Victoria unveils new cyber incident management plan

The Victorian Department of Premier and Cabinet has released a new cyber incident management plan (CIMP) to coordinate the public service’s response to the 1900 cyber attacks it faces each day.

Chief information security officer, John O’Driscoll, said these attacks come from a mix of state actors, cyber criminals, political ‘hacktivists’, and “online vandals” at a rate of about one attempted attack every 45 seconds.

The new CIMP, as part of the state’s broader cyber incident management framework, supports government agencies’ existing response plans and connects them with Victoria’s inter-jurisdictional emergency management arrangements, O'Driscoll said.

The plan defines four categories of cyber event based on severity:

• Cyber Event – suspected or unsuccessful attempt to compromise with no business impact
• Cyber Incident – compromise with minor impact
• Significant Cyber Incident – compromise with limited or major impact
• Cyber Emergency – serious or exceptional compromise with community consequences.

It also outlines organisations’ obligations in response to an incident and defines protocols for intelligence and information sharing.

However, the department said the CIMP does not replace an organisation’s existing infosec plans, policies or procedures.

“Rather, you should update existing documents to align with the CIMP,” the department said.

It applies to all of the state’s public sector bodies, however, local governments are exempt (although strongly encouraged to apply the plan anyway).

Under the plan, organisations are required to prepare for a cyber attack by:

• Creating their own cyber incident response plans
• Establishing a cyber incident management team
• Practicing responses to cyber incidents with the incident management team.

Whole-of-government responses to cyber incidents will be managed by the by the Cyber Incident Response Service (CIRS) with the Department of Premier and Cabinet, which is also available to help out other organisations manage their own cyber incidents.

The department said 90 percent of government organisations experienced a cyber incident between 2017 and 2018, most of which centred around phishing attempts and malware.

Three quarters of the Victorian public service also reported some level of system or service disruption from cyber incidents during the same period.