Dept Home Affairs continues building out the SOCI Act

The department of home affairs has said its continuing to build out the Security of Critical Infrastructure Act  (SOCI) as it “can't set and forget” when it comes to continuing to build out strong safeguards across Australia’s critical infrastructure.

The SOCI Act regulates critical infrastructure assets from 11 key industries in Australia.

Tackling the government work around vital frameworks, Peter Anstee, first assistant secretary at the Australian government told an AWS Summit Sydney crowd the recently updated SOCI Act expanded out traditional critical infrastructure sectors from four to 11 “reflecting our 21 century priorities and industries.”  

“Essentially, what the Act does is provide a flexible framework for managing and protecting our critical infrastructure.”

He said there is also now a an “enhanced cybersecurity obligations” and “the establishment of a government capability to step onto critical networks in the most extreme scenarios and help private organisations disrupt and respond to these critical threats.”

Anstee said, “We recognise we can't set and forget and so we're emphasising the need with our partners and critical infrastructure providers have the need for continuous refinement of the rules and evolution of our approach for critical infrastructure reform.

“To this end, we're already updating the security of critical infrastructure act to introduce a few new measures.

“The first is a new power called ‘last resort all hazards consequence management power’, something of a mouthful, but essentially, it's looking to allow government to step in following a credit infrastructure disruption and assist the operator manage the downstream consequences of that disruption.”

He said the act is also looking to extend “expand what's called our national cyber exercise program”.

“Finally, given the scrutiny that we've applied to industry across the last 12 to 18 months, it's only appropriate the government looks in its own backyard and gets its own house in order.

“We're taking a number of measures across the federal government states and territories to drive cybersecurity uplift.

“This includes the development of a whole of government, zero trust culture across federal government, which was a major reform for us.

He said the implementation of significant cyber abuse, “including the recently launched cybersecurity strategy, as well as the designation of a new group of critical infrastructure systems, and we're calling these systems of government significance.”

“Ultimately, resilience is a team sport, when it comes to critical infrastructure and partnerships are key.

“This funded fundamental shift we've taken to an all-hazards approach, rather than just a single sectoral approach requires really robust risk management and clear understanding of how organisations and sectors can work together to mitigate these threats”.

During the AWS talk Anstee also said, “Australia has never been so reliant on its critical infrastructure”.  

“Most of us only think about critical infrastructure when something's going wrong,” he said.

“When there's a cyber incident or a bushfire and electricity outage, when comms are down, or when food can't be supplied during a supply chain crisis.”

According to Anstee, “In the last 12 months, ASD, the Australian Signals Directorate, has responded to 150 major critical infrastructure related cyber incidents, and that's a 15 percent increase on the year previous”.

This, alongside threats of foreign interference on critical infrastructure systems, has seen the department develop an “all-hazards approach to protecting Australia's most critical systems and how we're creating a more resilient critical infrastructure ecosystem.”

“Critical infrastructure is an increasingly attractive target for cybersecurity attacks. We often focus on cyber as the primary threat in this context and that is because it is particularly acute.”