The Six Shields - Australia's New Cyber Defence Strategy

Last month, on September 18th, Home Affairs Minister Claire O’Neil unveiled a new strategy to modernise and strengthen Australia’s security posture and make Australia the most cyber-secure country by 2030. This strategy comprises what’s been termed as ‘the six shields’.

You can read the full speech here for more details.

Like with just about anything in life, I love to get technical and dig into the weeds with how things work and add value. I started thinking about how businesses and organisations in the public and private sectors can take action that aligns with these six shields.

We will see some comprehensive details emerge later in the year about how Australia is going to achieve each of these strategic goals, but since we’ve got some time until then, here are some of my ideas on how each of these six shields can be implemented and measured for success in the real world.

For each strategic cyber shield, I’ll use the format below: (Squarespace doesn’t like tables as much as I do, unfortunately.)

Strategic Shield

• Goals and Objectives
  • Actions
    • KPIs

S1 - Education and Support

• GOAL: Raise cyber awareness among citizens and businesses.

  • ACTION: Initiate national cybersecurity awareness campaigns.

    • KPI: Percentage of population reached by awareness campaigns.

• GOAL: Equip all organisations in the public and private sectors with fundamental cybersecurity knowledge and practices.

  • ACTION: Develop a support system to help users and the general population understand and navigate cyber risks effectively.

  • ACTION: Implement a continuous cybersecurity education program with mandatory training aligned to specific roles/responsibilities.

    • KPI: Percentage reduction in user-originated security incidents.

  • ACTION: Offer financial incentives for cybersecurity compliance in public and private sectors.

    • KPI: Total number/percentage of compliant organisations.

S2 - Safer Technology

• GOAL: Ensure all technology used within the public and private sectors is secure by design. UPDATE 18/10/2023: Victorian Chamber proposing cyber “game-changers” for Australia to achieve the most secure nation by 2030

  • ACTION: Implement mandatory cybersecurity standards for products and software.

  • ACTION: Introduce a scoring system (e.g. “Secure Score”) for products and services supplied by vendors and service providers.

  • ACTION: Support research and adoption of post-quantum cryptography.

    • KPI: Number of products compliant.

    • KPI: Number of products scored.

    • KPI: Percentage reduction in hardware/software vulnerabilities found.

• GOAL: Implement robust security controls and conduct frequent vulnerability assessments.

  • ACTION: Leverage AI/ML technology to assess and validate secure coding practices and conduct continuous security audit activities.

  • ACTION: Incorporate post-quantum cryptography standards into business-critical products, systems and services.

    • KPI: Number of products, systems, and services vulnerable to quantum and AI-based attacks determined through penetration testing.

    • KPI: Percentage reduction in incidents exploiting known vulnerabilities.

S3 - Threat Sharing and Blocking

• GOAL: Strengthen public-private partnership in threat sharing.

  • ACTION: Organise quarterly cybersecurity events with major tech vendors and service providers.

    • KPI: Number of events held and percentage of organisations participated.

• GOAL: Enable automatic sharing of critical threat data.

  • ACTION: Implement AI-driven threat detection and sharing in a national threat-intelligence platform.

    • KPI: Percentage of threats detected and shared in real-time.

S4 - Protection Of Critical Infrastructure

• GOAL: Establish a national cyber defence programme for protecting and securing critical information infrastructure systems (CII).

  • ACTION: Identify and assess key national CII/ICS assets.

    • KPI: Number of assessments performed against CII/ICS assets.

    • KPI: Reduction in total vulnerabilities identified in CII/ICS assets.

• GOAL: Enhance real-time monitoring of critical systems.

  • ACTION: Leverage AI/ML to provide advanced threat monitoring capabilities across critical infrastructure assets.

    • KPI: Percentage of CII/ICS assets under real-time monitoring.

S5 - Strengthening Cyber Skills

• GOAL: Increase the number of trained/certified cyber professionals.

  • ACTION: Initiate apprenticeship programs for cybersecurity studies at tertiary institutions. (Aligns to GC#12 here)

    • KPI: Number of apprenticeship programs delivered annually.

• GOAL: Establish specialised cybersecurity training centres. UPDATE 24/10/2023: “A new Microsoft Data Centre Academy will open in 2024 in NSW in partnership with TAFE NSW”

  • ACTION: Fund and support the creation of national cybersecurity training hubs.

    • KPI: Number of training hubs established and operating.

S6 - Global Collaboration

• GOAL: Strengthen bilateral cyber agreements. UPDATE 24/10/2023: Microsoft announces A$5 billion investment in computing capacity and capability to help Australia seize the AI era

  • ACTION: Engage in talks and finalise cyber pacts with strategic allies.

    • KPI: Number of bilateral cyber agreements signed.

• GOAL: Share threat intelligence with global partners. UPDATE: 17/10/2023: Five Eyes launches the Five Principles of Secure Innovation

  • ACTION: Establish secure channels for sharing real-time threat intelligence with global allies.

    • KPI: Number of threat reports shared with and received by international partners.