Our Aussie Cyber Security Act is going to be interesting to watch unfold not just in it's initial form, but as it evolves over the years. IMHO, great steps forward, but let's look at those arguments *against* it abc.net.au/news/2024-07-3…
"Business groups say the new disclosure rules, and the proposed $15,000 fines for failures to disclose a payment, could sink some small operators." - you only get fined if you don't disclose, so... don't hide the breach!
"They are also pushing back against the decision to include businesses with an annual turnover of more than $3 million, arguing the threshold is too low" - appx 90% of Aussies businesses have turnover <$3M/y, so the scope is still very small
"They might not know that they have this new obligation" - that's a pretty weak excuse, laws are constantly shifting, it's not hard to work out your obligations in the (still extraordinary) event that you're breached and ransomed
"We don't think that a mandatory reporting obligation or any further pressure needs to be put in place" - let's be clear: a business has had a breach, it has likely exposed customer data, they should *absolutely* be obligated to report not just to the regulator, but to customers
Whilst breached orgs are victims themselves, they have to wear the accountability. That's the cost of business in the digital era and we should increasingly hold them accountable when they try to conceal incidents at the expense of the individual victims and the community.
The writing is on the wall, I expect we'll see more and more pressure on transparency in the coming years. Who knows, it might even add some incentive to tighten things up *before* a breach happens. More on our gov's position (thread):
https://x.com/troyhunt/status/1810502203884618222
• • •
Missing some Tweet in this thread? You can try to
force a refresh
