Australia’s 2020 Cyber Security Strategy

1 Australia's 2020. Cyber Security Strategy A call for views Commonwealth of Australia 2019. With the exception of the Commonwealth Coat of Arms, all material presented in this publication is provided under a Creative Commons Attribution International license at: This means this license only applies to material as set out in this document. The details of the relevant license conditions are available on the Creative Commons website at: as is the full legal code for the CC BY license at Use of the Coat of Arms The terms under which the Coat of Arms can be used are detailed at the Department of Prime Minister and Cabinet website: Contact us Enquiries regarding the licence and any use of this document are welcome at: Cyber Security Policy Division Department of Home Affairs 4 National Circuit Barton ACT 2600. Submissions are welcome at discussion-papers/ Cyber - Security -strateg y-2020/submission-form Australia's 2020.

2 Cyber Security Strategy A call for views 2 Australia's 2020 Cyber Security Strategy Table of Contents Foreword 4. Introduction 5. Where we are now 6. Positioning ourselves for the future 8. Government's role in a changing world 9. Case Study: How can Government proactively address national Cyber threats? 10. Enterprise, innovation and Cyber Security 11. Case Study: Europe's Network and Information Security Directive 12. A trusted marketplace with skilled professionals 13. A hostile environment for malicious Cyber actors 14. A Cyber -aware community 16. Other issues 17. Taking things forward 18. Call for views 19. Appendix A: Progress against Australia's 2016 Cyber Security Strategy 22. A call for views 3. Foreword Cyber Security has never been more important For nationally significant systems, such as those to Australia's economic prosperity and national that control our power and water, Australia Security .

3 In 2016, the Australian Government must position itself as a world leader in Cyber delivered its landmark Cyber Security Strategy , threat detection, prevention and response. which invested $230 million to foster a safer This means government and industry will need internet for all Australians. Despite making strong to work closer together than ever before. progress against the goals set in 2016, the threat For individuals and families, I want to ensure environment has changed significantly and we more support and assistance is provided to need to adapt our approach to improve the keep them safe online. Every Australian should Security of business and the community. have the confidence that they can keep Cyber criminals are more abundant and better themselves and their family safe while taking resourced, state actors have become more advantage of the online world. sophisticated and emboldened, and more I encourage all Australians to have a say in this of our economy is connecting online.

4 Cyber discussion paper from small businesses to Security incidents have been estimated to large corporations, tech experts to interested cost Australian businesses up to $29 billion per individuals. Together we can build on what we year and cybercrime affected almost one in have already achieved and take the next steps three Australian adults in 2018. At the same towards a stronger and more prosperous time, serious Cyber incidents like WannaCry, Australia. Cloud Hopper and the intrusion into Australia's parliamentary networks illustrate the threat to I look forward to hearing your contributions our economy, democracy and way of life. and insights. For businesses, a more secure cyberspace will support the delivery of digital services that Australians have come to rely on. Cyber Security The Hon Peter Dutton MP. will underpin our future economic growth and Minister for Home Affairs ensure we remain competitive globally as 5 September 2019.

5 Australian enterprises innovate and find new ways of creating value for their customers. 4 Australia's 2020 Cyber Security Strategy Introduction The internet is an essential part of life for networks, universities and key corporate entities many Australians. We use it to work, stay in illustrate that the threat continues to be touch, access entertainment, pay the bills and significant. Even smaller scale Cyber incidents manage our finances. At the same time, more affecting families and local businesses often of the things around us are connecting online, lead to financial loss, business interruption, including our cars, household appliances and identity theft and psychological stress. industrial machinery. The benefit this brings is We want to explore with you how Australia can enormous, but it also exposes us to new threats position itself to meet Cyber threats, now and from those who wish to do us harm.

6 Into the future. In forming a view, we will need to Australia's 2016 Cyber Security Strategy set consider whether responsibilities are appropriately out Government's plan to strengthen our Cyber assigned in keeping everyone safe. This will require resilience and Security . The Strategy , backed a thoughtful discussion about how Government, by a $230 million investment, built Australia's businesses and individuals can share responsibility Cyber Security foundations and raised national for Cyber Security in the future to get the best awareness of online threats. Since 2016, we outcome for everyone. have opened the Australian Cyber Security For the Strategy to be successful, we need to Centre within the Australian Signals Directorate develop and deliver it in partnership with the to be the single point of Cyber expertise for the Australian community. This discussion paper Australian Government. We have also formed seeks views from all Australians about how Joint Cyber Security Centres across the country to grow Australia's Cyber Security and future to work more closely with industry, and we have prosperity.

7 Cyber Security affects us all and created a 24/7 Global Watch to respond to we are seeking views from small, medium and critical Cyber incidents. large businesses, industry bodies, academia, The rapid pace of change in cyberspace advocacy groups, not for profits, government and the extent of our reliance on the internet agencies, community groups and members means we cannot be complacent. A loss of of the public. We have posed a series of an essential service like electricity, water or questions you may wish to answer as you transport has the potential to cripple the offer your thoughts. economy, cause social unrest and, ultimately, By working together, governments, academia, damage our welfare and way of life. There are industry and the community can strengthen our also many who seek to undermine our strong nation's Cyber resilience across the economy to and enduring institutions. Recent incidents such ensure we prosper as a nation and protect our as compromises of the Australian parliamentary interests online.

8 A call for views 5. Where we are now We have made a lot of progress since the Invested in skills and education, including release of the 2016 Cyber Security Strategy . through Academic Centres of Cyber We have: Security Excellence at the University of Opened the Australian Cyber Security Melbourne and Edith Cowan University, Centre to bring together the Government's and national Certificate IV and Advanced Cyber expertise in one location and Diploma qualifications. strengthen our ability to meet current Further detail on progress against the 2016. and emerging threats. Strategy is at Appendix A. Built stronger partnerships with businesses, While we have delivered these outcomes, governments and academia, including we have also noticed growth in the scale through the establishment of Joint Cyber and severity of malicious Cyber activity. Cyber Security Centres in five capital cities. criminals continue to target Australians and are Established a 24/7 Global Watch to enabled by tools that are cheap and widely respond rapidly to Cyber incidents available.

9 The most basic do not require a high and launched as a new level of technical knowledge, making it easier to one-stop-shop' for Cyber Security advice. undertake criminal activities. Valuable personal Shown international leadership by information, which can be used for financial appointing an Ambassador for Cyber fraud or other serious crimes, is a major target. Affairs, strengthened our commitment State actors are also growing more organised, to act in accordance with existing confident, and sophisticated in using Cyber international law and agreed norms of espionage and interference to promote their behaviour in cyberspace, and supported national interests. Malicious Cyber activity activities that build Cyber capacity across includes efforts to influence public opinion and ASEAN and the Pacific. interfere in democratic processes. This includes Publicly attributed significant Cyber the hack and release' of sensitive information, incidents to multiple nation states.

10 Which is intended to embarrass the target and Supported our domestic industry through damage their reputation with the public. AustCyber (the Australian Cyber Security While new threats are constantly appearing, Growth Network), Austrade's Landing Pad known vulnerabilities and basic techniques Program and a $50 million investment that have been used for decades also remain in the Cyber Security Cooperative effective against networks that lack baseline Research Centre. 6 Australia's 2020 Cyber Security Strategy Cyber Security . Adversaries of all kinds routinely threaten physical safety, economic Security , scan the environment for easy targets. Many and the continuity of Government and Australians continue to fall victim because they its services. fail to observe, or are unaware of, basic online Australians are relying on the internet and Security practices. digital services more than ever. Technologies Against this backdrop, Australia's such as automation, artificial intelligence, critical systems, including in the energy, virtual reality and the internet of things will telecommunications and transport sectors, are continue to transform the way we live, work and becoming increasingly digitised.