Senate Legal and Constitutional Affairs Legislation Committee, , 3:47:04 to 3:54:03
Officials outline the strategy for mitigating, replacing, or stopping legacy technology, noting that risk management plans for non-critical systems are due by March 2027.
Topics: Government IT systems, National security
Speakers: Hamish Hansford, Hon Jonathon Duniam, Stephanie Foster, Tim Neal, Unknown Speaker, Senator Lisa Darmanin
I think that the starting point is uh that the definition of legacy technology is often misunderstood. People think it's just old technology, but it's actually unsupported technology. And so actually trying to get to the quantum is the whole purpose of this work as you've rightly outlined. But um it is pretty clear it's going to be a significant figure. Um but I think the most important thing is what what in order to get to the point of replacement, we've got to quantify, better protect now, and that's the work that has been accelerated and in and is included in the direction.
And I think Senator making um informed choices about what actually needs to be replaced. What could be done in a different way, what could be shut down. Um so it's not simply uh a matter of going along and saying we've got all these systems and we just need to upgrade or patch them all, and this is the bill. It's actually an assessment about what does the technology estate look like at the end of this process. One of the really helpful things about the systems of government significance is it gives us a way of prioritizing what's most important.
And are we confident that you know we're not going to have uh more exposures found or attacks or breaches or unauthorised access occur between 31 December and then indeed beyond that March, the end of March next year?
Uh well, no, Senator, no one could ever give you a guarantee that there'll be no attempts of any cyber incident. If something's internet connected, it's it's at risk. And I think even the ASD um threat report out today shows that AI is enhancing the attacks that we're seeing across the economy, which means that some of the basic cyber settings that have been in place for a number of years are so much more important, and then thinking about and deploying AI to in a different way is the area that agencies are looking at and grappling with. Um but that doesn't mean that there won't be further attacks, there will be further disruptions, and I think the kind of macro point is that um we've we've thought about um 24 access, 24-7 access to systems for a very, very long time. Um what's happening in the environment means that if you prioritize security over um the system being provided, then that might mean systems are down for a short period of time, which is why you've seen websites preemptively taken down to patch and then put back up as a prioritization of security. So I think we'll continue to see that type of disruption into the future.
Yeah. And so just refresh my memory, or please explain to me again. Those two deadlines. The 31 March, what was the body of work to be completed by the end of March?
Mr. Mr. Neil will give you the um specific details in the direction.
Tim Neal, acting first this. Secretary personnel and objective security division. The March 2027 deadline includes the legacy stock take for non-systems of government significance and the beginning and implementation of a technology risk management plan, which includes a target for legacy reduction. Prioritization strategies that support delivery, mitigations to address the risks and procedures to identify those areas to rationalise the technology estate. And then December is for those systems of government significance. As the Secretary's already.
Do we have a deadline to have all of these things dealt with, though? I mean, you've talked about identifying and stock taking, very important because then you know what you're dealing with, but then there were elements of what you described just then mitigation and rationalization, etc. But do we have a point in time where the government's saying we must now be completely secure?
I think the reality is it's an iterative approach from here, and really there's three ways to address uh legacy technology. There's stopping, there's mitigating, and there's replacing. So the first instance is to stop those legacy technology pieces that have been identified in the stock take that are no longer required. The element that is kind of mitigation and replacement, that is kind of an ongoing piece, and the reality of technology is that things that are supported now will become legacy in the future. So in fact, what we're we're dealing with is an ongoing process that will need to be implemented by agencies from now in a continuous manner.
But there's obviously an urgency around this. I mean, the the uh public concern around this is such that action must be taken, government of seed action will be taken. So I'm just trying to understand by what time it is the intention to have these matters broadly resolved, noting it is an ongoing job, but I don't think we can stand up tomorrow and say to the people of Australia, oh, it's going to be a work in progress forever. So, what is the government's intention to have these matters resolved in some certain or solid way?
We will know more both internally but across government what the nature of the challenge is when the stock take has been completed and when people have been in a position to look at the different treatments that Mr. Neal just outlined. Um and our approach will be to use the systems that we currently have in place to prioritize treatment, whatever that treatment is for the most critical, the most vulnerable systems. Um we will be giving our focus to the things that matter most, but it's not going to be possible in a world of rapid technological change to say at point X everything's perfect.
Oh no, I don't think anyone can expect it to be perfect because as we advance, so do our adversaries and to the point that was made earlier.
Uh so I'm just Senator, the the stock take is not the direction, rather, is not just a stock take. As part of the direction stock takes the first bit, the second bit is a legacy technology risk management plan to pick up on exactly what Mr. Neal said. So it's not just counting what we've got, it's actually having the plan to remediate.
Yes, and I suppose I'm asking about the plan.
The date for that is also 31 March 2027.
And the plan is good, but actioning the plan. Uh so there'll be action items yet to be determined, I gather. Um so I can plan to ask you a whole heap of questions, but I'm not going to be able to today. So I'm just trying to figure out what confidence Australians who might be tuned into this for some bizarre reason will get from the time frames that this process has for resolving issues where there are exposures or sensitivities around our systems.
Senator, will be in a better position to answer that when we actually have worked with the agencies on those plans.
Yes. I won't be here for that though. I'll be watching from the other end then. Okay, we might do you want to.
Okay, come back to me.