Agencies must 'wear the risk' of outsourcing: MacGibbon

The Prime Minister’s top cyber security advisor has warned government agencies that they cannot outsource risk in the same way as infrastructure and services, following a series of high-profile failures involving service providers.

Speaking at the Amazon Web Services public sector summit in Canberra today, Alastair MacGibbon said while cloud computing offered reduced risks over legacy systems as well as the potential for improved compliance, agencies are still expected to shoulder the risk. 

“It is the responsibility of the agency to wear the risk associated with their operations - you cannot outsource risk,” he said.

“That means while you might outsource infrastructure and services, you own the risk associated with doing that, so you must make sure that you deal with those issues.”

The warning follows two high-profile failures involving service providers: last year's eCensus bungle and the ATO's storage network collapse early this year.

In both instances, the service providers were lambasted for their failings, but both the agencies involved were also criticised for relying too heavily on their technology partners.

Government's view of risk changing

MacGibbon pointed to three “points of inflection” - the Census fail, foreign cyber attacks influencing the outcome of last year’s US election, and the WannaCry ransomware attack - as having radically shifted how the government views risk and cyber security since its cyber security strategy was released last year.

“Those three points of inflection have radically and dramatically increased the amount of political pressure upon us to deliver better cyber security for the Commonwealth and for the nation,” he said.

MacGibbon said the Census debacle was particularly significant because it “brought into question the digital service delivery of government”.

It meant the government had to “go back and start asking ourselves questions on the way in which we do IT, the way in which we gather data, the way in which we use that data, and deliver our services to the public”.

He also implored agencies to invest in migrating legacy apps to cloud platforms avoid “a Jenga game where we are just adding layer upon layer, building legacy app upon legacy app, legacy system upon legacy system”.