Senate Finance and Public Administration Legislation Committee [Part 2], , 2:29:07 to 2:36:12
Examination of Services Australia's reliance on aging legacy ICT systems and the slow pace of addressing audit findings related to IT governance and user access.
Topics: Government IT systems, National security
Speakers: Ian Goodwin, Senator The Hon Jane Hume, Lisa Croswell, Speaker 1, Unknown Speaker, Nathan Callaway
>> Okay. That is quite concerning. As part of your report, you also noted that Services Australia removed cyber security incidents from its general incident management and escalation policy and we discussed that earlier and that was back in June n uh 2023. Did the agency ever explain to you why that was so
>> Not as part of this audit.
>> Not no was probably part of the earlier was that part of the earlier audit?
>> Yeah. So I might just senator just try and um so the two audits don't um necessarily stitch together. They're looking at slightly different objectives. Um so there's two there's two angles I think to to your question. One is that privacy risks can arise from technology risks and that was that was a one of the things that the audit was looking at. um in the context of services Australia, it does rely on a large number of aging legacy ICT systems >> and that then has means that the the accountable authority is you know should practively seek out vulnerabilities that may be present from those systems. So to your earlier question, senator of notifiable data breaches, um in the context of technology risks, um the audit identified that back in 2019 2020, um the number of notifiable data breaches that related to a malicious or criminal attack from a technology risk was three, but by 2425 that had increased to 82 notifiable data breaches. All right. So what what the order then sort of inquired was whether services Australia had developed a techn technology security risk management plan um as they're required to do under the PSPF. Um they had not they produced a technology asset stock take that was required by that direction um and they were still working at the time of the audit still working through that. uh the I might just uh to your earlier question Senator just come also back to this issue of the IT controls. So in the report um it's in chapter 3 because we're our office looks at um an agency through our financial statement audit work as well as our performance audit work. our financial statements audit work had identified in what we call the interim report on financial controls that there were seven moderate findings um against services Australia relating to controls over IT systems relating to user access um five five of those relate to IT governance privilege user access management monitoring of super users the Medicare mainframe and user access management
>> are they all legacy systems
>> so they all relate to their legacy systems. >> Um and probably the point just to note >> is that of five of those five findings, four of those were unresolved after 2 years.
>> After two years. >> Okay. So that's interesting that the 2024 report noted that Service Australia had not undertaken a post incident review or a lessons learned exercise following a largecale data breach following H um involving HW or Esworth lawyers. Was that one of the ones that you are
whether that relates specifically to that matter. Um, as you'd appreciate, Senator, when we're doing our audit, we're auditing of um, systems and frameworks rather than necessarily investigating a specific incident as an investigation. So, the the issues I just spoke to around IT, governance, privilege, user access, super user access is really speaking around the framework of how they manage those those systems from a controls perspective.
>> Okay. The way you have described both of these two reports does sound like a and obviously in the light of the recent breach um of the uh Medicare uh uh information portal that has had so much um publicity and coverage. This sounds like a cultural thing with services Australia that these systems have been reported, these breaches have been reported, audits have been done, but there doesn't seem to be an adequate response or a sense of urgency in its response. Am I imagining things or is is is that what these reports are telling you that there doesn't seem to be any um uh momentum towards addressing the problems that the ANAO has has
>> Senator, one of the recommendations that we made in the cyber incidents report was that services Australia develop post incident and learning approaches. Um so the that report did go to that sort of trying to encourage a learning culture where incidents happen. Um through our financial statement audit work as Mr. Goodwin has mentioned there addressed. some of the findings in that financial statement space. Um the the reason that they do take a while is because of complexity of the systems involved and and the processes. Um and uh we have encouraged services Australia over a number of years um to review their controls and processes um and to try and implement um control procedures that are easier to maintain on an ongoing basis. Because the other issue is once something's in place if the control is more manual and because the technology is old so you need a manual control uh it is harder to maintain over
>> Okay. just and just to um touch on what Miss Craswell said and to your question Senator um while we don't comment on culture I would just point you to paragraph 3.70 of the 2025 audit u where the audit journal in respect to the IT control of finding said that while services Australia is taking actions to address control reports [clears throat] findings and recommendations it is not doing so at a pace commensurate with the higher privacy risks associated with the increase ing volume of data breaches and malicious actors.
>> I think that's mentioning culture without mentioning culture, Mr. Goodwin. Thank you. Thank you, chair. the ANAO for joining us today. Um, sorry for the delay in the timing. I know that you couldn't think of anywhere you'd rather be. So, thank you very much for joining us. I would now ask for the Department of Finance to uh come to the table as swiftly as they can.