Below are areas that we believe require attention and focus with regards to Cyber Security Strategy for NSW:
1. Government, Organisations and the Community need to work together as a community in sharing intelligence on new attacks, so we can better understand how to defend and detect these emerging attacks. How do we become better than the Cyber Criminal community with sharing intelligence?
2. Supply Chain Management requires urgent attention. This is particularly important due to the impact of the following factors:
The impact of COVID-19 Pandemic has hampered the Supply Chain and the Availability of resources (including Data)
Globalisation and the increasing amount of supply chains emerging for organisations to operate.
Recent significant attacks against Australian communities and targeted attacks against sensitive Government Data highlights the importance of having proper visibility over the Government Data and its protection within the Supply Chain. This includes an appropriate identification and profiling of all 3rd Party and 4th Party suppliers with access to Data and also being able to measure their Data Sovereignty and Cybersecurity capabilities.
3. We also recommend that the new Cyber Security Strategy should emphasise on the importance of Continuous Monitoring and Assessment of the Cyber Security capabilities. What we found in this area is that these assessments are conducted in a silo approach with no or minimum engagement from the senior management team. The Cyber Security Strategy should demand further involvement of the Senior Management team as the key accountable entity around Cyber risks. As we know, CyberSecurity is positioned as a core business function for organisations today. However, we are not witnessing the effort from the organisation's leaders as non existed in many cases and only became involved once a breach has occurred. 4. We have witnessed the shortage of capability and the increase in rising costs as the industry has become extremely reliant on professional services to improve Cyber Risk and posture. We believe the industry must focus on technology and automation for fundamental and straightforward tasks such as security analysis and technical assessment as examples. This will lower Cyber cost and improve the resources of Professional Services required for critical areas that are challenging within Cyber Security such as detection and incident response. this will help the burden we have today with shortages on capability. Resources are required to be used more efficiently and smarter. Not for areas that can be managed by-product at a lower cost. Education is required on this subject to the industry. 5. We also believe that when it comes to Cyber, our government is highly dependent on overseas technology companies and has less attention to Australian companies. Example of this is the recently published Australian Cyber Security Strategy in which the first page is a quote from the US-based Palo Alto solutions. The NSW Cyber Security strategy should demand further collaboration and information sharing between the government and Australian Cyber leaders. This will create a healthy ecosystem that, in the long term, can turn us into a true international leader of Cybersecurity. 6. The other lesson learned from the recent targeted attacks against Australia was the classic mentality of "focusing on Preventive Controls" within the Cybersecurity professionals. The new Cyber Security Strategy should focus more on improving the Detection and Response capabilities within the organisations. This initiative must be supported by providing continuous awareness on the importance of Detection and Response capabilities and accepting the fact that this is highly probable that their Data is already being breached so how quick and efficient can they detect and respond to this matter.