Geoscience Australia takes action after cyber security fail

Geoscience Australia has kicked off a program of work to implement all the government’s mandatory and non-mandatory cyber security requirements by 2020 after being labelled highly exposed to cyber-attack last year.

In June 2018 the Australian National Audit Office (ANAO) found the agency had failed to implement any of the top four cyber mitigation strategies set by the Australian Signals Directorate.

“Geoscience Australia was assessed as vulnerable, with a high level of exposure and opportunity for external attacks and internal breaches and unauthorised disclosures of information,” the 2018 audit report stated.

Application whitelisting was highlighted as particularly poor outcome, as was application patching with the agency in some instances taking up to 30 days to install critical patches – where the current requirement is 48 hours.

The audit called on Geoscience to establish a plan and timeframe to achieve compliance with the Top Four, to which they agreed.     

On Thursday, in a submission [pdf] to the cyber resilience inquiry, the agency said all of the Essential Eight - now considered the baseline for cyber security by ASD – would be implemented by the end of June 2020 as part of its newly established “Security Improvement Program (SIP)”.

It follows the creation of a security strategy developed in the wake of the audit as a guide for achieving cyber resilience across three focus areas: people and culture, technical controls and security governance.

The internally funded SIP will be used to harden essential business system “with respect to availability, recoverability and resilience to attack” and establish a standardised security architecture and control framework for ICT to enhance security and risk governance processes.

New education and awareness strategies around cyber security will similarly be established under the program to foster “a security aware culture”.

The agency has already successful trialled an application whitelisting solution that it plans to deploy by the end of June, with all “non-essential systems and services to be remediated by 30 June 2020”.

It has also increase visibility of managed services provider services, upgraded its endpoint security software and introduced enhanced threat detection capabilities.

But Geoscience also wants to push the bar further, including plans for additional projects to reduce its exposure to cyber-attack through vulnerability management.