over the years, all continents.
00:02:07.359 --> 00:02:09.759
I've been on boards in US, Europe, and here.
00:02:10.000 --> 00:02:13.360
My main career was in logistics, transport and logistics.
00:02:13.439 --> 00:02:14.800
I'm multiple companies.
00:02:14.960 --> 00:02:19.759
I ended up as CEO of DHL Express, based uh initially in the US and in Europe.
00:02:20.000 --> 00:02:25.439
And then in my non-executive life, I've been lucky to be part of some fascinating companies.
00:02:25.520 --> 00:02:34.800
So I was uh chair at Telstra for many years, and today I'm chair of Qantas and also Brambles Pallets and Treasury Wine Estates.
00:02:34.879 --> 00:02:40.719
So I sort of joke with myself that Treasury grows it, Brambles carries it, Qantas flies it, and I drink it.
00:02:41.759 --> 00:02:42.719
I like that.
00:02:43.199 --> 00:02:45.680
It sounds like a perfect mixture of boards.
00:02:46.000 --> 00:02:52.080
I wouldn't mind starting our conversation, not talking about cyber at all or experiences with cyber or even new technology.
00:02:52.319 --> 00:02:57.120
But what what it takes to be a good director in this dynamic environment.
00:02:57.280 --> 00:03:02.000
What's that quote about things will never be as they'll never been as fast and they'll never be as slow again?
00:03:02.319 --> 00:03:04.400
We that's certainly what we're leaning into.
00:03:04.639 --> 00:03:13.120
I'd love your take on what it takes to be, first of all, a good director, but perhaps more importantly, what it takes to be a good chair in this type of environment.
00:03:13.199 --> 00:03:16.080
And John, I'll I'll start with you and we'll we'll go from there.
00:03:16.479 --> 00:03:23.039
I think it is a a very different world today than the years when we probably both started our careers.
00:03:23.360 --> 00:03:26.560
I think first and foremost, goes from a public company life.
00:03:27.039 --> 00:03:28.400
You've really got to want to do it.
00:03:29.039 --> 00:03:39.039
You know, I think unless you've really got some passion and conviction about the company you're working with and where you want to go and you enjoy the people you're working with, by and large, you're really going to want to do it now.
00:03:39.120 --> 00:03:44.879
The media exposure, the risk, everything else, you don't do that just to do a job sort of thing.
00:03:45.120 --> 00:03:55.759
And then secondly, I think it's sort of incre in one's increasingly become almost like the conductor of an orchestra, if you agree, Catherine, but you've got so many stakeholders to balance these days.
00:03:55.919 --> 00:04:00.639
You've obviously got a governance role within the company, but at the same time, you're not policemen.
00:04:00.719 --> 00:04:06.159
You know, you're there to stand beside the CEO and the management team and through thick and thin and support
Load full transcript
them.
00:04:06.319 --> 00:04:12.319
But again, if I go back not so many years, really stakeholder primacy was shareholder privacy.
00:04:12.719 --> 00:04:18.000
That was basically all you had to worry about, provided you delivered financial results, how you did it and how your team did it didn't really matter.
00:04:18.160 --> 00:04:20.000
Today, of course, that's dramatically different.
00:04:20.240 --> 00:04:20.480
Yes.
00:04:20.800 --> 00:04:25.759
How something is done can completely derail the reputation of the company and individuals.
00:04:25.920 --> 00:04:33.839
So I think the chair's got a and the whole board's got a much broader remit today under the glare of public scrutiny and and the like.
00:04:33.920 --> 00:04:42.720
And lastly, I would say I think certainly in my experience, I've really been focused on trying to build diversity around the board and not just male-female balance.
00:04:42.879 --> 00:04:56.639
Of course, that's important, but much more importantly, real diversity of thinking, of background, of experience, of ways of approaching things that I think there's been a risk in Australian businesses that you know the old boys' club and the old girls' club are pretty similar.
00:04:57.279 --> 00:05:01.519
And we've often been reluctant to go outside that and take a risk.
00:05:01.680 --> 00:05:04.000
And that certainly served me extremely well.
00:05:04.160 --> 00:05:05.920
But you know, you have to manage accordingly.
00:05:06.240 --> 00:05:12.800
We're most international directors, and some cultures are not as boisterous as Australians, they don't necessarily speak up.
00:05:12.879 --> 00:05:13.040
Yeah.
00:05:13.199 --> 00:05:17.759
And so unless you unless you draw them out, you can really waste the talent that's uh sitting there.
00:05:17.920 --> 00:05:19.920
So I think that's your your role.
00:05:20.720 --> 00:05:23.120
I completely agree with what John has said.
00:05:23.279 --> 00:05:33.839
There's so many things that come into the remit of a board, whether because regulators say that this must come to the board or that there are significant risks or opportunities for the organisation.
00:05:34.000 --> 00:05:44.720
And so I think that the role of a good board and which a chair facilitates is to get border management aligned on where we're heading, what that flag on the hill is and what the strategy is.
00:05:44.879 --> 00:05:46.160
And so that's really important.
00:05:46.240 --> 00:05:51.040
And if you don't have alignment on that, you've got challenges and you need to go back and get alignment.
00:05:51.199 --> 00:05:57.680
But we've got different roles to play when it comes to it, to how we execute on that and how we reach that flag on the hill.
00:05:57.839 --> 00:05:58.160
Yeah.
00:05:58.399 --> 00:06:20.879
And the board's job and the chair facilitates making sure that we create an environment where management can tell us what's going wrong, what they don't know, what they're concerned about, and where we can have a really constructive debate, bringing in those different perspectives and walk away with management, having a very clear understanding of what is concerning the board, perhaps thinking about things differently.
00:06:21.040 --> 00:06:24.560
I think good boards help lift management's eyes up and out.
00:06:25.120 --> 00:06:27.360
You have to be very deliberate in looking out.
00:06:27.759 --> 00:06:33.199
And so really good directors and chairs ask really good questions, and the chair then synthesizes it.
00:06:33.279 --> 00:06:36.160
So management walks out understanding where the board sits.
00:06:36.319 --> 00:06:38.240
And board agendas are finite.
00:06:38.399 --> 00:06:38.639
Yes.
00:06:38.879 --> 00:06:47.360
There's so many things that can come, and I think a good chair makes sure that the big rocks or the key things get the time that they need in the boardroom as well.
00:06:48.000 --> 00:06:56.000
Just as just sort of as an aside, and and this is not on notice, how are you being reported to at the moment?
00:06:56.160 --> 00:06:59.680
And is that effective given all these sort of dynamics?
00:06:59.839 --> 00:07:05.519
Because I've certainly said board papers and things presented to the board which are voluminous in nature.
00:07:05.600 --> 00:07:12.560
And I I look back and I think, how on earth is someone in that capacity going to be able to digest that we have a shared volume of information?
00:07:13.040 --> 00:07:17.120
Do you think we need to change the way in which we deliver our board reporting?
00:07:17.279 --> 00:07:30.639
I ask you that very deliberately because cyber is one area where you can get lost in the jargon, you can get swept up in a discussion where sometimes neither party understands the other or there is a risk of that.
00:07:31.040 --> 00:07:37.839
So I'd be interested in your view just off the cuff around board reporting, if you'd if you'd like to share your view.
00:07:38.319 --> 00:07:38.560
Sure.
00:07:38.639 --> 00:07:47.759
Well, there's an explicit tension there because the board is entitled to see everything and needs to be across things, but you can't function like that as well.
00:07:47.920 --> 00:07:52.399
So you're reliant on management to give you distilled information.
00:07:52.560 --> 00:07:52.800
Yes.
00:07:52.959 --> 00:08:00.000
And so there has to be a trust there and understanding that everything that you get through a board paper or committee paper is filtered by its very definition.
00:08:00.639 --> 00:08:03.759
But you want a really good board paper, so good framing.
00:08:03.839 --> 00:08:05.360
I like framing questions in there.
00:08:05.519 --> 00:08:05.600
Yes.
00:08:05.839 --> 00:08:10.240
A shorter board paper which has the salient information and something that everyone's read before.
00:08:10.399 --> 00:08:18.079
So we can use our precious time in the boardroom to have the discussion rather than having people present stuff that we could have read beforehand.
00:08:18.319 -->
00:08:18.560
Yes.
00:08:19.279 --> 00:08:22.800
But more detail, I think, is for the committees usually rather than the board.
00:08:23.040 --> 00:08:23.360
Yeah.
00:08:23.920 --> 00:08:25.120
Totally agree.
00:08:25.199 --> 00:08:32.000
Again, I'm when when I was at Telsa when I first started there, uh, average board pack was about 1200 pages.
00:08:32.159 --> 00:08:32.399
Yes.
00:08:32.639 --> 00:08:36.000
And I think it's beyond the wit of humankind to absorb 1200 pages.
00:08:36.080 --> 00:08:36.720
I mean, I can't, yeah.
00:08:36.799 --> 00:08:37.519
Anyway, I really can't.
00:08:37.600 --> 00:08:39.519
So you end up skimming things that might be important.
00:08:39.679 --> 00:08:46.159
Well, I had a really conscious effort with the company secretary at the time to get it down to sort of two to three hundred pages of pre-reader.
00:08:46.320 --> 00:08:46.960
I don't know about you.
00:08:47.360 --> 00:08:49.120
Well, I just I just can't absorb all that.
00:08:49.440 --> 00:08:49.600
No.
00:08:50.799 --> 00:08:53.200
So I I think that's that's important.
00:08:53.440 --> 00:08:58.080
And probably one of the lessons I've learned is that a board can never know everything.
00:08:58.320 --> 00:08:59.519
You're sort of expected to.
00:08:59.600 --> 00:08:59.840
Yeah.
00:09:00.000 --> 00:09:01.360
But realistically, you're only there.
00:09:01.440 --> 00:09:09.360
Whereas you're perhaps a lot more involved, but as a non-executive director, you maybe once a month there's a meeting and then a full board meeting every second month.
00:09:09.519 --> 00:09:14.559
You you don't know what the bank balance is in Geulong or you know what a salesman person did here or there.
00:09:15.120 --> 00:09:17.200
But sort of the public expects it.
00:09:17.360 --> 00:09:22.240
And I think one of the challenges is that it's the exception that get you into trouble, not the norm.
00:09:22.399 --> 00:09:27.759
You know, so yeah, the board paper says we're 98.5% successful on this or whatever you think.
00:09:27.840 --> 00:09:28.480
Well, that's pretty good.
00:09:28.559 --> 00:09:30.000
Yeah, great, so I can relax.
00:09:30.080 --> 00:09:33.919
But actually it's the one and a half where all the reputational risk is.
00:09:34.480 --> 00:09:37.519
And we don't look at that until it's too late.
00:09:37.919 --> 00:09:38.159
Yeah.
00:09:38.399 --> 00:09:38.639
Yeah.
00:09:38.799 --> 00:09:56.159
And that's where that environment comes into play where management feels safe saying this is what actually happened on the one and a half percent, and that they are thinking critically about what the board really wants to know, and that the board approaches board meetings in a way that makes it safe for management to tell you that.
00:09:56.240 --> 00:09:57.519
I think that's really important.
00:09:57.840 --> 00:10:09.200
Yeah, we um I have to say I'm not backwards and coming forwards sometimes when I see some of the cyber reports go up, and I look at it sometimes and I think this is this is a wonderful set of vanity metrics, actually.
00:10:09.279 --> 00:10:09.600
Yeah.
00:10:09.840 --> 00:10:23.600
And how can we make management feel comfortable that they can actually deliver things which aren't all green or you know, or amber and green, and there's no red on the on the page.
00:10:23.679 --> 00:10:36.080
So yeah, I think I think that's absolutely one of the things that preoccupies me, because it's again beyond the wit of most humans to really understand cyber down in the technical details.
00:10:36.320 --> 00:10:50.879
And you know, I think as as boards, I'm I'm not an accountant, but I can basically understand the financial statements, but I rely on the CERN and also rely on an external audit to with people with a high level of knowledge, then I feel reasonably comfortable in that world.
00:10:51.200 --> 00:10:52.720
Cyber world, I don't know.
00:10:52.799 --> 00:10:55.120
If the team says, yeah, everything's green, we're fine.
00:10:55.279 --> 00:10:55.679
Yes.
00:10:55.919 --> 00:10:57.679
I I I can't pick holes in it.
00:10:57.759 --> 00:11:03.039
You know, so I think we you know, I I think we should be moving almost to an external auditor for cyber.
00:11:03.200 --> 00:11:05.679
It's just as important as financial risk these days.
00:11:05.840 --> 00:11:17.200
And and so you're continually pro from outside, checking what our teams are saying, because I don't have the ability to to judge if the chief cyber guy is telling the truth or not.
00:11:17.360 --> 00:11:20.960
I was not he wouldn't not tell the truth, but he'll gill the lily a little bit.
00:11:21.519 --> 00:11:22.559
It's a great segue, actually.
00:11:22.799 --> 00:11:28.480
There has been a bit of a push out of the US that perhaps we need someone with the cyber expertise on the board.
00:11:28.720 --> 00:11:31.279
And I've got a a reasonably strong view on that.
00:11:31.360 --> 00:11:32.799
I'll share it once I hear yours.
00:11:33.120 --> 00:11:35.600
Um but I've got a I've got a view on that.
00:11:35.679 --> 00:11:41.440
But uh do do we do we think we need someone of that ilk on the board specifically?
00:11:42.159 --> 00:11:42.480
No.
00:11:42.799 --> 00:11:47.679
If you're a technology company or a cyber company, yes, because that's the core business.
00:11:47.919 --> 00:11:52.639
But I think having one person on the board who does cyber is a mistake.
00:11:52.720 --> 00:12:01.200
I think not because expertise doesn't matter, but it does create the wrong dynamic that that person has it all under control and is the expert.
00:12:01.360 --> 00:12:04.639
I don't think it's fair to that person, and I think it's dangerous for boards.
00:12:04.879 --> 00:12:11.600
But I'd also push back on the assumption that it's the board's job to be a cyber or a technology expert.
00:12:11.759 --> 00:12:23.679
I think the board's job is to understand the risk and the accountability and whether management has the capability and the culture to manage both, and they're
governance questions rather than technical questions.
00:12:24.080 --> 00:12:25.919
I I think you phrased it very, very well.
00:12:26.240 --> 00:12:29.519
Maybe just to add the nuance, I think you actually need both.
00:12:29.679 --> 00:12:34.639
I think everyone has to be cyber conversant to your to your way.
00:12:34.879 --> 00:12:36.639
You've all got to understand what's being talked about.
00:12:36.799 --> 00:12:50.480
But I think it helps if you've got one director who really knows the bottom level of all this, you know, and can go toe-to-toe with management on when you get into the technical stuff where all the rest of us our eyes glaze over a bit, you know.
00:12:50.559 --> 00:12:52.000
So for me the answer is both.
00:12:52.159 --> 00:12:52.399
Yes.
00:12:52.720 --> 00:13:00.000
Um but um the days of, as you say, just sort of looking at the cyber person and say, well, you answer that on our behalf, then that's those are gone.
00:13:00.320 --> 00:13:00.480
Yes.
00:13:00.639 --> 00:13:00.879
No, no.
00:13:01.279 --> 00:13:04.000
That baseline literacy is absolutely essential.
00:13:04.399 --> 00:13:14.720
Yeah, I I mean I love the idea of uh building literacy across the board, but not just because in cyber, but just d what I'd call digital risk more generally.
00:13:15.039 --> 00:13:18.480
Digital opportunity and digital risk, and maybe the solution lies somewhere in there.
00:13:18.639 --> 00:13:30.080
I do fear a little bit like you that um sometimes if you if you have one individual who's very deep, then they may become a proxy for the board around that sort of decision making.
00:13:30.480 --> 00:13:30.799
I agree.
00:13:30.879 --> 00:13:34.879
And it's not just cyber, it's about the technology strategy and the approach, etc.
00:13:35.120 --> 00:13:36.080
I don't think it's a silo.
00:13:36.559 --> 00:13:38.000
Yeah, and we're getting inundated, aren't we?
00:13:38.240 --> 00:13:39.679
There's AI coming all over the place.
00:13:39.840 --> 00:13:49.519
There's um, you know, the cyber is just one of a converging set of risks around digital technology, really.
00:13:49.759 --> 00:13:53.600
I say to people that we haven't managed to solve physical crime yet.
00:13:53.840 --> 00:14:02.399
We've been trying since the days of yesteryear, and I'm not sure if we're gonna solve digital crime very quickly either as this unfolds.
00:14:02.720 --> 00:14:10.000
Just recently we saw a large US organization pay an extortion demand to a threat actor who has been very active in Australia.
00:14:10.159 --> 00:14:19.360
And in many respects, uh it kind of broke me a little bit because all this hard work we've been doing to lean into that threat and not pay for data.
00:14:19.759 --> 00:14:22.960
I mean, I mean I think it's something that preoccupies all of us.
00:14:23.200 --> 00:14:28.320
It's hard to generalize because if life is at risk, yeah.
00:14:28.480 --> 00:14:28.639
Yeah.
00:14:28.960 --> 00:14:29.279
I don't know.
00:14:29.440 --> 00:14:33.039
Do you then say I'm not going to pay and we know that someone's going to die because of it?
00:14:33.279 --> 00:14:34.720
I think we'd all find that pretty hard.
00:14:35.519 --> 00:14:40.879
And for a big company, if you can afford it, I I firmly of the belief you you stand up to it.
00:14:41.039 --> 00:14:41.360
You have to.
00:14:41.600 --> 00:14:41.759
Yes.
00:14:42.080 --> 00:14:53.360
One thing that sort of bothers me a little bit, and it bothers me because I try to bring as much energy I can into this sort of cyberspace, is I worry about fatigue around cyber.
00:14:53.600 --> 00:15:02.159
We have this sometimes when we present to boards or present to executive teams, we have this little slide that we run that we talk about the wake-up call.
00:15:02.320 --> 00:15:06.799
And I don't know how many headlines you've seen of which this is another wake-up call for cyber.
00:15:07.039 --> 00:15:09.440
But it it's a it's a bit melodramatic, I have to admit.
00:15:09.600 --> 00:15:12.559
It's the jazz hands part of the um the presentation.
00:15:12.720 --> 00:15:20.639
But the very, very last headline is says enough with the wake-up calls, but it's dated June 2014.
00:15:21.039 --> 00:15:21.519
Oh wow.
00:15:21.840 --> 00:15:26.399
Yeah, you know, and and and so we had a wake-up call yesterday, uh apparently, another one.
00:15:26.799 --> 00:15:33.279
So how do we and how does a board remain energized around this space?
00:15:33.440 --> 00:15:34.480
Or is it easy?
00:15:34.960 --> 00:15:36.799
I I'm much a bit more optimistic about that.
00:15:36.960 --> 00:15:38.559
I I don't think it's fatigue.
00:15:38.639 --> 00:15:39.600
I'd almost say the opposite.
00:15:40.000 --> 00:15:40.080
Okay.
00:15:40.320 --> 00:15:44.559
There's a there's certainly the boards I'm on, there's an increasing paranoia about the risk.
00:15:45.279 --> 00:15:48.320
I don't have any trouble getting people focused uh on it.
00:15:48.559 --> 00:15:49.840
I don't do agree, I think.
00:15:50.240 --> 00:15:52.320
Well the threat landscape certainly isn't fatigued.
00:15:52.559 --> 00:15:52.799
Yes.
00:15:52.960 --> 00:15:53.120
Yeah.
00:15:53.440 --> 00:15:58.399
And other significant risks for organizations, things like health and safety, et cetera.
00:15:58.480 --> 00:15:58.559
Yeah.
00:15:58.960 --> 00:16:00.320
We're not fatigued about those.
00:16:00.399 --> 00:16:01.840
They're really important things.
00:16:01.919 --> 00:16:09.360
And cyber, data, all of those sorts of things, you know, there's a whole lot of things in that bucket, remain important.
00:16:09.440 --> 00:16:16.639
And I think everyone's very focused on it and very conscious of being as current as they can on it and understanding.
00:16:16.799 --> 00:16:19.200
And I think recognizing that they don't understand at all.
00:16:19.600 --> 00:16:19.840
Yeah.
00:16:21.039 --> 00:16:31.600
And I I I think it's the the the perception of the risk has evolved, I think, uh beneficially in that it was just
sort of one lump risk, cyber risk, you know.
00:16:31.679 --> 00:16:32.960
Um so what are we doing about it?
00:16:33.120 --> 00:16:34.639
Well, how do we measure ourselves?
00:16:34.720 --> 00:16:38.480
Well, if the our peers in the industry spend two percent we do, that's fine.
00:16:38.879 --> 00:16:48.639
You know, I I think it's we've matured a bit from then to say, well, look, there are bits of the company where if the information gets out, it's embarrassing, but it's not gonna group us, you know.
00:16:48.720 --> 00:16:51.519
Um very different in a B2B and a B2C world.
00:16:52.240 --> 00:16:57.360
Uh in a B2B, yeah, it's embarrassing with clients and this, that, and the other, but it's not necessarily the end of the world.
00:16:57.440 --> 00:17:11.279
So you can have one level of defense and expenditure there, but if you've got people's personal health details, their bank accounts, passport numbers, all of these sort of things, then there's almost no limit to where you you need to uh develop your your protection.
00:17:11.440 --> 00:17:24.000
So I think boards are becoming much more granular now in looking at those different components and making sure that, well, in our company, even if it's not an industry standard, it's absolutely critical that we are protected against X or Y.
00:17:24.559 --> 00:17:25.920
We'll spend whatever it takes to do so.
00:17:27.519 --> 00:17:35.759
Yes, and so that's requires that understanding of your technology stack, your third-party providers, the business really.
00:17:35.839 --> 00:17:41.359
So it's an understanding of the business and then having an appropriate risk appetite and processes around it.
00:17:41.920 --> 00:17:48.160
Yeah, it's a great point about actually being a little bit more sophisticated or mature about where your risks genuinely lie.
00:17:48.640 --> 00:17:57.920
And I'm not suggesting this is easy, but at least it's possible to get your head around where data holdings, for example, might be more valuable than others.
00:17:58.160 --> 00:18:03.759
I I struggle a little bit more when we deal with something which might impact the operations of the business.
00:18:03.920 --> 00:18:09.759
And let's be clear, we have, I think, in Australia, dodged and weaved this issue.
00:18:10.079 --> 00:18:13.519
John, you lent into it pretty heavily in 2020.
00:18:13.680 --> 00:18:25.039
But since then, we've probably only had one incident, and that was probably the DP World incident, where there was a threat of a shutdown of a major piece of, well, the steamer-doring business in many of our ports around the country.
00:18:25.200 --> 00:18:29.039
Not critical to infrastructure, but certainly a provider to our ports.
00:18:29.440 --> 00:18:31.759
How are boards looking into that issue?
00:18:32.000 --> 00:18:36.960
Because quite frankly, I would suspect that's the that's the issue that the government worries about the most.
00:18:37.519 --> 00:18:52.640
What happens if we have an operational asset integrity issue with some of your businesses and your the period you're running, some of the most significant and operationally sort of the impact would be incredible in an operational.
00:18:53.039 --> 00:18:53.279
Yeah.
00:18:54.240 --> 00:19:02.000
I think that's why the government um brought in the critical infrastructure sort of rules for that reason, which I totally uh agree with.
00:19:02.160 --> 00:19:09.519
I mean, I certainly learned you you were there at the time, I certainly learnt the hard way at toll when the first attack.
00:19:09.680 --> 00:19:13.680
And you know, it's sufficiently long ago now that it's probably a century in cyber time.
00:19:14.160 --> 00:19:19.119
But I don't think toll was any worse prepared than any other industrial company.
00:19:19.200 --> 00:19:24.960
I mean, it wouldn't have been at the length the level of a bank or a telco probably, but I think an ordinary industrial.
00:19:25.519 --> 00:19:28.319
And we were totally, totally flawed by it.
00:19:28.480 --> 00:19:33.119
Um and the issue was not leak so much of information, it was shutting the operation down.
00:19:34.319 --> 00:19:39.200
So we basically couldn't trade for a long time, weeks.
00:19:39.359 --> 00:19:42.799
And we had 55,000 employees who were paying the payroll every day.
00:19:43.039 --> 00:19:50.880
So you know when it started, I was very focused on getting all the cyber expertise that we could, and the government helped, and this, and we were all working around that.
00:19:50.960 --> 00:19:52.000
It's an IT thing.
00:19:52.240 --> 00:19:55.680
And then I suddenly thought to myself, actually, this is a liquidity issue.
00:19:55.920 --> 00:19:56.079
Yeah.
00:19:56.240 --> 00:19:59.920
We're bleeding like$100 million every 14 days, something.
00:20:00.160 --> 00:20:02.319
And if this keeps going, we're gonna run out of money.
00:20:02.640 --> 00:20:12.559
So I park all the cyber stuff with the experts and then completely reoriented the board to bankers, shareholders, you know, it was it was really scary.
00:20:12.720 --> 00:20:18.720
And if we came actually quite close to if we hadn't actually support, the company would have really struggled.
00:20:19.119 --> 00:20:28.559
Now that sort of taught me it's more than just a uh and so I you know, if that's taken on a national scale of a critical infrastructure company, that was just toll and their customers, which was bad enough.
00:20:28.640 --> 00:20:35.759
But if you're a you know critical infrastructure, energy or airlines or telcos, something like that, you're then affecting half of the population of the country.
00:20:36.319 --> 00:20:41.119
Mind you, you were delivering toilet paper, and that was very, very significant at that particular point in time, I seem to recall.
00:20:41.359 --> 00:20:41.440
Yeah.
00:20:42.000 --> 00:20:44.079
I had a few expert deliveries just in case.
00:20:46.480 --> 00:20:47.359
What do you think?
00:20:48.000 --> 00:20:48.720
I agree with that.
00:20:48.880
--> 00:21:06.240
I think that a cyber incident or any sort of crisis is a significant impact on an organization, but it's about how the organization survives as a functioning entity, whether it's liquidity, whether it's safety, whether there's a whole lot of other factors that come into play.
00:21:06.400 --> 00:21:10.400
And look, the environment has become much more sophisticated, etc.
00:21:10.640 --> 00:21:30.559
But I think that organizations and boards have been developing that muscle, not just through cyber and cyber simulations or SOCI, COVID, even the S2 scenarios from a climate perspective, thinking about the fuel crisis, that we are getting much better, I think, at thinking of the second and third order and sometimes fourth order effects of these things.
00:21:30.640 --> 00:21:30.960
Yes.
00:21:31.200 --> 00:21:34.400
But the environment is getting much more sophisticated as well.
00:21:34.640 --> 00:21:46.160
But we do need to think beyond the immediate and surround ourselves with advisors and a board that has that mindset that it's not just a discrete quarantine problem, it is a much broader one.
00:21:46.640 --> 00:21:53.839
It is a bit salutary, though, that you know, I think we all we've all got the risk matrix, which we have to look at however many times a year it is.
00:21:53.920 --> 00:21:58.319
And you've got the bubbles of sort of severity versus likelihood, and we all nod wisely and go.
00:21:58.640 --> 00:22:02.640
But then pretty well everything I've been involved in was never on the thing of the of the risk register at all.
00:22:02.799 --> 00:22:02.880
Yes.
00:22:03.200 --> 00:22:04.319
I mean COVID.
00:22:04.480 --> 00:22:06.079
Yeah, when that came all of a sudden.
00:22:06.400 --> 00:22:07.680
Bang, that wasn't on the register.
00:22:08.160 --> 00:22:09.200
It was not on the register.
00:22:09.440 --> 00:22:11.920
And there have been a few of those, and even now fuel.
00:22:12.160 --> 00:22:12.480
Yes.
00:22:12.720 --> 00:22:18.319
Yeah, everyone's obviously aware that if you can't put petrol in the car or carotene in the plane, you can't fly.
00:22:18.400 --> 00:22:21.440
But it was never sort of number two on the on the risk register.
00:22:21.680 --> 00:22:21.839
No.
00:22:22.079 --> 00:22:23.759
And it certainly is around the quantus board.
00:22:23.839 --> 00:22:28.000
We've we've we've got to think how do we deal with a hundred million dollars a year increased cost.
00:22:28.319 --> 00:22:30.079
But what happens if there's no supply?
00:22:30.319 --> 00:22:30.480
Yeah.
00:22:30.720 --> 00:22:32.319
That's a whole different ball game.
00:22:32.400 --> 00:22:32.640
Yeah.
00:22:32.960 --> 00:22:38.720
And again, that's never those levels of risks probably haven't been enunciated clearly enough in most companies.
00:22:38.799 --> 00:22:40.559
Because you sort of don't know what you don't know is the trouble.
00:22:40.880 --> 00:22:41.279
Exactly.
00:22:41.440 --> 00:22:41.920
Yeah.
00:22:42.480 --> 00:22:54.000
You s you touched on this, John, the suggestion that the lessons that you learn from these incidents may not be what you do in that immediate response, or that's critical, but you may well have a liquidity issue.
00:22:54.319 --> 00:23:07.759
When you look back on both of you, either the incidents you've been involved with, whether it's directly or on the periphery, or even the exercises you've run as organizations, because they can elicit great learnings too.
00:23:07.920 --> 00:23:08.240
Yeah.
00:23:08.400 --> 00:23:09.359
What have you learned?
00:23:09.440 --> 00:23:15.839
What would be your sort of top one, two, or three lessons from dealing with the cyber crisis?
00:23:17.680 --> 00:23:22.240
Well, that conversation was so good, we've decided to leave it on a cliffhanger.
00:23:22.400 --> 00:23:27.839
Please stay tuned for part two of the cross examination of Catherine Brenner and John Mullen.
00:23:27.920 --> 00:23:29.200
A rare treat indeed.
00:23:29.359 --> 00:23:31.920
And of course, thank you all for listening.