The Times Australia
The Times World News

.
The Times Real Estate

.

Australia has a new cybersecurity agenda. Two key questions lie at its heart

  • Written by Jeffrey Foster, Associate Professor in Cyber Security Studies, Macquarie University

The federal government is pursuing a new cybersecurity agenda in the wake of last year’s major cyber breaches with Optus[1] and Medibank[2].

“For businesses these days, cybersecurity is as important as having a lock on the door”, said Prime Minister Anthony Albanese in opening the government’s cybersecurity roundtable in Sydney on Monday. There, Minister for Cyber Security Claire O’Neil released a discussion paper[3] that seeks to answer questions about the role the government should play in order to improve Australia’s cyber resilience.

Read more: Albanese government to appoint Coordinator for Cyber Security, amid increasing threat to systems and data[4]

The government will also create a National Office of Cyber Security, and a new role based in the Department of Home Affairs – Coordinator for Cyber Security[5].

O’Neil said the government was struggling to find appropriate responses to last year’s major hacks due to a lack of prior policy or regulation[6].

The Optus and Medibank breaches each affected around a third[7] of the Australian population. Hackers leaked personal information including drivers licenses, passports and highly personal medical details.

In both cases, government intervention was necessary, such as by creating methods for people to replace drivers license ID numbers[8].

Prime Minister Anthony Albanese and Minister for Home Affairs Clare O’Neil at the cybersecurity roundtable, February 2023
Albanese and O'Neil at the cybersecurity roundtable. Dean Lewins/AAP

The discussion paper consists of 21 questions, and many focus on how government and industry can work together.

But two questions stand out as critically important.

1. Should the government ban ransomware payments?

Whether ransomware payments should be banned is a complicated question, and one that I’ve covered before[9].

Read more: Australia is considering a ban on cyber ransom payments, but it could backfire. Here's another idea[10]

In short, a blanket ban on all ransomware payments would be unlikely to stop cyber criminals from continuing their attacks. And the damage done to businesses and critical infrastructure could be severe. A legal ban from paying to recover their systems could mean small and medium businesses can’t recover.

O’Neil has previously stated she’s considering a ban[11] on ransom payments. The discussion paper demonstrates a more thoughtful approach.

It suggests the possibility of a distinction between different types of ransomware payment bans. For example, whether the government should prohibit payment to keep stolen data secret, versus payment to unlock a company’s hacked systems. It also asks whether, instead of banning companies from paying ransom, we should instead ban insurance payouts to businesses who fall victim.

2. Should the government be able to commandeer companies’ IT systems?

The Security of Critical Infrastructure Act was introduced in 2018 in response to the growing threat of attacks against the nation’s most important systems. It was more recently expanded to include a total of 11 sectors[12] from electrical grids and telecommunications, to education and data storage.

The act is specifically about securing the systems that our critical infrastructure run on.

But the discussion paper asks whether that should expand to include the personal data held on these systems, and to allow the Australian Signals Directorate to commandeer the IT systems of companies suffering from a hack.

While a seemingly small addition to the act, the inclusion of personal data and expanded Australian Signals Directorate powers could be reaching too far[13].

Specifically, it might include handing over citizens’ personal data held by the telecommunication and health sectors to the government.

What’s more, expansions to the act in 2021 and 2022 to include data storage means virtually any company could fall within its scope.

No specific details of how this potential change could work are included in the discussion paper, but it may be a step with severe consequences.

Anything else I should know?

The discussion paper also calls for simplifying regulations as a priority.

Australia’s data laws are spread across a range of acts: the Privacy Act, the Critical Infrastructure Act, the Telecommunications Act, the National Health Act, and the list goes on. Having the requirements spread out across so many acts makes it difficult for businesses to understand their obligations when it comes to cybersecurity.

What’s more, the paper clearly outlines the need to prioritise cybersecurity workforce training, both in technical and non-technical roles.

Australia has an estimated skills shortage of 30,000 cybersecurity professionals[14].

Read more: What skills does a cybersecurity professional need?[15]

The discussion paper has many suggestions that will likely be welcomed by industry, but clearly some questions raise concerns amongst industry professionals[16] about government overreach.

At the moment, these are just questions. And industry, government and education providers will have a chance to respond to these questions over the next six weeks before decisions are finalised. Hopefully, they’ll be heard.

References

  1. ^ Optus (theconversation.com)
  2. ^ Medibank (theconversation.com)
  3. ^ a discussion paper (www.homeaffairs.gov.au)
  4. ^ Albanese government to appoint Coordinator for Cyber Security, amid increasing threat to systems and data (theconversation.com)
  5. ^ Coordinator for Cyber Security (theconversation.com)
  6. ^ lack of prior policy or regulation (www.abc.net.au)
  7. ^ a third (www.theguardian.com)
  8. ^ replace drivers license ID numbers (www.abc.net.au)
  9. ^ one that I’ve covered before (theconversation.com)
  10. ^ Australia is considering a ban on cyber ransom payments, but it could backfire. Here's another idea (theconversation.com)
  11. ^ previously stated she’s considering a ban (au.finance.yahoo.com)
  12. ^ total of 11 sectors (www.cisc.gov.au)
  13. ^ reaching too far (www.afr.com)
  14. ^ 30,000 cybersecurity professionals (www.abc.net.au)
  15. ^ What skills does a cybersecurity professional need? (theconversation.com)
  16. ^ concerns amongst industry professionals (www.afr.com)

Read more https://theconversation.com/australia-has-a-new-cybersecurity-agenda-two-key-questions-lie-at-its-heart-200714

The Times Features

Why Regional Small Businesses in Bendigo Deserve Better Access to Finance in 2025

In the heart of regional Victoria, Bendigo has long stood as a beacon of innovation, resilience and community spirit. As we step further into 2025, the importance of nurturing sm...

Is It Time for a Deep Cleaning? Signs You Shouldn’t Ignore

Most people know they should visit the dentist for a regular check-up and cleaning every six months. But sometimes, a standard cleaning isn’t enough. When plaque and tartar build...

The Hidden Meaning Behind Popular Engagement Ring Cuts

When it comes to engagement rings, the cut of the diamond is not just about aesthetics. Each shape carries its own symbolism and significance, making it an important decision for...

Annual Health Exams in the Office: How They Can Reduce Sick Days and Healthcare Costs

Regular health check-ups, especially annual health exams in the office, can significantly impact the overall well-being of your workforce. A proactive approach to employee health...

Best Deals on Home Furniture Online

Key Highlights Discover the best deals on high-quality outdoor furniture online. Transform your outdoor space into a stylish and comfortable oasis. Explore a wide range of d...

Discover the Best Women's Jumpers for Every Season

Key Highlights Explore lightweight jumpers for spring and summer, ensuring breathability and ease. Wrap up warm with cozy wool jumpers for the chilly autumn and winter season...

Times Magazine

The Essential Guide to Transforming Office Spaces for Maximum Efficiency

Why Office Fitouts MatterA well-designed office can make all the difference in productivity, employee satisfaction, and client impressions. Businesses of all sizes are investing in updated office spaces to create environments that foster collaborat...

The A/B Testing Revolution: How AI Optimized Landing Pages Without Human Input

A/B testing was always integral to the web-based marketing world. Was there a button that converted better? Marketing could pit one against the other and see which option worked better. This was always through human observation, and over time, as d...

Using Countdown Timers in Email: Do They Really Increase Conversions?

In a world that's always on, where marketers are attempting to entice a subscriber and get them to convert on the same screen with one email, the power of urgency is sometimes the essential element needed. One of the most popular ways to create urg...

Types of Software Consultants

In today's technology-driven world, businesses often seek the expertise of software consultants to navigate complex software needs. There are several types of software consultants, including solution architects, project managers, and user experienc...

CWU Assistive Tech Hub is Changing Lives: Win a Free Rollator Walker This Easter!

🌟 Mobility. Independence. Community. All in One. This Easter, the CWU Assistive Tech Hub is pleased to support the Banyule community by giving away a rollator walker. The giveaway will take place during the Macleod Village Easter Egg Hunt & Ma...

"Eternal Nurture" by Cara Barilla: A Timeless Collection of Wisdom and Healing

Renowned Sydney-born author and educator Cara Barilla has released her latest book, Eternal Nurture, a profound collection of inspirational quotes designed to support mindfulness, emotional healing, and personal growth. With a deep commitment to ...

LayBy Shopping