Senate Finance and Public Administration Legislation Committee [Part 2], , 1:26:45 to 1:30:20
Examination of legacy systems, the Medicare statistics portal breach, and the use of monitored email addresses for security disclosures.
Topics: Government IT systems, Online safety
Speakers: Senator The Hon Jane Hume, Dr Caralee McLiesh, Lisa Croswell, Unknown Speaker, Speaker 1
>> Okay. Um the December 2025 report said that the agency had no technology security risk management plan by the 30th of June 2025. Was that something that was identified in the 2024 report?
Just one moment. We'll see if we have We have that. I might need to take that on notice or come back to you in the hearing if we can identify that. Yeah.
>> Okay. Did the cyber incident management policy promised to the ANAO for development beginning in March 2024 come into force by the time you were conducting the 2025 audit?
>> Again, um I think we will take that on notice. Yep.
Uh, as part of your audits, were you aware that Services Australia was managing a monitored email address for disclosures, the um the public disclosures at servicesaustralia.gov.au or was that created after your reports?
>> Um, we looked at their processes, uh, but I wouldn't have the detail of whether that specific because that we would not have included that detail in the report. Right.
>> Okay. So, you don't know how long that public disclosures email address has been around. Okay. That's the first I've ever heard of an email address like that. You know, if you think that there's been a, you know, a breach, please contact us on this email address. That kind of because it's such a surprise and unusual thing. In your view, is that an appropriate meth method for picking up potential critical security breaches or reports?
>> Um, agencies have a a range of ways of gathering information, they often use um a a mailbox or a generic account um so that if the rather than an a specific individual because if a specific individual moves roles then you risk not picking things up. So having a sort of a a generic account wouldn't necessarily be unusual.
>> Okay. What I found unusual about it was it was only monitored once a day rather than sort of automatically or there was some sort of automatic escalation if a breach was reported. I would have thought that ANAO would having recommended some clear reporting time frames in 2024 would have potentially addressed that
We did highlight the lack of clear escalation paths and time frames for reporting uh major infiltrations to bodies like uh ASD,
>> right?
>> Um so certainly our our recommendations were related to this issue if not specifically about the uh website in question.
>> Right. Okay. So it sounds like you know your recommendations was were about this but this still persisted despite those recommendations. this rather strange or unique method of reporting. >> And escalating.
>> Yeah. I mean, a comprehensive cyber security uh incident management policy would have those clear escalation path pathways and time frames for rapidly notifying the relevant authorities of infiltrations.
>> Okay.
>> Senator Hume.
>> Sure. I'll come back to this.
>> Yep. We'll go to Senator Popok.