Open questions
- What specific control gaps did APRA and OAIC identify in Medibank's implementation of CPS 234 and APP 11 obligations?
- How did the single-factor VPN without MFA (W1) interact with unmanaged endpoint credential sync (W2) to enable initial access?
- What evidence exists regarding the SOAR/alert-triage failure (W3) and its contribution to delayed detection?
- What remediation and governance changes were mandated or recommended following the breach?
- How does Medibank's organigram and data-holding profile map to its information-security accountability structure?
- How did the single-factor VPN without MFA (W1) interact with unmanaged endpoint credential sync (W2) to enable initial access?
- What evidence exists regarding the SOAR/alert-triage failure (W3) and its contribution to delayed detection?
- What remediation and governance changes were mandated or recommended following the breach?
- How does Medibank's organigram and data-holding profile map to its information-security accountability structure?