Businesses must improve their cyber security measures, as part of the broader measures to defend the country from increasing interference by foreign states, the Government Communications Security Bureau (GCSB) says.
GCSB director-general Andrew Hampton. Photo: RNZ / Jane Patterson
Director-general Andrew Hampton said certain sectors of the economy were targets, including operators of critical infrastructure, holders of key intellectual property, and major exporters.
"They're the ones who we would say are most susceptible to those complex, persistent, state-sponsored type actors."
"Some of it is directly targeting those organisations ... sometimes unfortunately we see actors seeking to use New Zealand infrastructure so they can attack someone else," he said.
Hampton said the GCSB worked on about 340 cyber incidents last year, more than a third of which could be linked back to foreign states, including Russia, China and North Korea.
Research carried out by the agency in 2018 found too few businesses were taking information security risks seriously, nor were they recognising it at a board or executive level.
Fewer than one in five of 250 nationally significant organisations surveyed by the bureau had a dedicated executive to deal with information security.
More than 40 percent of the organisations were barely confident they would know if their systems were hacked.
Hampton said the findings proved the lack of focus on cyber security, although businesses were starting to listen to the GCSB's advice.
"Organisations are now in the process of implementing this [advice] and it still waits to be seen the extent to which they've done that."
He said "basic cyber hygiene" would go "an awful long way" to protecting many businesses.
"The more that organisations can do - on those basics around passwords, around access, around keeping their patches up to date ... the more we [the GCSB] will be able to focus on those high-end threats."
In response, Trustpower has rolled out a new cyber security measures to improve protection for its power network.
Last year, the GCSB blocked the use of Chinese telecommunications company Huawei in Spark's rollout of a 5G mobile data network, over national security concerns.