Australia’s New Guidance Aims to Harden IT Network Security

The Australian government released guidance on proactive cyber defense strategies for enterprises, beginning with the statement: It is virtually impossible to prevent successful cyberattacks using existing strategies.

See Also: Cisco Umbrella for Government: Helping Agencies Meet Their Enhanced Cybersecurity Mandates and TIC3.0 Standards

The Australian Signals Directorate’s Australian Cyber Security Center said the guidance will help organizations build a modern, defensible network architecture that’s resilient to cyberattacks.

“Steps can be taken in the design, architecture and build of networks to significantly minimize the risk and harm to a network’s most critical assets and systems should an incident occur, while also increasing their resilience,” the guidance says.

The center advises domestic enterprises to adopt zero trust and secure-by-design principles to enhance cyber resilience, and these practices have been included in its latest “foundations for modern defensible architecture” that organizations can refer to when designing network security architectures.

The architectural frameworks complement ACSC’s Information Security Manual and Essential Eight Maturity Model, previously released to help organizations develop cyber defense capabilities holistically and strengthen internet-connected IT, enterprise mobility and operational technology networks.

The Essential Eight Maturity Model, first published in 2017 and updated in November 2023, helps organizations gradually enhance their maturity levels by adopting eight mitigation strategies: patching applications, patching operating systems, enabling multi-factor authentication, restricting administrative privileges, enabling application control, restricting Microsoft Office macros, hardening user applications, and performing regular backups.

The Information Security Manual, released in December 2024, serves as a cybersecurity framework for CISOs, CIOs and other cybersecurity leaders to protect information technology and operational technology systems, applications and data.

ACSC said organizations that have applied the earlier frameworks to strengthen their IT environments should use the new foundations to further strengthen their networks by implementing zero trust and secure-by-design practices.

The cybersecurity agency’s instruction manuals represent the government’s urgency to make domestic businesses and enterprises more resilient in its goal to make Australia the world’s most secure nation by 2030.

The government began in late 2023 by releasing its AU$587 cybersecurity strategy that advocated a ban on ransomware payments, compulsory reporting of cyber incidents, and new reporting requirements on critical infrastructure sectors (see: Australia Unveils AU$587M Strategy to Defeat Cybercrime).

The government has since published a series of advisories and guidance to strengthen the country’s information technology environments. The ASD in December said it will phase out several existing encryption algorithms by 2030 that could be vulnerable to quantum computing-enabled cyberattacks in the future. Encryption algorithms to be phased out include ECDSA, or Elliptic Curve Digital Signature Algorithm, and EdDSA, or Edwards-curve Digital Signature Algorithm, with 128 bits of security strength and RSA for digital signatures with no more than 128 bits of security strength (see: Australia to Phase Out Weak Encryption Algorithms by 2030).

The government also announced a $6.4 million grant in January to help set up a cybersecurity information-sharing network for government and private hospitals and health clinics to raise the sector’s preparedness against rising cyberattacks.

According to ASD, the latest foundations for modern defensible architecture are technology agnostic, and organizations are not mandated to follow them by the letter, but use the guidance framework to strengthen their networks based on their environments and business goals.