iscover
ReporterShare this article on:
Powered by
MOMENTUM
MEDIA
The WA government is set to uplift their cyber security defences after the Essential Eight cyber security controls were mandated last year.
Developed by the Australian Cyber Security Centre (ACSC), the “Essential Eight” is designed to educate and enable organisations to protect themselves from cyber threats and their systems from becoming compromised. It was mandated by the government to ensure entities nationwide are compliant with the cyber security framework that is designed for security control maintenance at the highest standard.
WA's new cyber security “uplift team” falls under the state's Office of Digital Government's cyber security umbrella and is a major investment in cyber security since the Office of Digital Government (DGov) secured $1.8 million in the 2020-21 budget to establish a cyber security operations centre (CSOC).
In an iTNews interview, WA government chief information security officer Peter Bouhlas explained the new team is set to assist “agencies to understand where their weak spots are and to provide direct support”.
“We can help them focus on what’s the one or two or three controls they’re struggling with, and then the team can then go in and have a more targeted approach to supporting an agency,” Bouhlas added.
To enhance WA's cyber security capability focused on incident detection, response and prevention, the new team is funded by the government’s new digital capability fund, a $25.5 million boost, courtesy of the mid-year budget review.
According to Bouhlas, about 25 staff are set to join the cyber security unit filling policy and operations roles.
“DGov has already used surveys to identity weak spots and other areas of concern, though agencies will also be able [to] request help."
“We can see from the survey results and their maturity assessments where they need help,” Bouhlas said.
The ACSC's Essential Eight controls replaced the WA government's Security and Emergency Committee of Cabinet Top Five controls (SECC5) which was introduced as a “warm up exercise in the lead up to a larger set of controls”.
“Five controls were much easier to talk to and acceptable by agencies to get done, so we focused on that,” Bouhlas said.
The controls included patching, multi-factor authentication, privileged accounts and backups, with the exception of application whitelisting.
“I didn’t think that agencies were ready for that,” Bouhlas added.
The WA government's investment in DGov's cyber security unit is also set to establish a dedicated facility with “tools” including a vulnerability scanner, security information and event management system (SIEM).
The team will also coordinate with vendors to help industry “understand what DGov is doing” when they engage with agencies.
“Having a central function means we’re sort of orchestrating all of WA’s cyber security industry to get on the same page,” Bouhlas said.
In recent years, WA government agencies have struggled with meeting cyber security requirements based on numerous state auditor-general information systems reports with just 50 per cent of WA agencies meeting the benchmark for information security in 2021, with “no noticeable improvement from the previous year”.
“Over the last 14 years, there has been little improvement in this area with only 11 per cent increase in the number of entities since 2008,” according to the state auditor-general's report.
Bouhlas added that having a central function will enable WA’s cyber security industry to get on “the same page”.
“The Essential Eight for us is important because they protect us the majority of attacks that we see across WA, Australia and even globally,” Bouhlas concluded.
[Related: Australia, US, India and Japan lock in cyber security cooperative]
Be the first to hear the latest developments in the cyber industry.
