NZX said it will continue to improve its IT systems and cybersecurity over the coming months – and that the associated costs “are likely” to be passed on to its clients.

This comes after another year saw some hot prospects for local IPOs, including Laybuy and Aroa Biosurgery, finally choose to apply across Tasman.

In a statement this morning, the exchange did not provide figures on the ongoing security enhancements, but offered that “no impact on the FY2020 earnings guide”.

In the December 2 update, NZX said it expects ETC for the 2020 financial year (which coincides with the calendar year) to be “above the $ 30 million to $ 33.5 million guidance range”.

The exchange will not comment on any impact on its FY2021 guidance until it submits its full year FY2020 report on 17 February.

Today’s statement comes following the completion of a series of independent reviews of clearing and settlement incidents during March and April this year, and multi-day outages caused by DDoS (distributed denial of service attacks) in late August and early September.

The review by EY and local InPhySec security officers has looked at some of the steps being taken to tighten security.

But the bourse said it was still in the process of approving a formal action plan for the coming months with the Financial Markets Authority. Once that’s done, it will be in a position to break down costs.

This morning’s statement indicates that great work is at hand.

“NZX recognizes the need for further technology investment in 2021, particularly in the business market, to enhance the stability and resilience of its technology framework,” the exchange said.

“This includes enhancing the Securities IT team and cybersecurity countermeasures, taking into account the prices associated with market participants. NZX is very advanced, along with market ecosystem participants, to a massive upgrade to its core trading system around the end of March 2021,” he added.

“The board has yet to consider the consequences of pricing for NZX services, but some cost recovery process is possible.”

NZX is also looking to implement a series of changes recommended by its new Technology subcommittee, made in November, including better crisis management, better communication “with the ecosystem”, and “strengthening NZX’s IT organizational structure with a set of specialized expertise.” .

The head of information exchange, David Godfrey, Stop on September 28, a day after the big daylight saving blunder that occurred after the previous DDoS attack and outage cleanup. No reason was given for his departure. A spokesman said it was not related to various IT issues. NZX has not yet named the new CIO.

Although no costs were disclosed today for IT and cyber security enhancements on the train, NZX provides a reference point for its latest major upgrade, saying: “NZX started its technology infrastructure modernization program in 2017, with $ 12 million invested over a four-term. years to 2020, in projects focused on clearing, upgrading of trade infrastructure and systems, modernization and capacity building. “

This morning, a spokesperson said NZX had shared the full EY and InPhySec reports with law enforcement and regulatory authorities, but would not publish them due to safety concerns, in line with GCSB advice.

The general summary released on December 4 provides no detail on the big questions surrounding DDoS attacks including whether the attackers are politically or commercially motivated, where they are or what ransom, if any, they demand to stop smothering exchanges with automated bot attacks.

Today, the exchange said: “NZX accepts that it does not meet its own high standards in certain areas of its technological systems.”

Despite little detail offered in the December 4 summary of the EY and InPhySec report, the exchange said: “InPhySec says the severity of cyberattacks is beyond anything that has been seen before or can reasonably estimate – the volume, sophistication and persistence of attacks that have never been before. happened before in the New Zealand context, and was one of the most severe we are aware we have experienced internationally. It is said that the attack fundamentally changed expectations about this kind of attack for the industry. “

It said NZX had “assisted in managing attacks by getting very advanced with a significant network upgrade starting in 2019”. Work on these improvements with Spark, “creating a ‘fit-for-‘ team which means NZX can respond quickly and effectively”.

The decision “to engage Akamai, a leading global cybersecurity company, was also highlighted as being at the core of NZX in responding to threats”, in an independent report, according to an exchange summary.

Akamai’s content network delivery specialist last made headlines in New Zealand at some point in time rocky partnership with Spark during the 2019 Rugby World Cup.

GCSB is also bound to help.

During the DDoS attack, NZX emphasized that only its website, not its trading system, was attacked. However, it had to suspend trading for the first few days of cyberattacks because, with its site down, its ongoing disclosure obligations were not fulfilled.

The exchange is turning to alternative means of getting market participants to information as DDoS attacks continue.

On September 18, after the dust settled, NZX launched alternative site for market announcements, accessible if the main site is taken offline by another DDoS attack – apery tactic adopted many years ago by MetService.

NZX Ltd shares rose 1 percent to $ 1.98 in midday trading.

Its stock is up 47 percent for the year.