Senate Finance and Public Administration Legislation Committee, , 2:28:57 to 2:34:18
Examination of the ANAO audit into DPS cyber security, focusing on 'partly effective' findings and the accuracy of maturity level assessments.
Topics: National security, Government IT systems
Speakers: Hon Jane Hume, Nicola Hinder, Mike Webb, Speaker 3, Senator Karen Grogan
>> Okay. I I'm acutely conscious that that ANAO report uh which was titled management of cyber security and DPS concluded that the department of cyber security was only partly effective and it outlined that um DPS had partly effective baseline of essential cyber security strategies. The essential eight uh cyber security strategies had not been fully implemented in accordance with requirements of the protective ser security policy framework and compensating controls were not sufficiently effective to mitigate the full extent of the risk. Now that sounds terrifying to me. Can we first just establish that it would be fair to say that the parliamentary computing network is a would be a very high value target for malicious actors. That's correct.
Uh, Senator, I think we'd be very fair to be able to say that any system that's operated by any government agency that holds wholesale data on people, policies, program, budget, funding, um, would be a high value target and of course that would include the PCN.
>> Well, I mean, first of all, that finding of partly effective, I'm assuming that is something that is of great concern to you.
>> So, Senator, it is. And as we recognized prior to the ANAO audit by work that had been undertaken by the department as we outlined to the committee and in other submissions, >> we recognized that the PCN was not fit for purpose and for that reason we have been successful in obtaining funding to be able to do a multi-year uplift program which is now well underway.
>> Okay. Can I ask uh that report and the quote that I just gave you? It said compensating controls were not sufficiently effective to mitigate the full extent of the risk. What does the full extent of the risk mean?
>> I I'll take that one. Senator Mike Webb, chief information uh officer. Essentially what that that's referring to under the essential eight uh there are essentially two paths through it. You can there's a very prescriptive uh all of the um checks and balances for all the controls where that uh for various reasons isn't uh isn't possible or well suited to a particular system or service or particular type of network based on the on the usage or the technology within it. Compensating controls can be can be used. What the ANAO is really referring to there is uh not so much around the uh the use of compensating controls but uh DPS's um the cadence with which we tested uh the efficacy of those compensating [clears throat] controls against the intent of each of the essential eight.
>> Can I ask what what's the difference between maturity level two and maturity level three? My understanding is that in 2024 the department assessed itself as meeting maturity level two but the ANAO's report stated that DPS is self assessed as achieving maturity level three for the essential eight in 23 24.
>> So senator thank you again for that question. I think having a look at the way that the department had done its previous reporting um I think in certain circumstances and situations it it overinflated um our maturity level the maturity level that we have applied this year in both all of our reporting is realistic and factual and able to be supported by evidence.
>> Okay. So so who approved the earlier
assessments? Uh, Senator, I believe that was under the previous leadership of both the ICT division and the then
>> What was the evidence that was provided [sighs] to the secretary at that stage to support those claims?
>> Senator, I can't say. I wasn't in the position at that time.
So, did the department ever advise the presiding officers that the cyber security maturity was higher than the independent testing subsequently
demonstrated? Uh Senator um I can't speak for what the previous secretary or the previous head of the ICT division advised the presiding officers. The secretary has had a very firm approach with DPS that in the advice that we provide to both parliamentarians, all committees and the presiding officers is to be backed up by evidence and be truthful, transparent and open.
So as your evidence now is then that we can um ensure that the department's future cyber security reporting is reliable.
>> Uh senator for as long as we have our current executive team I do believe that it will be exactly that same approach.
>> Okay. Um, Senator, you the previous secretary assured this committee in 2004 2024 that um the system was fit for purpose
>> of the eight.
>> Senator Hume, I'm just going to um say that you're you're heading up towards the 20 minute mark and we do need to rotate the call.
>> Sorry. Okay. I have uh many more questions on this, so I will happily rotate the call and come back.
>> Fantastic. Um we will go uh to the president first.