, 69 tweets, 35 min read
My Authors
Read all threads
OK, Kids, I’m about to review the public submissions to Australia’s 2020 Cyber Security Strategy. homeaffairs.gov.au/reports-and-pu… I’ve put them all in a .zip at drive.google.com/open?id=1vaP78… (204.9MB). I’ll tweet random interesting bits. Follow or mute #2020Strategy as suits your mood.
Off to a good start. “Government is main responsible for trust and dignity for the citizens of Australia. Its like a father is head of family, then the government is head of citizens .” #1 #2020Strategy
“Companies should give power to provoke a person in breach of leaking data of people by suspending him and also complaining to police so they can charge him under theft act.” #1 #2020Strategy
“Stop saying stupid things.” #24 #2020Strategy
Note that I’m just powering through a first cut of these submissions. As is normal, the majority will be restating individuals’ and organisations’ positions, and are therefore not newsworthy. You may well find interesting stuff in the submissions I’m skipping. #2020Strategy
“Combine all 30+ threat-reporting bodies into one.” #27 #2020Strategy
As an aside, I’m always amused by the number of submissions that are, essentially, “The government needs to put more resources into X. By a strange coincidence, we happen to be a provider of X.” #2020Strategy
The main recommendations from Huawei’s submission. Plus stats that only 4% of telco systems failures are about the cybers. #39 #2020Strategy
There’s a LOT of detail in the Huawei submission. It’s almost as if they’ve been thinking about how to address these issues in response to... I dunno... events or something. #39 #2020Strategy
I’m 20% of the way through the skim. Lots of calls for more enforceable legislation, and lots for cybersecurity compliance ratings. Five-star cybers! My understanding is that official support for the idea in Australia has gone, however. #2020Strategy
An “Executive Summary” that doesn’t actually summarise the points made in the document, but which just waffles on about the organisation, so I end up having to skim the whole thing. #2020Strategy
Australian Payments Council says payments systems are important but they get cybered a lot so the government should focus on helping with that. But taking four pages to say it. #48 #2020Strategy
Recommendations from Australian Catholic University. #49 #2020Strategy
From REA Group, “The government needs to hold itself to the same level of account as the private sector.” #51 #2020Strategy
The REA Group submissions has lots of thoughtful and focused comments and I’ll read it properly later. #51 #2020Strategy
Lots of recommendations from @ACCAN_AU, including the ol’ cyber trust rating and minimum cyber security features for connected devices, with “financial incentives”. Wink. #52 #2020Strategy
Cybersecurity and Cybercrime Advisors Network (CyAN) suggests reestablishing a separate cybersecurity portfolio within government because Home Affairs is so big. #53 #2020Strategy
Ian Falconers has done a SWOT analysis, amongst other things. Curious. #56 #2020Strategy
Yet another call for tighter standards and regulations* from the Commission for the Conservation of Antarctic Marine Living Resources (!), as well as a mention of blockchain because why not. #57 #2020Strategy

* Australians love regulations.
Some more regulations etc from Trusted Impact. MOAR REGULATIONS. #58 #2020Strategy
More interestingly, it quotes @TFeakin from before he was ambassador: “[Progress] requires a prime minister who will be prepared to champion the issue and spend some time talking about it with those that can make a difference.” #58 #2020Strategy
@TFeakin That @TFeakin quote is from “Cyber security: the new captain’s pick” (14 Jul 2015) aspistrategist.org.au/cyber-security… #58 #2020Strategy
Personally I think “greatest transfer of economic wealth in history”, originally by @DAlperovitch I think, is bullshit. Just look at how slavery and colonisation built the European empires. But we can argue about that later. Once he’s given the server back. ;) #58 #2020Strategy
Paul Twomey is taking a big-picture approach. Also, very national security. #59 #2020Strategy

This is very different from civil society orgs. “Civil society experts slam ‘national security’ agenda” (29 Oct) zdnet.com/article/cyber-…
From KnowBe4, some specific comments on awareness-raising. As I’ve said before, there’s a strong call in submissions for a more-focused approach here. #61 #2020Strategy
Professor John Magnussen and Samuel Baartz point out some problems with the security of medical imaging. #72 #2020Strategy
RSA is going for the cyber ratings system as well, and pushing for a Singapore-style licensing system for cybersecurity providers. #80 #2020Strategy
Palo Alto Networks is suggesting UK-style private-sector placements into the ACSC. #82 #2020Strategy
University of Sydney is among several organisations recommending an active defence approach as per UK’s NCSC. Government should handle high-volume low-danger threats at a national level. (It is working for the UK.) #86 #2020Strategy
CSIRO is pushing for more “provably secure” software, possibly because they’re world leaders in how to do this. Yet another call for cybersecurity ratings for devices. #87 #2020Strategy

Obviously much more in there too, but that’s an interesting angle.
As an aside, this question asked in the review docs, “Are there any barriers currently preventing the growth of the cyber insurance market in Australia?”, kinda assumes that this market is something that should be grown. Why are we assuming this? #2020Strategy
That’s 40% of the way through the submissions by document count. Break time. #2020Strategy
Time to return to reviewing these submissions. See attached tweet for the context of this thread. #2020Strategy
FS-ISAC says “it remains unclear which Minister has prime carriage of cyber security as that portfolio has been subsumed by the Minister of Home Affairs... The need to better inform the business community remains critical and has been lacking.” #88 #2020Strategy
Four recommendations from Standards Australia. #90 #2020Strategy
Superannuation Transaction Network (STN) wants financial networks to be declared essential services. Is STN a financial network, I wonder? Also, “unrestricted warfare”. On your super payments! #92 #2020Strategy
BSA: The Software Alliance isn’t happy with the Assistance & Access Act. #93 #2020Strategy
IBM Australia reckons the 2016 strategy focused too much on industry development rather than countering threats. They definitely don’t like the Assistance & Access Act. #96 #2020Strategy
The Jeff Bleich Centre for the US Alliance in Digital Technology, Security, and Governance wants more attention on the “socio-cognitive implications of the digital age more broadly”. #98 #2020Strategy
University of Queensland knows how to write a submission. Get to the point up front. Seven pages in total. #99 #2020Strategy
Worth noting: “Consider if an intelligence agency (ASD) the best place for the Government’s national CERT capability
(ACSC)” and “Consider options for a Cyber Security "Civil Defence" capability”. #99 #2020Strategy
IT Professionals Australia reckons the government should hire more IT professionals. But with a lot more words. #100 #2020Strategy
The Australian Investment Council reckons the government should encourage more investment. But with a lot more words. #102 #2020Strategy
I’m halfway through looking at the submissions yet I still retain the will to live. I have become one of Them. #2020Strategy
The ACS doesn’t think we have a local software industry. #105 #2020Strategy
Charles Sturt University wants a Ministerial Council for Cyber Security. #111 #2020Strategy
ANU College of Law points to some shortcomings in the Security of Critical Infrastructure Act 2018. Also, tougher penalties for cybercrimes. #115 #2020Strategy
The Australian Small Business and Family Enterprise Ombudsman says there should be more focus on small businesses and family enterprises. #121 #2020Strategy
auDA is for a free and open internet, except when it isn’t. #131 #2020Strategy
The Council of Australasian University Directors of Information Technology (CAUDIT) likes the cybersecurity quality rating idea, calling it a Cyber Emblem. #132 #2020Strategy
MurdockCheng Legal Practice is quite blunt about our ability to trust the government. Solid calls for action. Also wants to allow private-sector players to “hack back”! #136 #2020Strategy
Water Corporation has suggested something I’m a fan of: Daly cyber weather reports (my term). Or like traffic reports. #144 #2020Strategy

Me: “It’s time for cyber weather and traffic bulletins” (13 Apr 2018) zdnet.com/article/its-ti…
That’s 70% of the way through. Kinda. #2020Strategy
The submission from WiseLaw’s Jonathan Lim is about the cybersecurity of space-based assets. I’ll come back to this one, because Space! homeaffairs.gov.au/reports-and-pu… (PDF) #155 #2020Strategy
PwC is another submission recommending leadership from the top and a dedicated cybersecurity minister. Also, bug bounties for government. #171 #2020Strategy
I’m zooming through the rest of these submissions now because I’ve identified my news angles for tomorrow. I’ll take a second pass through them on Monday afternoon or Tuesday, depending on the news cycle. For now, I’ll only tweet stuff that jumps out. #2020Strategy
Deakin University has some solid suggestions for improving trust in government cybers, as is their wont. #183 #2020Strategy
Accenture has a 76-page submission, FFS. I’ll come back to it, though it does have this “responsibility matrix”. They’re calling for a Cyber Council. They explore this idea at some length. #189 #2020Strategy
I’m visualising a bunch of Cybermen sitting around a conference table. #189 #2020Strategy
I’m down to the final 10% of submissions now. I’m getting a bit giddy. #2020Strategy
Hah! Cute observation by VeroGuard Systems. ;) #196 #2020Strategy
The OAIC is calling for a “mapping and clarity around the Commonwealth entities’ actual and potential engagement in combating cyber risks”. Which is a polite way of saying “Who is meant to be doing what, exactly?” #197 #2020Strategy
From NetThing: “There is an inherent conflict of interest where the government agency responsible for surveillance and national security is simultaneously responsible for cyber security.” #198 #2020Strategy

(I wrote about this on 29 Oct. zdnet.com/article/cyber-…)
A straightforward set of recommendations from the Tasmanian Government. #200 #2020Strategy
Hahaha. Microsoft has, in a very diplomatic way, suggested that the coordination of cyber policy and planning, outreach and partnership, communications, operations, and regulatory, spread across three departments is perhaps not going all that well. #203 #2020Strategy
Lockheed Martin isn’t a fan either. “A fragmented and inconsistent approach that is often contradictory, incomplete, and no cohesive.” Someone had a thesaurus! #208 #2020Strategy
That’s it for going through individual submissions for now. I may add some further observations tomorrow, but I’ll probably be more focused on writing, at least initially. #2020Strategy
Here’s that entire thread on a single page. Comments please. threadreaderapp.com/thread/1198388… #2020Strategy
Missing some Tweet in this thread? You can try to force a refresh.

Enjoying this thread?

Keep Current with Stilgherrian

Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

Twitter may remove this content at anytime, convert it as a PDF, save and print for later use!

Try unrolling a thread yourself!

how to unroll video

1) Follow Thread Reader App on Twitter so you can easily mention us!

2) Go to a Twitter thread (series of Tweets by the same owner) and mention us with a keyword "unroll" @threadreaderapp unroll

You can practice here first or read more on our help page!

Follow Us on Twitter!

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just three indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3.00/month or $30.00/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!