Senate Legal and Constitutional Affairs Legislation Committee, , 3:54:03 to 4:02:49
An update on Horizon 2 of the Australian Cybersecurity Strategy, focusing on the 'human firewall,' small business resilience, and the success of anti-scam public awareness campaigns.
Topics: National security, Online safety
Speakers: LTGEN Michelle McGuinness, Ciara Spencer, Senator Lisa Darmanin, Unknown Speaker, Stephanie Foster
Yeah, sure. Thank you very much. Senator Darmanin.
Yes, absolutely, Senator. Um, so Horizon 2 was initiated by the Minister back in June this year, and really um sets a Slayer focused on three key priorities. One is uh strengthening people as our greatest defence. The minister often calls it the human firewall, but it's providing that support to citizens both in their homes, workplaces and businesses to empower them to provide the right culture and the right organizational structures and institutional processes that support our technology. The second is a strong focus on our government and critical infrastructure, and it plays out in the designation of our systems of government significance. We'll also be mapping our critical supply chain underpinning the critical infrastructure and key government systems and then providing additional support in exercising those supply chain, as well as providing additional tools to businesses to uplift themselves and exercise themselves. And the third lens is really about the safe and secure adoption of emerging technology and uh and that is how do we embrace the opportunity of emerging technology, including uh frontier AI, in order to uplift our security and defences, but also preparing for post-quantum cryptography.
Thank you. Um, in terms of the human firewall, it sounds like just in terms of the strategy, you talked about it's exactly that being the humans well equipped and resourced as much as they can be. Um can you talk a bit about more a bit more about this one in particular and you know why your assessment why the assessment is that this is important?
Yeah, absolutely. Um, Senator, we know that when um organizations are prepared, not just with the right technology stack, but with the right culture, the right training, the right preparedness, the right exercises, and they fare much better. And this strategy uh is about resilience rather than preventing every tack, but how are we strong enough to identify and respond quick and recover quickly? Um I might hand to my colleague um Miss Spencer.
Thank you. The focus really is on behavioural change and particularly um with Horizon 2 to focus on small and medium businesses and not-for-profits where we are seeing people need the most support. Um in terms of uh delivery of Horizon 2, we've delivered five of the 64 initiatives to date. Um that includes setting up a not-for-profit cyber uplift community practice, and also working on an industry data classification framework as well as a smart device labelling scheme pilot program. And the intention of that again is to make sure that the general public can have confidence in the tech that they're buying, that it has inherent cyber security there, alongside that general uplift in terms of the basics of cybersecurity and how to protect themselves online.
And so five out of sixty-four initiatives, like um how do you see it rolling out in terms of a time frame and kind of getting across small medium enterprises and NFPs is a very large community to work with. Absolutely.
Mr. Bell to talk about that in more detail. Uh thank you, Senator Ashley Bell, uh, Assistant Secretary for cyber policy and programs. Uh, as you mentioned, the small business and not-for-profit sector is uh incredibly large. Uh and one of the big focus uh points for Horizon 2 is actually getting into that scale. So there's a lot of great programs out there around cyber resilience, as the coordinator noted. Um it is about resilience, but it's also about reach. And I think uh where we can increase resilience of a small business in the hundreds or the thousands, that's great work, but we are looking at the 2.5 million small businesses, and so part of the work we've done through uh establishing the Cyber Smart program, which uh we had a recent town hall with industry to go through what cyber smart will be. Uh part of the reason uh we're taking that sort of structural approach is to say how do we look at standards that will apply to all small businesses at low cost in a way that's easy to implement uh and that is actually fit for purpose.
Yeah, thank you. Um and just on supply chain um I think and Lieutenant General McGuinness, you talked about um mapping that as one of the other pillars. Um can you explain um a bit more in detail what uh some of the things the government's doing to strengthen supply chain resilience?
Um what we're finding is that there is a concentration of risk. And we're trying to encourage um businesses and industry to look at that risk. It's not necessarily a bad thing, but you need to understand the concentration risk and have initi uh plans in place to mitigate that. So some of the work we do, and that's led by the coordinator is around exercising, but also just providing clear guidance and understanding of how to assess your supply chain risk, uh, how to build up the cybersecurity resilience within it, um, and ensure that every member of your supply chain is aware of the risk because you're only as protected as the the lowest common denominator. The other thing we're doing more broadly is we have recently signed a digital resilience agreement with Microsoft. And what that does is work with large hyperscalers that most of industry and government use to say to them, here are the strategic risks we're facing. We want to work more closely with you and together build our resilience to some of these consider um concentration risks.
Senator specifically with the supply team mapping, we'll um map that critical dependency that we see across both critical government systems and critical infrastructure systems. And then we'll provide scalable exercises for them to both exercise themselves but also to participate in more tabletop exercises within sectors and cross sectors.
All right. For the Commissioner, you know, um I wondered if you could talk. I I think um across the economy. So outside of perhaps the world of people who are more familiar with the these concepts, what are some of the lessons that you've learned from the recent cyber incidents that you think should be known across the economy?
Thanks, Senator. I think the long-standing advice since I've been in this role is really the key actions that we promote under our Act Now Stay Secure campaign, which include having unique and long passphrases for every different account. Always applying multi-factor authentication when it's available and rapidly updating your software, whether you're a business for patching or installing new software when it becomes available. We know that these foundations still make a significant difference in building our resilience in our cyber posture. We also encourage um Australians to recognise scams to actually recognise, which has become easier with the uh technological evolution as AI can become more convincing. Um we are asking and giving uh our citizens additional resources to recognise those things and importantly, the National Anti-Scam Centre recommends that we stop, think and protect and just taking that moment, and if you're unsure, not being so urgent that we know that our cyber criminals will try and force urgency and make them feel make us feel like we know them and that they're familiar and that we should respond. So we um actually finished up uh phase four of our ACNASA secure campaign in May this year, and once again the campaign performed um at an above or above benchmarks uh with more than three out of five people who are interacted with the campaign taking an action to make themselves more secure.
And I think you got an award.
And that campaign did win a bronze award at the FES as well for and that those awards are about the impact that advertising and marketing actually has. So that's the result of some great marketing and communications experts working with us to get that message out.