Australia's cyber security defence must not be outsourced

Truthfully, other than some sabre-rattling from China President Xi Jinping and the US, war is not inevitable and is unlikely to happen in this decade, some experts have claimed.

For Australia, I would argue the most pressing threat of attack would likely come from bad actors either in the form of other nations or from criminal syndicates and the war would be waged in the cybersphere.

And there's plenty of intelligence from the last decade on what a war in the cybersphere might look like.

Take Russia's attacks on Ukraine, for example. While Ukraine has been engaged in a traditional land war since February 2022, Russia has been waging a cyber war against Ukraine since the 2014 illegal annexation of Crimea, and has launched sustained cyber attacks at its public, energy, media, financial, business and non-profit sectors, attempting to disrupt services, gather intelligence and manipulate elections.

The level of Russia's success on the cyber battlefield has been mixed, though, as Ukraine's cyber defences have proven to be resilient and have certainly benefited from support and technology from other Western nations.

The cyber attacks against Medibank and Optus were a small taste of what Australia might expect from a sustained cyber attack and the response from the Albanese government, led by Clare O'Neil has been commendable. Appointing Ms O'Neil as the first dedicated Cyber Security Minister in the OECD's top 20 indicates how seriously the government is taking the cyber threat, and the need for urgent reform.

One of Ms O'Neil's first pledges was to concentrate on building a cyber security strategy focused on sovereign capability and boosting our future cyber security workforce.

Australia is well-placed, I believe, to achieve some of the goals outlined by the government, including an ambition to be the world's most cyber-secure nation by 2030.

Our government's efforts to safeguard data have been recognised by the US institute MIT's Cyber Defence Index. It ranked Australia No.1 among 20 of the world's largest and most digitally-advanced economies on preparation against, and response and recovery from, cyber security threat.

There are threats, though, to the process of building Australia's sovereign capability. One threat is offshoring. Offshoring IT work is commonplace in Australia, from customer support to software programming and data storage. But if there's one thing the pandemic has taught us, it's supply chains break down, and sovereign capability matters.

When it comes to cyber security, we can't afford to be relying on overseas third parties to be protecting us or storing our sensitive data.

We must invest in building our own data storage facilities. We should be looking to strengthen our sovereign data laws to ensure Australians' private data held by businesses is safely stored on-shore, like the Australian government which mandates all public sector data is stored on-shore.

The cost-cutting attitude some Australian businesses have towards IT services, data storage and cyber security also needs to shift.

READ MORE:

When a business is working with a low-cost IT or cybersecurity service provider overseas, that business must ask itself: are we sure the highest level of security is being maintained? Are we confident when there are many different contractors involved, that those people are qualified and will carry out work to the highest standards? And if a data breach does occur, what legal recourse might we have, if any?

Choosing an off-shore cyber security company might be enticing for the bottom line, but with little to no oversight, a lack of quality control and potentially no legal recourse, it's a recipe for disaster.

If Australia truly wants to be ready to defend itself against cyber-attacks from countries like Russia, Iran, China and North Korea, who we know are already targeting us, and if we want be the most cyber-secure country in the world by 2030, our best defence must start and end here in Australia.