In the face of ever-evolving cyber security risks that impact every Australian citizen, Standards Australia is developing an informative position paper to help navigate this complex terrain, driven by the standards committee responsible for the development of Information security, cyber security and privacy protection standards.

As cyber threats continue to grow in sophistication and frequency, Australia aims to position itself as a leader in cyber security globally, including through the implementation and promotion of robust standards and regulations.

Standards Australia and the standards committee will explore the challenges, offer recommendations, and outline strategic initiatives that will support Australia’s ambition to become a leader in cyber security, to protect its national interests and its people.

The Complexity of Cyber Security Challenges

Cyber security challenges are multifaceted, requiring a comprehensive approach to safeguard sensitive information and critical infrastructure. Standards are an essential component of this approach, offering a consistent framework for businesses and individuals to safeguard themselves against cyber threats. Addressing cyber challenges is a complex task, and while standards are only one part of the answer, the role they play is instrumental in creating a cyber-secure nation.

Australia’s Cyber Security Vision

The global cyber security landscape has undergone significant transformations in recent years, with Australia experiencing several high-profile security breaches. The Australian Government’s goal to make Australia the most cyber-secure nation by 2030 is a challenging but attainable target.

Standards Australia strives to support this vision by promoting the value of cyber security standards, leveraging internationally aligned standards, and developing new standards where relevant.  

A harmonised approach through consensus-driven mechanisms will provide organisations and individuals with tools to enhance their cyber security resilience.

Cyber security should not be perceived as a fixed goal, but rather as an ongoing, dynamic process. As technology progresses, the standards and regulations established to safeguard it must also adapt and evolve.

Australia’s regulatory environment is unique and is influenced by the Security of Critical Infrastructure (SOCI) Act, among other regulatory frameworks. These frameworks integrate standards to provide a solid foundation. The SOCI Act is especially crucial in defending critical infrastructure against cyber threats, ensuring that vital services continue to function, even when confronted with advanced cyber-attacks.

Australia’s Cyber Security Landscape and Areas for Growth

Australia’s cyber security landscape consists of various standards and regulations. A key standard is AS ISO/IEC 27001:2023 Information security, cyber security and privacy protection, which provides guidance for businesses establishing an information security management system. Others include a handbook for small businesses on implementation, and standards outlining the monitoring and evaluation of an information management system and management of security risks.

Additionally, guidelines and mitigation strategies play a critical role in protecting systems and data from cyber threats. These guidelines offer practical steps that organisations can take to improve their cyber security posture.

For example, the Telecommunications Declaration and the European Standard for Internet-connected consumer devices (adopted by Standards Australia as an Australian Standard in late 2023), address cyber security breaches in telecommunications and consumer devices connected to network infrastructure, respectively. These standards are crucial in ensuring that the proliferation of connected devices does not introduce vulnerabilities that could be exploited by malicious parties.

Standards Australia and the information technology standards committee are dedicated to maintaining a cyber security standards ecosystem that is safe, internationally aligned, and contextually relevant. The standards they develop support a wide range of stakeholders, catering to varying levels of maturity and risk appetite, meaning we are well positioned to lead the way in emerging areas of cyber security standardisation.

Below are some of the key areas in which standards can support Australia’s cyber security ambitions:

Education

One of the key recommendations from Standards Australia is to increase industry awareness on the value of cyber security standards through education. Cyber security standards can help ensure that businesses are better protected against cyber-attacks, meaning they can recover quickly when such attacks occur. 

Increasing awareness of cyber security standards across various business sectors is essential. Clear communication channels and adherence to applicable minimum cyber security standards for government agencies, departments, and critical infrastructure operators will enhance national resilience.

Further Standards Development

Identifying and developing standards for specific cyber security areas where standards do not currently exist is another priority. For instance, in the realm of Consumer Energy Resources (CER) and Distributed Energy Resources (DER), Australia has the potential to lead standard-setting globally. This proactive approach ensures that emerging technologies are secured from the outset, mitigating risks associated with their deployment.

Supporting Government Priorities

Standards Australia actively supports the Australian Government’s 2023- 2030 Australian Cyber Security Strategy and is well placed to contribute to the delivery of this strategy in critical areas, such as the development of a mandatory cyber security standard for IoT devices, and the development of a voluntary labelling scheme for consumer-grade smart devices. At a broader level, standards can support the Australian Government’s regional priorities by creating a cyber-secure Indo-Pacific region through international standards harmonisation and capacity building. Together, these efforts will help fortify cyber resilience both nationally and regionally.

The Future of Cyber Security

Managing cyber security is a continuous process of adaptation and improvement. It is essential to approach cyber security standards from an international perspective, leveraging existing frameworks and tools rather than attempting to reinvent the wheel. Standards can support the success of the Australian Government’s cyber security strategy, raise awareness of key cyber practices and keep Australian organisations and consumers secure.

Through education, further standards development, and alignment with government priorities, Australia is well-positioned to establish itself as a global leader in cyber security and achieve its ambitious goal of becoming the most cyber-secure nation by 2030.

Claire Ripley, Senior Manager, Strategic Initiatives, Standards Australia, will join a discussion about the implications of the 2023–2030 Australian Cyber Security Strategy for digital products and services, at the IoT Impact conference at the University of Sydney on June 13. See the IoT Impact Conference agenda and purchase tickets here.