http://www.copyright link/news/special-reports/defence-innovation/dealin...

http://www.copyright link/news/spec...ersecurity-threat-20161121-gsubpz?logout=true

If you have information that can be used by another person to his or her advantage, it could well be stolen. It's as simple as that. In 2015-16 CERT Australia, the government's Computer Emergency Response Team, responded to 14,804 incidents affecting Australian businesses, 418 of which involved systems of national interest as well as critical infrastructure.

That undoubtedly understates the number of attacks experienced by Australian firms, who usually under-report, and does not include attacks on Australian government websites.
According to industry sources, the average cost of a cyber attack for Australian businesses is about $622,000 and about three quarters of all Australian businesses have been attacked in the past year, and as many as one third in the past month alone. Globally, between 2 and 5 per cent of global GDP is tied up in criminal hands – at worst that's equivalent to the national GDP of the fifth-largest economy in the United Nations, and much of that money derives from cyber crime.

At US$71 billion ($96.46 billlion) annually, cyber security is a massive global industry fighting a threat you can no longer ignore. All these statistics may be arguable, but the reality is likely to be worse.

The Commonwealth government thinks so too, which is why it released its Cyber Security Policy in April this year. The Prime Minister followed up with a couple of key appointments: junior defence minister Dan Tehan, MP, was made Australia's first Minister Assisting the Prime Minister for Cyber Security. And long-time cyber security expert Alastair MacGibbon was appointed special adviser to the Prime Minister on cyber security, another entirely new position based in the Department of Prime Minister & Cabinet, which is responsible for national cyber security policy.

Recently another Canberra-based expert, Dr Tobias Feakin, who heads the Australian Strategic Policy Institute's International Cyber Policy Centre, was appointed Australia's first Ambassador for Cyber Affairs. Overall, this new policy area has some $230 million behind it, a signal of the priority that the PM himself affords this initiative. There's a further $400 million allocated to cyber security in the 2016 Defence White Paper.
Minister Tehan will be making his first major speech on Cyber Security later today to the National Press Club in Canberra. There, he will be setting out his role and his vision for the implementation of the Cyber Security Policy and its five themes of action over the coming four years:

1.   A national cyber partnership
2.   Strong cyber defences

3.   Global responsibility and influence
4.   Growth and innovation
5.    A cyber smart nation

The Minister told The Australian Financial Review he had some priorities. Among them: "We will increase the Australian Signals Directorate's (ASD) capacity by 100 new staff to help identify new and emerging cyber threats to our security and improve intrusion analysis capabilities.

"The Government will also enhance ASD's capacity to assess Government agencies' vulnerabilities, provide technical security advice and investigate emerging technologies. Government agencies will also be independently assessed on their implementation of ASD developed strategies to mitigate targeted cyber intrusions," he said
The policy also calls explicitly for government and industry to work together - this needs a trusted community of players. And that community is international – a globalised economy needs an open, free and secure internet: hence the appointment of Dr Feakin.

Dr Feakin, MacGibbon and the Australian Centre for Cyber Security form a critical triumvirate. ACSC is moving to a new headquarters in Canberra's Brindabella Park, along with elements of ASIO, the AFP, Defence intelligence, the Australian Crime Commission and others. Between them, they provide a whole of government focus on national cyber threats as well as expert insight and a secure environment for industry, academia and overseas allies to develop a common approach to cyber security.

However, the policy acknowledges that no one department, or agency, or company, or even nation, has a monopoly on the skills and resources necessary to fight cyber threats. "This is a step-change in the way the Commonwealth government views the ubiquity of the need for strong cyber defences," MacGibbon says. "While on counter-terrorism the government leads, on cyber security it partners and tries not to inhibit."

The majority of cyber targets lie outside the government's purview. The major threats come from four areas: nation states, who seek intelligence, for military or commercial ends, or to disrupt; criminals, who simply follow the money; issue-motivated groups, whose focus is usually on a political outcome; and insiders, who might be malicious or just unwitting agents of the malign. So the government is also developing a Joint Cyber Security Centre in partnership with industry as a hub to share information about the threat as well as co-develop responses.
Identifying threat actors enables us to see our data and systems through different eyes, and value them differently, MacGibbon says. Understanding what motivates attackers helps us to better prioritise our protective efforts.
A new industry-led Cyber Security Growth Centre, due to come on-stream by the end of this year, will help industry, researchers and governments develop world-class research and technical skills.

However, you cannot solve the cyber challenge just by spending a bit more money on a technical fix. Most industry observers agree security is an end to end problem. It requires the right technology as well as the right processes, as well as education and training, and the right people.

While emerging technologies such as Quantum science promise to transform encryption and communications switching, the low-hanging fruit keeps returning: laziness, stupidity, "finger trouble" and malign intent, demanding continuous training and education of employees and managers.

Without doubt it is a whole of organisation challenge and the increasing likelihood and cost of a cyber attack means corporate leaders, right up to board level, must drive an organisation's defensive response.
That said, awareness has spread, says Tehan: ASX 100 companies have been urged to undertake cyber security health checks. The intent is to ensure boards assign appropriate governance resources to the understanding of security risks and opportunities.

Also, Australia's overhaul of its cyber strategy and resources has delivered results, according to Alastair MacGibbon: "Australia's pretty well placed with the capacities we have."
· Dr Gregor Ferguson is the Executive Manager Industry Development of Industry Defence and Security Australia Limited, the organiser of the CIVSEC Security Congress and Exposition. This article reflects his personal views and not those of his employer.