CYBE R SE CURITY
HOW AMENDMENTS TO THE
SECURITY OF CRITICAL INFRASTRUCTURE ACT WILL IMPACT YOUR UTILITY
by Richard Bergman, Partner, EY Oceania Cybersecurity, and Clement Soh, Associate Partner, EY Oceania Cybersecurity
Every year, organisations are spending more and more money on their security defences. But every year, we see the frequency and severity of cyber attacks against Australia continue to increase.
T
he upcoming regulatory changes to the Security of Critical Infrastructure Act will set a higher baseline standard for organisations across the sectors now deemed critical infrastructure. These changes are in response to the increasing threat landscape and acknowledgement that the security baseline across our critical infrastructure is insufficient to protect Australia from the risk of a significant attack or outage. The Australian Cyber Security Centre (ACSC), part of the Australian Signals Directorate (ASD), receives a report of a cybercrime attack every eight minutes. That equaled 67,500 cybercrime attacks reported between 1 July 2020 and 30 June 2021. Of concern was that around 25 per cent of these attacks were targeting critical infrastructure. Further to this, ASD has estimated that a significant attack on our critical infrastructure could cost the Australian economy up to $33 billion and wipe out 160,000 jobs. Across Australia, Federal Government, State Government and
42
UTILITY • FEBRUARY 2022
Territories, Health, Education and Professional and Technical Services were the top five sectors targeted. The three most significant challenges that utilities are struggling with are: 1. Skills shortage – the ability to attract, develop and retain cybersecurity, technology and risk talent in an already competitive skills market 2. Cost of compliance versus risk-based approach – clarity and confidence to define the ‘statement of applicability’ when adopting legislative and compliance obligations. According to the EY Global Information Security Survey (GISS) 2021, 55 per cent of power and utility respondents agree that regulations will become more fragmented and time-consuming to manage in the next few years 3. An appropriate level of investment and prioritisation – to have visibility of risk across the converged OT and IT environments WWW.UTILITYMAGAZINE.COM.AU
