Dan Woods | Cyber threats loom as we get complacent about defence

While this island's isolation has served as an impressive bulwark against physical geopolitical threats, it's a dangerous default mindset to carry into the cyber realm.

As cyber warfare becomes more expansive, sophisticated, and aggressive, previously periodic cyberattacks have evolved into an epidemic of cybercrime.

According to ACSC's 2022 Annual Cyber Threat Report, a cybercrime is reported in Australia every seven minutes. The volume, sophistication, and impact of these threats have grown significantly in recent years, with no signs of slowing down.

Recently, a litany of high-profile cyber attacks has shown that Australia needs to accept that - short of disconnecting from the global internet - it's just as vulnerable as anyone else.

Cyber threats know no jurisdictional or geographical divide. Protection requires action across the entire country. This means cyber security should be a priority for whole-of-government, not just Defence.

Small, medium, and large businesses, not just enterprises. The academic and scientific communities responsible for education, research, and development alongside the community and all individuals within it.

The whole-of-government approach is key here. It's not enough for a single person, or even a well-resourced department, to be responsible for visibility and maintenance of cyber security.

It must be seen as an everyday priority for the entire organisation, industry, government, and nation.

One of the major problems I see again and again is a lack of cooperation.

This can be on a small scale between individuals whose job it is to ensure protection against cyber attacks within a company, or friction between security and operations teams as a result of differing objectives or competing budgets.

More dangerously, this lack of cooperation can be seen on a much larger scale where organisations, industries, and governments fall out of alignment, leading to a breakdown of protection, or failure to establish adequate defences to begin with.

Recently, the goal of the highest profile attacks has been financial gain.

While the stakes are undoubtedly high in these attacks, particularly for the individuals affected, they can be much, much higher.

When cyber attacks target critical infrastructure, as we're seeing more and more, the intention is to cause major instability over time, weakening the ability to respond to threats - both cyber and physical.

Recently, discussions around the origins of high-profile attacks are highlighting the likelihood of major breaches being geopolitically motivated.

It's becoming clear that an adversary could wreak irrevocable havoc without ever setting foot on this island.

Contained within the recent geopolitical unrest of the world around us, we've seen the damage caused by a hostile power attempting to shut down an electrical grid or targeting an entire nation's transport system.

However, this is a wake-up call. If we search for the silver-lining in the high-profile cyber attacks aimed at Australians of late, it would be this; awareness is a good thing. It leads to action. Australia has already responded by aspiring to become the most cybersecure country in the world by 2030.

READ MORE:

It is more than just a whole-of-department or whole-of-industry approach to cyber threats that is necessary to meet such aims.

While every nation is more than the sum of its parts, those parts still need to come together to present a united front against increasingly emboldened belligerent states.

From this point on, basic cyber hygiene must be front-of-mind for every single Australian, taught as a foundational subject from a young age, with the same impetus as writing and mathematics, and continually and consistently cemented as an unquestioned national priority.

Without the whole-of-nation approach being viewed as absolute necessity, Australia's island is not protected.