With the rise of sophisticated and targeted malicious activities against Australian Universities, the need for strong information security measures has never been greater. The last 12 months has seen some of the biggest data and security breaches with the most recent attacks against a wide range of public and private sector organisations in Australia. The risk – “cyber security risk” – is not just industry-wide, but economy-wide, and attacks include those that are organised and well -coordinated as well as those that are opportunistic in nature.
UNE undertakes wide ranging and highly advanced research projects, delivering intellectual property valuable to both the University and researchers. This IP is essential in ensuring the continued growth of the University, investment in ground-breaking research and placing Australia as a centre for creativity and innovation. To lose this IP will gravely impact all these stakeholders.
The Cyber Security Rapid Uplift Program intends to implement a range of information security services and solutions that are ‘business-driven’ and ‘risk-prioritised’. These will address the wide range of cyber security threats the University faces daily and enable the opportunities the University pursues as a leading international education and research institution.
The Rapidly Evolving Risks
Assessing widespread security threat trends requires an adaptive risk and trust assessment approach. We must confront the threat landscape based on a continuous assessment of threat and business evolutions. As the security industry continues to flourish, an ever-increasing number of threat reports become public every year, but it is often difficult to find anything new, relevant, and actionable when reading these reports. We suffer from breach and threat statistic fatigue, but still must quickly assess and maintain the University’s security posture when investors are considering UNE for advanced research projects.
As 2020 has proved, risks are not static. Planning for risks that are on the decline may be as harmful as ignoring the risks that are growing. Because attacks leveraging known threat vectors continually evolve, often under the radar, Cyber Security needs constant attention because protections that are adequate one day may not be same for next day.
The Cyber Security Rapid Uplift Program (RUP)
UNE has put in place an program aimed at improving UNE’s overall security posture which will significantly reduce the risk of a major cyber incident impacting the University’s integrity and reputation as a safe and secure place to work, study and invest in. This program is based on well-recognised techniques and approaches that have been proven globally.
Identify |
Have a clear understanding of the University’s infrastructure (systems and applications) and the data that is held on those systems. The ‘value’ must be understood by both UNE and the stakeholders and appropriate protective measures applied. |
Protect |
Cyber security controls will be defined and made available to stakeholders to enable them to protect their systems and data in all its forms and stages of production, storage and distribution. |
Detect |
Any attempts to access and compromise the University’s systems and information, must be detected and reported at the earliest opportunities. As the attack methods evolve, so must the UNE’s detection methods. |
Respond |
Responding to cyber attacks is not straightforward. UNE will work closely with leading cyber response agencies in both the public and private sector. |
Recover |
The University must be able to continue to operate at an acceptable and agreed level of capability. The Uplift Programme will introduce and support effective Disaster Recovery and Business Continuity programmes to support these operational objectives. |
Program Delivery
The RUP will be delivered over 2021/23. Individual cyber security capabilities will be defined, validated and deployed. The deployment phase of the program will be based on business need and identified risks. At all stages, stakeholders will be kept informed and consulted on how the capabilities will support or impact them.
With the completion of the program, UNE will have performed required due diligence in securing our data and systems from ever evolving sophisticated cyber security threats. This, however, is not the end of the cyber security program. The capabilities delivered and deployed, must be maintained and enhanced to ensure they continue to meet evolving threats and system vulnerabilities.
There will be challenges. Some cyber security capabilities may affect the way people work. New threats may evolve that are able to bypass the security controls. Vulnerabilities in the infrastructure may initially not be identified. These challenges will be addressed through the project lifecycle and beyond. This will include extensive consultation with end users and stakeholders.
Questions and comments can be sent to Stewart Hayes on shayes31@une.edu.au