Cybersecurity Mentors Podcast · Cybersecurity Mentors

Lessons Learned From the Australian National University Breach with Suthagar Seevaratnam - Part 2

·52 min·3 clips

The vice chancellor owned the breach publicly and set the benchmark for ANU’s response.

1. Cybersecurity Mentors Podcast part two centers on the Australian National University breach and the firewall change that unexpectedly blocked the attackers. 2. Hosts John and the guest Suthagar Seevaratnam discuss his ANU role in handling the incident and why his perspective matters for breach response. 3. The episode asks how defenders contain an active intrusion, communicate openly, and turn a university breach into lessons for the wider sector. 4. Suthagar says ANU had firewalls that were up to date but not universally deployed, and the team pushed a routine firewall change to expand coverage. 5. He describes the interruption as unplanned and says the attackers’ access was cut off in a “Keystone cops” moment rather than through a deliberate trap. 6. The logs later showed the attackers becoming noisy and desperate after earlier operating with disciplined OPSEC. 7. Suthagar says they zeroed out files, wiped timestamps, and kept very methodical timing during the earlier phase of the intrusion. 8. He speculates that they may have been under pressure to deliver results after they started trying harder to re-enter the network. 9. The attackers compiled code on a VM, tried to run an exploit, and eventually found a password that let them move deeper. 10. He says they were looking for access into the enterprise services domain, where separate network boundaries were not obvious from outside. 11. The conversation turns to packet captures, credential sniffing, weak protocols, and freeware tools the attackers used on the wire. 12. Suthagar says they reached underlying databases directly, not just the web interfaces, and ANU’s hyper-customized data structures were difficult to interpret without a data dictionary. 13. He says the attackers likely took data they could not easily use because the structure was obscure even to staff who knew the system. 14. He explains the defender dilemma of balancing intelligence value from watching a live actor against the need to minimize harm. 15. ANU split the work into two teams so it could learn how the attackers got in and what they were targeting while still being careful about OPSEC. 16. Suthagar says there is always a tipping point where defenders must decide, “get out of my network,” even if the intruder realizes it has been detected. 17. The communication section emphasizes that the vice chancellor wanted to own the breach, apologize, and speak for students, academics, and staff. 18. Suthagar says ANU held the line for about two weeks before going public, then faced another attack on the day the first communications were released. 19. This episode will appeal to security leaders, higher-education defenders, and incident-response teams. 20. This episode may be skippable for listeners who want only lightweight security talk.

As heard by us

A firewall change opens the harder question: what does an institution owe its community after a breach?

A breach report becomes the episode's real battleground. Once a firewall change temporarily pushes threat actors out of the Australian National University's network, the pressure moves from containment to the messier public work of breach handling: communications, transparency,…

Read the full review in PlayNext →

Why you'd press play

See what happens after a critical firewall change temporarily kicks threat actors out, and the crisis room thinks the job is done.

Read the full recommendation in PlayNext →

Listen to the show on

Apple Podcasts Spotify

Play clips from this episode More from Cybersecurity Mentors Podcast