The federal government is lagging behind on nearly half the reforms laid out in a plan to bolster the public service's cyber security, a defence think tank says.
Subscribe now for unlimited access.
$0/
(min cost $0)
or signup to continue reading
Efforts to strengthen APS protections against disruptive and costly cyber attacks are too slow in several areas if the government wants to meet a four-year deadline to shore up its defences, according to the Australian Strategic Policy Institute.
The think tank, partly funded by the Defence Department, urged the government to improve transparency for its cyber security push, communicate more with the private sector about the project and channel more funding to reforms.
No progress was made last year on 14 of 83 measures from the 2016 strategy to improve cyber security, the government needed to move faster on 22 to improve protection, and progress was hard to measure on another 11.
The federal government was behind on goals to prepare responses to cyber crises with state and international counterparts, and agencies did not have clear guidance to identify and manage cyber security risks when procuring ICT equipment and services, the ASPI said.
It had also not met another goal that critical services and high risk sectors demonstrate good cyber security practices, while public service agencies were also yet to become examples of good protection.
Australia's first Minister Assisting the Prime Minister for Cyber Security, Dan Tehan, said in March the government wanted to speed its strategy against cyber intrusion, and that it would make the project a priority.
The ASPI report, released on Wednesday, counted efforts by Prime Minister Malcolm Turnbull's special adviser on cyber security Alastair MacGibbon to raise the profile of cyber protection among the government's successes.
However a minister focused solely on cyber security and a timeline for reforms could speed the roll-out of new measures to protect the APS from attack, the ASPI said.
"The absence of timelines leaves the government room to mask underperformance, and means that promises to 'accelerate' or deliver initiatives 'ahead of schedule' hold very little meaning," it said.
"Failure to provide a timeline has opened the government up to criticism, since stakeholders are left with nothing but their own expectation against which to judge the pace of activity.
"There's a perception among stakeholders that implementation is slow and that the speed of tangible on-the-ground delivery isn't yet commensurate with the importance of the issue or reflective of the government's narrative of urgency."
The think tank report comes after Mr MacGibbon warned a 'tick box' mentality in the public service risked blinding departments to threats.
Departments charged with pushing reforms had not received additional cash for the project, and more staff could speed efforts to improve cyber security, the institute said.
"Leading the public commentary, developing policy and implementing the strategy are a nearly impossible task for the team with its existing size and scope," it said.
"If support can't be increased, then it may be necessary to rationalise the initiatives, prioritise them based on need, and leverage the private sector more effectively."
A lack of security has left Australia's Tax Office and Immigration Department vulnerable to cyber attacks, putting personal data at risk, a national audit found in March.
