Under these new rules, the operators of companies with infrastructure deemed as critical to the nation must report significant cyber breaches – which compromise continuing operations – to the federal government within 12 hours of an attack.There are a wide variety of companies that are considered as critical from a national security and productivity perspective. The definition applies to 11 sectors operating 22 different asset classes.
The problem, as the Optus breach – and particularly the Medibank breach – showed us, is that even some of the country’s biggest companies have precious little idea what is going on when they are compromised.Leaving aside the conjecture and accusations about how breaches happen, both companies initially struggled to grasp the true nature of what had befallen them.about the severity of the attack for well over a week after it was first announced.
The only people who enjoyed Australia’s latest cyber awakening were the myriad technology vendors and advisers, who have had their sales pitches written for them across the country’s newspaper front pages. Chief information security officers are often not given the standing in the executive structure to insist on restrictions or strategic direction, and those with bigger chequebooks have tended to prioritise innovative growth initiatives, rather than more prosaic security caution.