Year In Review: Australia Expands Cyber Regulation

Australia announced a flurry of cybersecurity legislation and regulations in 2024, spotlighting the government’s intent to fortify the nation’s cybersecurity in the wake of the Medibank and Optus data breach incidents.

See Also: Expert Panel | Data Classification: The Foundation of Cybersecurity Compliance

The Australian Parliament approved the Cyber Security Act in late November, a core component of the government’s cybersecurity legislative package intended to strengthen the government’s powers to monitor cybersecurity threats, build resilience and eradicate vulnerabilities in smart devices. Australia’s Labor government vowed in 2022 to transform the country into the world’s “most cyber-secure” by 2030 following back-to-back cyber incidents at private health insurer Medibank and telecommunications provider Optus (see: Australia Aims to Be World’s ‘Most Cyber-Secure’ Country)

The act requires certain sectors to report ransomware payments and empowers the government to set mandatory cybersecurity standards for smart devices.

A week before the Cyber Security Act passed both houses of the Parliament, the government announced its intent to ban users younger than 16 from accessing social media platforms, a move that evoked harsh criticism nationwide, with critics calling the blanket ban “too blunt an instrument to address risks effectively” and questioning how the ban will be enforced.

The government has also introduced several mandatory regulations over the course of the year, including the financial regulator telling banks, financial services and insurance providers to undergo cybersecurity assessments, the government expanding the list of services that fall under the definition of critical infrastructure, and unveiling a digital ID scheme that has raised data privacy concerns.

The government has justified its intent to strongly regulate critical infrastructure and the financial sector, citing perpetual cyberespionage activities conducted by nation-state actors to steal intellectual property and trade secrets from Australian organizations. In July, the Australian Cyber Security Center said a Chinese state-backed cyberespionage group, tracked as APT40, conducted cyberespionage campaigns against government and private organizations to steal sensitive information and surveil its victims.

Lax Cybersecurity Controls and Processes

An audit by the Australian National Audit Office found that government organizations, such as the Australian Transaction Reports and Analysis Center and Services Australia, displayed middling capability in designing and implementing incident management procedures or implementing effective incident management recovery practices to mitigate disruptions to operations.

The government amended the Security of Critical Infrastructure Act 2018 in November to give itself powers to categorize certain data storage systems as critical infrastructure assets and require their owners to apply critical infrastructure regulations to the assets.

The Australian Cyber and Infrastructure Security Center in November also designated 46 additional critical infrastructure assets as “systems of national significance,” taking the total count of such assets to more than 200 systems across critical infrastructure sectors.

Operators of the designated systems must apply cybersecurity controls, conduct exercises and assessments and share information with federal cybersecurity agencies to ensure continuous monitoring and management of such assets.