QUESTIONS WITHOUT NOTICE

Mr BURKE (Watson—Minister for the Arts, Minister for Home Affairs, Minister for Cyber Security, Minister for Immigration and Citizenship and Leader of the House) (15:01): I thank the member for Reid for the question and, in particular, for the work that the member for Reid is leading on cybersecurity with the House of Representatives Committee. When we talk about different threats to the country, particularly in terms of terrorism, we often talk about whether a threat is 'possible' or 'probable'.

We don't tend to use that language with respect to cybersecurity, because the threat is always certain. Our critical infrastructure and our government institutions are constantly under attack. Some of those cyberattacks come from criminal gangs and some of them come from state actors.

But the work in particular of the Australian Signals Directorate in making sure that we help critical infrastructure and government institutions be able to have the strongest possible cyber defences is as much part of our national security as anything else that we do. The work of the Signals Directorate has traditionally provided advice to government and to critical infrastructure through a process known as the Essential Eight.

That process and those essential eight documents have now been updated, and the new documents were released today. Effectively, we need to constantly update them with the new methods that people, those who want to do us harm, are using. The simplest example I'd give would be artificial intelligence.

The gap between a hostile actor finding a vulnerability and being able to exploit it used to be roughly 2½ years. It's now 10 hours between finding the vulnerability and exploiting it. We need to make sure that we have the best possible cybersecurity across government and critical infrastructure to be able to keep Australians safe.

The new advice that's come from the Signals Directorate has a series of different themes that are part of it, but there are three new areas in particular that I would highlight. The first is the focus on the human firewall. We've started to find that businesses can invest extraordinary amounts of money in the technical firewall only to find that a well-meaning member of their own staff has inadvertently opened the door.

There are gangs like Scattered Spider that exist throughout the English-speaking world that are trained at basically building relationships and pretending they're the help desk so that eventually somebody will unwittingly upload something that never would have made it through the technical firewall. The second area that the new documents deal with, importantly, is legacy technology.

Legacy technology is not just something that's old. It could be new or old, but it's something that can't be updated and can't be patched. Those constant patches and regular updates are a big part of how we make sure that new vulnerabilities, as they're found, are quickly shut down.

But legacy technology and edge devices—sometimes people wonder why we are worried about all these other sorts of devices—often, if they can't be patched and updated, then become a pathway to infecting an entire system. Finally, the supply chain—a business itself can have great cybersecurity, but if parts of their supply chain, businesses that they rely on or other operators who plug into their devices don't have the same level of cybersecurity, you can get a similar threat.

I want to congratulate the Signals Directorate, thank them for the extraordinary work they do, and remind everybody about the importance of constantly checking and updating on these issues.