Services Australia has announced to Senate Estimates that it has reported a total of 20 cybersecurity incidents to the Australian Cyber Security Center (ACSC) in 2019-20, which is its responsibility across the Department of Social Services, the National Disability Insurance Agency and the Department of Veteran’s cover matters, in addition to having your own IT shop.
The ACSC said it had received a total of 436 reports from government agencies.
Rebecca Skinner, CEO of Services Australia, said while it was inappropriate to discuss the nature of the incidents, her agency has not committed any breach of Australian citizen data.
As one of the largest government agencies, Services Australia has its own Security Operation Center (SOC) that has been responsible for protecting all of its systems since 2017, including those that contain information on Centrelink, Medicare and child support.
“We are constantly doing security reviews, upgrades, and patches – things like that to uphold our responsibilities [the] ASD eight essential safety precautions, “she added.
The agency’s cybersecurity division blocks around 14 million suspicious emails a month, according to Skinner.
“If something looks strange, people do something,” she said, noting that the department is also seeing multiple campaigns trying to attack their systems. “We monitor all of this.”
Michael McNamara, Services Australia’s chief information officer, said the SOC is also “conducting its own tests on the dark web”.
See also: Cops are the only ones legal on the dark net, explains AFP
“We have our own in-house capabilities … which will routinely work this through and identify issues in this area,” he told the senators. “We can’t discuss individual cases, but we work very, very closely with the AFP, the ACSC and the ASD.”
McNamara said that while much of his data is not classified under a national security classification, it is all treated in the same way as the agency’s most sensitive and important records.
“They’re in physical security centers, if you like, which are the ways you would protect national security information. Technically, they don’t have a national security classification,” he said.
“We have a very robust data security framework within the agency … [including] a data integrity framework that deals with training our employees on the use of data in relation to the inappropriate and appropriate use of data and the distribution of data. We do that regularly. “
He said that in addition to multifactor authentication across the agency and the systems it controls, there are also a number of access controls such as: B. Monitoring tools.
“Our systems are, as you can imagine, by their nature and design, secure and the data is encrypted at rest,” he added. “If this data is moved, we will use our monitoring tools to control the movement and distribution of that data, especially as it leaves the agency.”
He said the same requirements will be placed on the largest contractors – Telstra, Microsoft and IBM.
Comments are closed.