MFA for Superannuation Funds in Australia

Get free passkey whitepaper for Australian organizations

Introduction to FSC Standard №29

In July 2024, the Financial Services Council (FSC) introduced Standard №29 to strengthen cybersecurity measures for Australian superannuation funds. This update is a critical part of the broader Cyber Security 2030 Agenda, aiming to protect sensitive financial data and enhance consumer confidence in digital financial services.

Read full blog post here

Why Superannuation Funds Are Vulnerable

Superannuation funds are important in Australia's financial landscape, holding vast amounts of retirement savings for millions of Australians. This makes them prime targets for cybercriminals due to:

• High-Value Targets: The significant funds accumulated make these accounts highly attractive.
• Sensitive Personal Information: They store extensive personal data, including identification details and financial information, which can be exploited for identity theft and fraud.
• Widespread Access: The widespread online access to these accounts creates numerous entry points for cyberattacks.

Historical Breaches and Vulnerabilities

Several high-profile breaches have exposed the vulnerabilities of superannuation funds:

• Phishing Attacks: Cybercriminals use phishing tactics to gain access to accounts by tricking users into providing their login credentials.
• Weak Authentication Practices: Reliance on simple username and password combinations makes these systems susceptible to brute force attacks.
• Insufficient Security Measures: Lack of robust security protocols, like multi-factor authentication (MFA), increases the risk of unauthorized access.

Regulatory Landscape

Various regulatory bodies have provided guidelines to enhance the security of superannuation funds:

1. Australian Prudential Regulation Authority (APRA)

• Prudential Standard CPS 234: Mandates the implementation of appropriate information security measures, emphasizing strong authentication mechanisms.
• Information Security Management: Requires continuous monitoring and assessment of security posture, including regular updates to authentication methods.
• Guidance on Multi-Factor Authentication (MFA): Strongly recommends MFA for all critical systems, recognizing that single-factor authentication is insufficient against sophisticated cyberattacks.

2. Essential Eight Framework

Developed by the Australian Cyber Security Centre (ACSC), the Essential Eight Framework provides a comprehensive set of mitigation strategies:

• Phishing-Resistant Authentication: Encourages the implementation of advanced authentication methods to protect against phishing attacks.
• Multi-Factor Authentication (MFA): Requires MFA for all systems and applications, particularly those accessible by customers.

3. Financial Services Council Standard №29

The updated FSC Standard №29 includes several critical provisions:

• Mandatory Multi-Factor Authentication (MFA): Requires all superannuation funds to implement MFA for accessing critical systems and consumer-facing web portals.
• Phased Implementation Timeline: Sets a phased timeline for compliance, with full implementation required by 2026.
• Alignment with Regulatory Expectations: Emphasizes adherence to guidelines set by APRA and other regulatory bodies.
• Consumer Protection Focus: Ensures that authentication mechanisms are secure, user-friendly, and accessible.
• Regular Security Reviews: Mandates regular reviews and updates to authentication systems to maintain robust security.

Recommendation: Phishing-Resistant Multi-Factor Authentication with Passkeys

Given the vulnerabilities and regulatory requirements, adopting phishing-resistant MFA, such as passkeys, is crucial for superannuation funds. Passkeys offer a higher level of security compared to traditional methods, ensuring the protection of consumers' sensitive information.

Conclusion

The heightened focus on cybersecurity for superannuation funds, as highlighted by APRA, the Essential Eight Framework, and FSC Standard №29, underscores the critical need for robust MFA mechanisms. By prioritizing the adoption of phishing-resistant MFA like passkeys, superannuation funds can significantly enhance their security posture. Implementing these measures now, rather than waiting for the 2026 deadline, is imperative to safeguard against evolving cyber threats.
Find out more on FSC Standard №29: MFA for Australian Superannuation Funds.