What have we done so far? New Zealand has issued two previous cyber security strategies in response to this challenge. The 2011 strategy outlined the Government’s response to the Social engineering is one of the most commonly used techniques among cyber criminals. growing threat and established the National Cyber For example, in a recent case, an employee of Security Centre and the National Cyber Policy Office. a finance company was deceived into providing The 2015 Cyber Security Strategy acknowledged credentials, after responding to a phone call that technology was transforming New Zealand and from a person claiming to be from the helpdesk. outlined a vision of a secure, resilient and prosperous The criminal then used the employee’s login online New Zealand. details and emailed the company’s customers, Since 2015, a range of actions have been taken to advance that vision, including the establishment of CERT NZ to respond to cyber security threats in New Zealand, New Zealand’s first Cyber Security Summit, the Government Communication Security Bureau’s (GCSB) deployment of CORTEX services asking them to pay invoices from the company to the criminal’s bank account instead. Several customers did so before the breach was uncovered. The account was closed down, but not before several customers had paid a total amount in the $100,000s. to nationally significant organisations (preventing In cases like this, no one “hacked” into the $67 million of financial harm in the first 2 years of company’s network – they breached the operation), GCSB’s development of Malware-Free company’s security by tricking the employee. Networks, the designation of the Director-General The employee lacked cyber security training, of the GCSB as the Government Chief Information and were unaware of the threats and the Security Officer, the introduction of greater measures needed to protect themselves and cybercrime training for New Zealand Police, and the their company from this kind of crime. development of a cyber credentials scheme to help small businesses improve their cyber security. But the world has shifted since 2015 and our response has to adapt to these changes. New Zealand’s cyber security strategy 2019 6