Peter A Clarke

The Australian in Business on frontline in cyberspace ‘war’   and the BBC with GCHQ chief warns of tech ‘moment of reckoning’ both report on senior governmental figures in Australia and the United Kingdom warning of the impact of threats to security through the internet.

Andrew Hastie, Assistant Defence Minister, in another series of “canary in the coal mine” grabs highlights the danger of cyber attacks to infrastructure, governments and business.  There is talk of a new international cyber and meetings of critical technology engagement strategy and meetings of the governments cyber security industry advisory committee and need to counter threat actors.  He is right that major cyber attacks aimed at government institutions and major infrastructure is a threat to Australia’s digital sovereignty.  And of course the article talks up the funding of the international cyber and critical technology strategy which involves spending of $375 million.  All very worthy.

But these statements are nothing much new.  The threat from hackers has been a problem that has existed for over a decade.  Longer.  It has evolved over time, as technology has developed and opportunities to monetise the use of malware has grown at an exponential rate. The greater activities of state players has made a difficult situation worse.

Where Hastie and other government members are wrong is in having a top down approach to the ensuring that businesses and governmental agencies are properly prepared to deal with cyber attacks.  Strategies are fine.  But they have no real impact on the day to day operations of businesses, many of which have contact with government.  There is little incentive for businesses to do all that is required to minimise cyber attack.  Some see it as being in their best interests and do so without any prompting.  Some are in industries where cyber attacks are frequent and the effects are potentially catastrophic so it is normal to maintain appropriate protections, for example with banks and in the mining sector.  But most businesses spend too little time and money on cyber security including training and developing processes and protocols.  Which is where the real problem lies.  Over 80% of data breaches are caused by human error.  That bespeaks inadequate training and a poor culture.  There is no incentive for businesses to mend their ways.  The Privacy Act is a flawed piece of legislation and the regulator is at best timid and quite ineffective.  The chances of a business being penalised for not properly complying with the Privacy Act are small.  Even if a complaint is made about an organisation intefering with someone’s personal information, the Information Commissioner’s investigations are slow, highly bureaucratic and take around 2 years to resolve.  And the awards against malefactors are risibly low.  Until the Government reforms the law, arms the regulator with powers and resources to take action against those who fail to maintain adequate data security and appoints staff to the Information Commissioner’s office who are more assertive and effective all the talk of dangers is just that, talk.  The problem will still remain.

Meanwhile back in Old Blighty the head of GCHQ, Jeremy Fleming, raises similar concerns about the security challenges when adopting technology GCHQ chief warns of tech ‘moment of reckoning’     His comments that technology take up must be matched by proper security is sensible but hardly new.  That is what privacy advocates have been saying since the internet became ubiquitous and a necessary part of commerce and government activity.  It is just that Governments have until relatively recently not appreciated the public policy necessity of having proper security.

The Australian article provides:

Amid a wave of cyber attacks targeting Australian companies, critical infrastructure operators and governments, Mr Hastie told The Australian that “increasingly we’re going to see war, or coercive activities, carried out in cyberspace”.

The government’s cyber security industry advisory committee, chaired by Telstra chief executive Andy Penn, met on Tuesday to discuss the ongoing cyber-crime threat to businesses.

The Biden administration last week warned of new Microsoft Exchange server vulnerabilities, linked to China, and imposed sanctions against Russia over the devastating SolarWinds cyber attack, which compromised US government agencies and companies. Mr Hastie, who is urging Australian businesses and individuals to patch their Microsoft Exchange systems after initial security updates were ineffective, said he strongly backed the increased international focus on cyber attacks.

“This is a critical recognition that cyber is the new battlefield and we must continue to co-operate to counter threat actors,” he said. “We’ve always talked about sovereignty in territorial terms, but we need to start thinking and talking about what it means for Australia to retain and protect its digital sovereignty.

“Cyber is low cost, it’s hard to attribute when someone conducts a cyber attack, and you can do it anytime, anywhere.”

Foreign Minister Marise Payne on Wednesday said the international cyber and critical technology strategy would support responsible conduct in cyberspace in the Indo-Pacific region and protect the nation against technologies that can “significantly enhance or pose risks to Australia’s national interests”.

The critical technologies include artificial intelligence, 5G, the Internet of Things, quantum computing and synthetic biology.

Under the strategy, the Morrison government will inject $37.5m into strengthening the cyber capabilities of South Pacific and Southeast Asian countries and co-sponsor a proposal to establish a UN program for responsible state behaviour online.

“We can’t have individual states trying to dominate international standard-setting bodies in pursuit of their own economic and ideological interests,” Senator Payne said.

The US Office of the Director of National Intelligence this month warned of the growing cyber risks posed by China, Russia, Iran and North Korea. It said China presented a “prolific and effective cyber-espionage threat”, possessing substantial cyber-attack capabilities and a growing influence threat.

The threat assessment warned China “can launch cyber attacks that, at a minimum, can cause localised, temporary disruptions to critical infrastructure within the US”.

It also said cyber threats “from nation states and their surrogates will remain acute”, with hostile countries using cyber operations to “steal information, influence populations, and damage industry, including physical and digital critical infrastructure”.

Home Affairs Minister Karen Andrews, who this month took part in talks with counterparts from the US, Canada, New Zealand and Britain about cyber and ransomware attacks, said the government was working to combat threats through its legislation to “enhance security and resilience of critical infrastructure assets … from cyber crime”.

“Cyber criminals continue to pose risks to Australians and Australian businesses, and I’m committed to ensuring our response is commensurate to the gravity of this threat,” she said.

The Australian Cyber Security Centre last week updated its security advice to “critical” after new vulnerabilities were discovered in Microsoft Exchange 2013, 2016 and 2019, which could be “exploited by attackers to gain persistent access”.

Microsoft’s Threat Intelligence Centre last month attributed the attacks on its software to HAFNIUM, a “group assessed to be state-sponsored and operating out of China”.

The BBC article provides: