Introduction

1.1 The Australian Signals Directorate⁷ has prioritised a list of security initiatives that Australian Government entities should take to secure their information and communications technology (ICT) systems against cyber intrusions and threats.⁸ In April 2013, the Australian Government Protective Security Policy Framework⁹ mandated that government entities implement the top four of these 37 strategies (Top Four mitigation strategies).¹⁰

1.2 The Top Four mitigation strategies are:

• using application whitelisting¹¹ on desktops and servers to prevent malicious software and unapproved programs from running on a computer;
• applying application patches¹² through sound policies, procedures and practices to help ensure the applications’ security;
• applying operating system patches through sound policies, procedures and practices to mitigate security risks and reduce system vulnerabilities; and
• effectively managing access provisions for privileged user accounts¹³ across an entity’s ICT environment, including the entity’s network, applications, databases and operating systems.

1.3 In February 2017, the Australian Signals Directorate recommended the inclusion of four additional security strategies to prevent malware running on ICT systems, limit the extent of incidents and recover data. The Australian Signals Directorate updated its cyber security strategies from the Top Four mitigation strategies in response to the increasing threat of ransomware.¹⁴

1.4 The additional security strategies are:

• disabling untrusted Microsoft Office macros on desktops and servers to prevent the unauthorised download and running of malicious software;
• hardening the configuration of applications (user application hardening) used to interact with the Internet, including blocking web browser access to Adobe Flash player, web advertisements and untrusted Java code;
• applying multi-factor authentication to make it more difficult for adversaries to use stolen credentials to access sensitive information and facilitate further malicious activities across an entity’s ICT environment; and
• effectively managing daily backup of important data, including testing of data restoration processes, to mitigate data being encrypted, corrupted or deleted by ransomware or other destructive malicious software.

1.5 These four strategies complement the Top Four mitigation strategies—and are collectively known as the Essential Eight.¹⁵ The current cyber threat is such that the Australian Signals Directorate recommends that entities implement a package of eight essential mitigation strategies as a security baseline. Only four of the eight strategies—the (original) Top Four—are mandatory.¹⁶

1.6 To effectively implement the Essential Eight, an entity must have a sound enterprise-wide ICT general controls framework. This framework provides an entity with a stable and reliable ICT environment and forms the foundation upon which other processes and controls can be built. ICT general controls include controls over: ICT governance; ICT infrastructure; acquiring and developing applications; logical user access¹⁷ to ICT infrastructure, applications and data; and making changes to ICT systems and applications.

Self-assessments, previous audits and cyber security culture

1.7 Since 2013, non-corporate Commonwealth entities have been required to undertake an annual self-assessment against the mandatory requirements of the Protective Security Policy Framework. Entities are required to annually report their compliance to the relevant portfolio Minister and the Secretary of the Attorney-General’s Department and provide a copy to the Auditor-General by August each year. The Top Four mitigation strategies are part of the self-assessment criteria.

1.8 Since 2013–14, the Australian National Audit Office (ANAO) has conducted three performance audits to assess the cyber resilience of 11 different government entities.¹⁸ These audits assessed entities’ implementation of the Top Four mitigation strategies and ICT general controls, which are required by the Protective Security Policy Framework. The ANAO has also reviewed the self-assessment of compliance with the mandatory strategies, as reported by entities.¹⁹

1.9 In June 2017, the Joint Committee of Public Accounts and Audit (JCPAA) held a public hearing to discuss the findings of the third ANAO audit on cyber security.²⁰ The JCPAA, in Report 467: Cybersecurity Compliance released in October 2017, considered that all non-corporate Commonwealth entities should be compliant with the Top Four mitigation strategies by 30 June 2018. The JCPAA also noted that ‘key elements to achieve compliance with the mandatory mitigation strategies are a significant investment, as well as a culture which recognises the importance of, and requirement for cyber resilience.’²¹ The JCPAA made 10 recommendations; including two for the ANAO:

• Recommendation 4—The Committee recommends that the Auditor-General consider conducting an audit of the effectiveness of the self-assessment and reporting regime under the Protective Security Policy Framework.
• Recommendation 6—The Committee recommends that in future audits on cyber security compliance, the ANAO outline the behaviours and practices it would expect in a cyber resilient entity, and assess against these.²²

1.10 In relation to Recommendation 4, this audit has addressed, for the three audited entities, the effectiveness of the current self-assessment and reporting regime for the Protective Security Policy Framework. The ANAO will consider conducting an audit of the effectiveness of the revised self-assessment and reporting regime (which is planned to be implemented from 2018–19) when developing future annual audit work programs. In respect of Recommendation 6, in this audit the ANAO has drawn on previous audit work²³ to assess the cyber resilience of the three audited entities, and has outlined additional behaviours and practices of cyber resilient entities to assess against in future cyber security audits (reported in Chapter 4).

Audit approach

1.11 The ANAO decided to conduct this fourth audit of entities’ management of cyber risks recognising ongoing parliamentary interest (including enquiries by the JCPAA) and the level of non-compliance with mandatory requirements identified in previous audits. In Report 467: Cybersecurity Compliance, the JCPAA recommended that the ANAO outlines the behaviours and practices it would expect in a cyber resilient entity and assess against these.

1.12 The three Australian Government entities included in this audit are significant users of technology and were selected based on the character and sensitivity of the information collected, stored and reported:

• the Department of the Treasury analyses economic and fiscal data to advise the Government on effective government spending and taxation arrangements, including trends in Commonwealth revenue and major expenditure programs, and the annual preparation of the Commonwealth Budget;
• National Archives of Australia plays a key role in collecting and preserving Australian Government records that reflect the nation’s history and identity; and
• Geoscience Australia applies science and technology to assist government and the community to make informed decisions about the use of natural resources, management of the environment, and community safety. In addition, it provides critical services such as tsunami warnings and monitoring of bushfires, earthquakes and nuclear tests.

Table 1.1 outlines the type of information collected, stored and used by these entities.

Table 1.1: Key information collected, stored and used by the selected entities

Source: ANAO analysis.

1.13 The objective of the audit was to assess the effectiveness of the management of cyber risks by the Department of the Treasury, National Archives of Australia and Geoscience Australia.

1.14 The audit criteria were:

• do entities have effective arrangements in place for managing cyber risks;
• do entities monitor and report against cyber security deliverables; and
• were entities cyber resilient, with a culture of cyber resilience?

1.15 The scope of the audit was to assess whether the selected entities were compliant with the Top Four mitigation strategies mandated in the Protective Security Policy Framework, and the extent to which the entities had implemented, or planned to implement, the four non-mandatory mitigation strategies of the Essential Eight. The audit also examined aspects of entities’ arrangements for developing a culture of cyber resilience.

1.16 In undertaking the audit, the ANAO:

• assessed the actions taken by the selected entities in prioritising cyber risks through effective ICT governance and risk management frameworks;
• assessed the Essential Eight cyber security strategies and the underlying controls as per the Australian Signals Directorate’s Information Security Manual, with an emphasis on the Top Four mandatory mitigation strategies; and
• reviewed the business model and ICT governance, and the cyber resilience culture.²⁴

1.17 The assessments were made in late 2017 through early 2018.

1.18 The audit was conducted in accordance with the ANAO Auditing Standards at a cost to the ANAO of approximately $440 000.

1.19 Team members for the audit were Alex Doyle, William Na, Matthew Rigter, Lisa Elkner, Kelvin Le, Carissa Chen, Pooja Bajaj, Elenore Karpfen and Andrew Morris.

Were entities compliant with the Top Four mitigation strategies?

Note a: Geoscience Australia had recently reassessed its cyber security arrangements and commenced an IT program of work to achieve compliance with the Top Four mitigation strategies, including deploying application whitelisting for critical ICT infrastructure, by late 2018.

Entity compliance with the Top Four mitigation strategies

2.1 As outlined in Chapter 1, the Top Four mitigation strategies are application whitelisting, application patching, operating system patching and minimising privileged user access.

2.2 Treasury was compliant with the requirements for implementing each of the Top Four mitigation strategies, and therefore met the mandatory requirements set out in the Protective Security Policy Framework. National Archives was compliant with two of the four mitigation strategies, and Geoscience Australia was not compliant with any of the four strategies.

2.3 Table 2.1 shows the ANAO’s assessment of the three entities’ compliance with the Top Four mitigation strategies, as at February 2018. The assessment was based on an aggregated score for the assessment of a number of controls for each of the four strategies, as discussed in Appendix 2.

Table 2.1: The ANAO’s assessment of entities’ compliance with the Top Four mitigation strategies

Source: ANAO analysis.

Application whitelisting

2.4 Application whitelisting protects ICT systems against unauthorised applications running on them. Its purpose is to protect systems and networks from harmful applications. The Top Four mitigation strategies include the requirement for entities to implement application whitelisting for desktops and servers.

2.5 The ANAO assessed:

• Treasury as having effectively implemented application whitelisting on desktops and servers using a combination of approved whitelisting methods covering executables, software libraries and installers. The department also used monitoring tools in high risk business areas to report any attempts to bypass the application whitelisting policy;
• National Archives and Geoscience Australia as not sufficiently implementing application whitelisting to comply with the requirements of the Information Security Manual:
  • National Archives had only implemented application whitelisting on desktops. At the time of the audit, it had not completed a risk assessment nor had plans to implement application whitelisting on its servers²⁵; and
  • Geoscience Australia did not have application whitelisting in place across its ICT environment at the time of audit fieldwork, although it had an IT program of work to review its cyber security posture—with regard to application whitelisting—for critical ICT infrastructure.²⁶

2.6 None of the three entities had a documented and endorsed application whitelisting strategy. In practice, Treasury and National Archives relied on their respective Information Security Policy to document the requirement to deploy application whitelisting across the ICT environments. Their security policies were silent on strategies and practices for explicitly selecting and permitting software execution or network communication to deliver services and business requirements, and the preferred security protocol.²⁷

2.7 Treasury and National Archives also used proprietary application whitelisting configuration software and security information and event management (SIEM) software as a secondary control to monitor, capture and log unauthorised attempts to install applications by general and privileged user accounts.

Patching applications and operating systems

2.8 The Top Four mitigation strategies include a requirement for entities to deploy security patches as soon as possible after being released by the vendor to protect ICT systems from known vulnerabilities. Critical security patches should be deployed within 48 hours from vendor release.²⁸ According to the Australian Signals Directorate, applying security patches to applications, operating systems and devices is one of the most effective security practices to address known system vulnerabilities.

2.9 Entities had installed either Microsoft Windows 7 or Windows 10 operating systems on their desktops. Entities used vendor provided tools to support the automatic deployment of security patches to desktops. The automated deployment of security patches was efficient and timely.

2.10 The ANAO assessed:

• Treasury as having adequately implemented patching of applications and operating systems. The department had a patch management practice that included deployment of patches, rollback and contingency in the event the patch failed, and expected timeframes to patch applications and operating systems. Treasury deployed security patches using automated processes on a monthly cycle for desktops and servers, and critical security patches were deployed within 48 hours from vendor release.²⁹
• National Archives as having implemented patching of applications in accordance with the requirements of the Protective Security Policy Framework, but not patching of operating systems. National Archives deployed security patches for applications on a monthly cycle for desktops; and, in general, also for servers, although there were instances where patches were installed on a quarterly cycle. Less than 20 percent of critical operating system patches were deployed within 48 hours from vendor release across the server fleet. In addition, some servers were running operating systems that were out of vendor support, so that patches were no longer being released to address vulnerabilities.
• Geoscience Australia as not implementing patching of applications or operating systems in compliance with the requirements of the Protective Security Policy Framework. Geoscience Australia was inconsistent with its patching procedures, installing some security patches on a monthly cycle but not installing other patches at all. Most critical patches were installed between 7 and 30 days after vendor release—greatly exceeding the requirement to install critical patches within 48 hours, as specified in the Top Four mitigation strategies and the contractual agreement with the service provider.³⁰

2.11 For all entities, system management software such as System Centre Configuration Manager was used to provide patching status reports. National Archives and Geoscience Australia had no procedures in place to verify the installation of security patches, including documented processes to investigate, resolve and reinstall security patches to applications, operating systems and devices.

Minimising privileged user access

2.12 Misuse of privileged access³¹ can lead to significant security compromises, such as unauthorised information disclosure and system/process breakdown. The Top Four mitigation strategies include a requirement for entities to implement effective controls over assigning and using privileged accounts to maintain system and information integrity.

2.13 All entities had policies and procedures in place to enforce key controls over the use of privileged accounts, including:

• granting and restricting privileged accounts only to appropriate staff to meet role-based needs;
• minimising the number of privileged accounts;
• preventing privileged accounts from accessing emails and the Internet;
• passphrase length and complexity requirements; and
• activity logging and monitoring.

2.14 For all entities, the process of granting and revoking privileged user accounts is in accordance with the Information Security Manual. However, Geoscience Australia did not effectively manage privileged accounts, in particular for non-Windows application servers, where there was limited visibility of user access and activities. For all entities, while event logs were captured and stored, there was room to improve the active monitoring of privileged user accounts. The entities were aware of this shortfall and were reviewing strategies to address it.

Were entities cyber resilient?

2.18 Cyber resilience is the ability to continue providing services while deterring and responding to cyber attacks. Cyber resilience also reduces the likelihood of successful cyber attacks. To become cyber resilient, an entity must first establish effective ICT general controls. Effective ICT general controls provide a stable and reliable foundation upon which other processes and controls can be built. An entity must also effectively implement the Top Four mitigation strategies. Together, these form the basis of the entity’s cyber resilience—in essence, how well the entity is protecting its exposure to external vulnerabilities and intrusions, internal breaches and unauthorised information disclosures, and how well it is positioned to address cyber threats.

2.19 ICT general controls are entity-wide structures, policies, procedures, and standards applied to information systems that support business processes.³² They include controls over ICT governance, ICT infrastructure, security and access to operating systems and databases, application acquisition and development, and ICT change procedures. Effective implementation of ICT general controls provides a level of assurance that an entity’s systems are protected from security threats.³³ Two elements of the ICT general controls framework—logical access control and change management—are crucial as they relate directly to security management.³⁴

2.20 Table 2.2 shows the ANAO’s assessment of entities’ ICT general controls.

Table 2.2: The ANAO’s assessment of entities’ ICT general controls

Source: ANAO analysis.

2.21 Treasury and National Archives had effective ICT general controls in place, with effective controls for endorsing changes to ICT systems and adequate logical access controls. Geoscience Australia did not have effective ICT general controls due to weaknesses in logical access controls. All entities had effective controls for managing ICT changes.

2.22 With respect to logical access controls:

• Treasury had documented processes and procedures, including for passphrase length and complexity requirements. Based on sample testing, privileged user accounts were granted authorisation based on roles and job duties, although regular reviews to revalidate privileged user accounts were not conducted which led to a high number of privileged accounts.
• National Archives had processes and procedures, including for granting and revoking user access and for directly attributing shared accounts to a user, but there was room for improvement in managing privileged user accounts.
• Geoscience Australia had policy and procedures in place to support the management of user access, however user access controls were not effectively implemented at the database and operating system level.

2.23 All entities had controls in place to enforce the ‘least privilege principle’ over privileged users. The least privilege principle is to assign users with the minimal required system access rights that are necessary to support them performing their defined job duties. The National Archives and Geoscience Australia did not effectively implement the administration of privileged user accounts, particularly in segregating administrative access based on job duties. In some instances, privileged user accounts were not blocked from accessing the Internet and emails, and were not adequately monitored.

2.24 All entities demonstrated maturity in the administration of change management. Changes to ICT systems required endorsements from responsible parties and testing before being implemented in the production environments. For the majority of change requests selected for testing, rollback plans were in place and appropriately documented.

Entity cyber resilience—summary assessment

2.25 Figure 2.1 summarises the ANAO’s assessment of the entities’ cyber resilience, which comprises compliance with the Top Four mitigation strategies and effective implementation of ICT general controls.

Figure 2.1 Entities’ cyber resilience^a

Note a: An entity’s position on the matrix indicates its overall cyber resilience—in essence how well the entity is protected from external intrusions, internal breaches and unauthorised disclosures of information, and how well it is positioned to address threats.

Source: ANAO analysis.

2.26 Treasury is in the Cyber Resilient zone. Security controls are in place to provide a high level of protection from external attacks and internal breaches, and unauthorised disclosures of information. Treasury had achieved compliance with the requirements of the Protective Security Policy Framework to implement the Top Four mitigation strategies for cyber intrusions and threats.

2.27 National Archives is in the Internally Resilient zone. Security controls are in place to provide an adequate level of protection from breaches and disclosures of information from internal sources but vulnerabilities remain to attacks from external sources. The Top Four mitigation strategies are not in place across the ICT systems, or are inconsistently implemented across the systems. ICT general controls for logical access and change management are effective.

2.28 Geoscience Australia is in the Vulnerable zone. The Top Four mitigation strategies and ICT general controls are not in place or insufficiently implemented across the ICT systems.

2.29 National Archives and Geoscience Australia did not achieve compliance with the Protective Security Policy Framework requirement to implement the Top Four mitigation strategies.

Have entities implemented the four non-mandatory strategies in the Essential Eight?

2.30 As discussed in paragraph 1.4, the four non-mandatory mitigation strategies in the Essential Eight are: disabling untrusted Microsoft Office macros; user application hardening; multi-factor authentication; and daily backup of important data, systems and configuration settings.

2.31 These controls are not mandatory and the Australian Signals Directorate has been actively promoting them as strategies to improve cyber resilience since February 2017. For the purposes of this audit, the ANAO assessed the extent to which the four non-mandatory mitigation strategies had been implemented (recognising that they need not be), and examined the plans and processes entities had put in place to consider implementing those strategies.

2.32 As shown in Table 2.3, none of the three entities had fully implemented the four non-mandatory strategies in the Essential Eight. All three entities had implemented one of the strategies—daily backup of important data.

Table 2.3: The ANAO’s assessment of entities’ compliance with the non-mandatory mitigation strategies in the Essential Eight

Source: ANAO analysis.

Disabling untrusted Microsoft Office macros

2.33 Configuring Microsoft Office macro settings addresses adversaries attempting to run malicious code while evading basic email content filtering and application whitelisting. Effectively configured macro settings for Microsoft Office should only allow macros vetted as trustworthy, and preferably placed in ‘trusted location’ directories in the entity’s ICT environment with no write access for general and low-privileged user accounts. All other macros from the Internet that are not vetted should be blocked.

2.34 In all cases entities had implemented limited controls of Microsoft Office macros using configuration settings, and users were able to bypass these restrictions to run a macro. Entities did not adopt a risk-based approach to assess end-user functionalities against job needs. Rather, the entities adopted a ‘one-size-fits-all’ approach to setting restrictions on running Microsoft Office macros using configuration settings.

2.35 Entities advised the ANAO that they understood the importance of blocking untrustworthy macros but had to maintain end-user functionality so that staff were not disrupted in performing their job duties. The three entities had not conducted a risk assessment, developed plans to implement effective controls for this mitigation strategy, or otherwise set out a rationale for not implementing an effective mitigation strategy.

User application hardening

2.36 Malicious content and Internet advertising accessed through web browser software can be reduced by disabling unneeded features in Microsoft Office, and by configuring web browsers to block Adobe Flash, ActiveX and untrusted Java code.

2.37 Treasury had configured the Internet gateway to block Adobe Flash from external web sites but applications on their network could run Adobe Flash files, for example training course material that relies on these features. Geoscience Australia and National Archives had no restrictions to run Adobe Flash from external web sites. All entities had limited controls to restrict untrusted Java code.

2.38 Entities had not assessed the effectiveness of the user application hardening controls and had no policy and procedures in place for applying appropriate security requirements. Instead entities relied on regular security patching of applications, such as Java, to maintain end-user applications and reduce the risk exposure.

Multi-factor authentication

2.39 Multi-factor authentication requires an authorised user to provide at least two of the following three mechanisms to gain access to an ICT system:

• something the user knows, such as a passphrase;
• something the user has, such as a physical token or software-based certificate; and
• something the user is, such as their fingerprint.

2.40 If implemented correctly, multi-factor authentication makes it more difficult for adversaries to use stolen user credentials to gain access to ICT systems to facilitate malicious activities.

2.41 All entities were using multi-factor authentication for remote access to ICT environments and, in addition to passphrases, have in place additional authentication methods recommended by the Information Security Manual.³⁵

2.42 Treasury and National Archives did not have in place multi-factor authentication for privileged user accounts or any plans to implement this authentication. At the time of audit fieldwork, Geoscience Australia had multi-factor authentication in place only for system administrators with access to critical infrastructure systems on the cloud computing environment, and had an ICT program of work underway to deploy multi-factor authentication on key systems for all cloud application user accounts.

Daily backup of systems and data

2.43 Backup of systems and data is a common practice by organisations to ensure the resumption of normal information processing in the event of disruption to the ICT systems, such as through user error or failures of storage hardware. Given vulnerabilities and emerging cyber threats, recent backup of data and proven data restoration processes are also vital to mitigate data being encrypted, corrupted or deleted by ransomware and other destructive malware.

2.44 The principle for data backups is:

• frequency—daily backups of operational data, and more frequently for important data;
• reliable backup processes—supported by a means to test the data afterwards to ensure that the process is actually recording all of the data onto the target backup device;
• secure storage—in a location (both physical and virtual environments) that is safe from unauthorised access and protected by ICT security controls such as encryption; and
• restoration—a documented and regularly tested process for restoring the backup.

2.45 All entities had backup policies and procedures in place, and conducted daily backup of their important data.³⁶ All entities stored backups for over three months, both onsite and offsite (physical environment) and using cloud computing services (virtual environment).

2.46 None of the three entities had formal procedures in place to test the restoration of backups. However, Geoscience Australia restored production backups to its test environment monthly, while Treasury and National Archives relied on operational restoration requests as a testing mechanism for their backups.

Did the entities appropriately assess and report against compliance with the Top Four mitigation strategies?

Annual self-assessment against the Protective Security Policy Framework

3.1 As discussed in Chapter 1, entities are required to undertake an annual self-assessment against the mandatory requirements of the Protective Security Policy Framework, and report the results to the relevant Portfolio Minister, Secretary of the Attorney-General’s Department and Auditor-General.

3.2 The requirements for entities’ self-assessment against the mandatory requirements of the Protective Security Policy Framework are divided into four categories:

• Governance (GOV), to implement and manage protective security governance arrangements;
• Personnel Security (PERSEC), to ensure the suitability of personnel to access Australian Government resources;
• Information Security (INFOSEC), to ensure the confidentiality, availability and integrity of all official information; and
• Physical Security (PHYSEC), to ensure a safe working environment for employees, contractors, clients and the public, and to provide a secure environment for official assets.

3.3 The Top Four mitigation strategies form part of INFOSEC 4, one of the mandatory requirements of the Protective Security Policy Framework under the Information Security category. According to the Attorney-General’s Department’s Protective Security Policy Framework Compliance Reports from 2014–15 to 2016–17, INFOSEC 4 had the highest rate of self-assessed non-compliance. In 2016–17, only 60.2 per cent of non-corporate Commonwealth entities reported compliance with the Top Four mitigation strategies.³⁷ This is despite the Top Four mitigation strategies representing the minimum requirements for entities. The three ANAO cyber security performance audits found higher rates of non-compliance—eight of the 11 entities assessed were not compliant with INFOSEC 4.

Self-assessments of the three audited entities

3.4 Table 3.1 presents the entities’ self-assessment of compliance with the Top Four mitigation strategies as at July 2017; and the ANAO’s rating of entity compliance as at March 2018.

Table 3.1: Entities’ self-reported compliance ratings for the Top Four mitigation strategies, and the ANAO’s ratings of entity compliance

Note a: Treasury reported that it was compliant for application whitelisting for the desktop, and non-compliant for servers although mitigation controls were in place. During audit fieldwork the department completed its ICT program of work to implement application whitelisting on the servers.

Source: Entities’ 2017 annual self-assessment report against the Protective Security Policy Framework and ANAO analysis.

3.5 In the July 2017 self-assessment for compliance and reporting to government:

• Treasury self-assessed as compliant for three of the Top Four mitigation strategies;
• National Archives of Australia self-assessed as fully compliant with the strategies; and
• Geoscience Australia self-assessed as non-compliant.

3.6 As at March 2018, the ANAO assessed that:

• Treasury was compliant with each of the Top Four mitigation strategies. The ANAO’s higher compliance rating for application whitelisting stemmed from the different timing of the assessments. The department completed a program of work to implement application whitelisting on servers in February 2018, which was after its self-assessment, but before the ANAO’s assessment and critical to the outcome;
• National Archives was not compliant with two of the Top Four mitigation strategies; and
• Geoscience Australia was not compliant with any of the Top Four mitigation strategies.

3.7 The self-assessments and ANAO assessments were consistent for Geoscience Australia and Treasury (after adjusting for the timing difference) but not for National Archives. Accordingly, the ANAO considers that Treasury and Geoscience Australia accurately assessed and reported the level of compliance with the Top Four mitigation strategies as part of the 2017 reporting against the mandatory requirements of the Protective Security Policy Framework, but National Archives incorrectly reported compliance and should have reported non-compliance.

Entities’ self-assessment processes

3.8 In conducting annual self-assessments against the mandatory requirements of the Protective Security Policy Framework, entities relied on:

• an assessment conducted by those with prime responsibility for cyber security, such as the Information Technology Security Advisor;
• an assessment conducted by an external ICT security advisor, as requested by the Chief Information Security Officer or Audit Committee; and/or
• past ICT operations reports, as submitted by the ICT divisions or contracted ICT service providers.

3.9 The ANAO sought documented information from the three entities about their assessment of the Top Four mitigation strategies and found that reported statements for compliance could not be substantiated with evidence. In most cases, entities relied on control assessment reports that were greater than six months from the time of reporting to government. In particular, Treasury and National Archives could not provide the evidence used and analysis created to inform their compliance self-assessments. This indicates insufficient senior management oversight and challenge of the assessment of achieving compliance with the Top Four mitigation strategies.

3.10 Where entities’ controls were assessed as non-compliant, there were no documented initiatives to achieve compliance. For example, Geoscience Australia had an ICT security assessment conducted by the Australian Signals Directorate in July 2016. The overall findings from the assessment were that the entity was non-compliant with the mandatory mitigation strategies. The Chief Executive Officer accepted the cyber risks. No further assessments of cyber risks or planned cyber initiatives were taken until 2017.³⁸

3.11 As previously discussed, the aim of the Australian Government Information Security Manual is to detail the technical security controls that can be implemented to help mitigate security risks to entities’ information and systems. The manual is silent in detailing the preferred criteria and methodology for assessing the operating effectiveness of controls.

3.12 Entities must rely on professional judgement—from internal and/or external ICT security advisors—to assess security controls’ effectiveness. Different approaches and interpretations of the assessment criteria will continue in the absence of a common control assessment methodology.

3.13 The Australian Signals Directorate has issued implementation guidance for the Essential Eight in its supplementary document to the Information Security Manual.³⁹ There is no similar guidance or supporting information, including assessment and reporting tools such as control assessment test plans, for the annual self-assessment processes.

3.14 There was also not a grading scheme that reflects the security control operating effectiveness. The current rating of either compliant or non-compliant is limited, and may not accurately reflect an entity’s adequacy of implementation and control effectiveness for their ICT environment.

3.15 In the absence of a common control self-assessment methodology and guidance, including a broader grading scheme, entities may continue to inaccurately self-assess and report on the adequacy of security controls.

3.16 A common control self-assessment methodology, supported by appropriate guidance and grading scheme is required to:

• achieve consistent management of cyber risks and cyber investments (entity-level); and
• strengthen trust online and protect Australian’s privacy and Australia’s social, economic and national interests (government-level).

Can the Essential Eight Maturity Model be used to assess maturity in implementing the Essential Eight?

3.17 To assist entities in determining their maturity in implementing the Essential Eight mitigation strategies, the Australian Signals Directorate has prepared an Essential Eight Maturity Model.⁴⁰ The model has five levels of maturity, broadly defined as:

• Maturity Level Zero—not aligned with intent of mitigation strategy;
• Maturity Level One—partly aligned with intent of mitigation strategy;
• Maturity Level Two—mostly aligned with intent of mitigation strategy;
• Maturity Level Three—fully aligned with intent of mitigation strategy; and
• Maturity Level Four—for higher risk environments fully aligned with intent of mitigation strategy.⁴¹

3.18 According to the Australian Signals Directorate, entities not operating in higher risk environments should aim to reach a maturity level of three for all of the Essential Eight mitigation strategies.⁴² This maturity level rating would equate to compliance with the requirements of the strategies for those entities. This rating would mean that the entities have satisfied the minimum requirements for mitigating cyber risks through the Top Four strategies, and satisfied the additional four strategies of the Essential Eight that are not mandatory.

3.19 The minimum criteria required to be met for Maturity Level Three for each mitigation strategy is presented in Appendix 3.

3.20 The ANAO assessed each of the three entities’ maturity according to the Essential Eight Maturity Model, and compared it to the assessment of compliance with the Top Four and additional four mitigations strategies, as reported in Chapter 2.

3.21 This assessment highlighted that the criteria used to determine the levels of maturity in the Essential Eight Maturity Model are not closely aligned to the criteria used by the ANAO to determine the level of compliance with the Essential Eight mitigation strategies. The ANAO’s criteria are based on the controls outlined by the Australian Signals Directorate in the Australian Government Information Security Manual and Strategies to Mitigate Cyber Security Incidents, for the purpose of supporting entities to comply with the requirements of the Protective Security Policy Framework.

3.22 Table 3.2 (application whitelisting) and Table 3.3 (restrict administrative privileges) present a comparison of the controls identified as mandatory for the implementation of two of the Top Four mitigation strategies, and identify which of these controls need to be implemented to achieve a maturity assessment of three. Appendix 4 includes a comparison of the remaining Top Four mitigation strategies.

Table 3.2: Application whitelisting: mandatory controls under the Protective Security Policy Framework and treatment in the Essential Eight Maturity Model

Note a: SOE is Standard Operating Environment. This is the specification of the architecture, operating systems, application set and configuration of computers within an organisation.

Note b: DLL is Dynamic Link Library. This is a file that contains a library of functions and other information that can be accessed by a Windows program.

Source: ANAO analysis.

3.23 For application whitelisting, an assessment of Maturity Level 3 could be achieved with the implementation of only one of the five mandatory controls (Row 1 in Table 3.2), however it would also require the implementation of a control in the Essential Eight Maturity Model (Row 6) that is not mandatory under the Protective Security Policy Framework. Implementation of the second of the five mandatory controls (Row 3) would enable the entity to achieve a maturity assessment of four.

Table 3.3: Restrict administrative privileges: mandatory controls under the Protective Security Policy Framework and treatment in the Essential Eight Maturity Model

Source: ANAO analysis.

3.24 For the strategy to restrict administrative privileges, an assessment of Maturity Level 3 could be achieved with implementation of one (Row 4 of Table 3.3) and partial implementation of a second of four controls (Row 1) that the Protective Security Policy Framework identifies as being mandatory for this strategy.

3.25 In the case of all four mandatory strategies, the mandated controls that make up each strategy are included at Appendix 6. It would be possible to achieve a maturity rating of three under the Essential Eight Maturity Model without implementing all of these controls. The ANAO considers that some of these controls, if not implemented, would undermine the effectiveness of the strategies—for example, the control to prevent users from bypassing the whitelisting mechanism.

3.26 In the case of application whitelisting, an entity could achieve compliance with the strategy but not be assessed as achieving Maturity Level 3 (because it does not satisfy a non-mandatory control under the Protective Security Policy Framework—Row 6 in Table 3.2).

3.27 In its current format, the Essential Eight Maturity Model does not provide a means for entities to accurately assess compliance. If entities also use the model in self-assessing and reporting on compliance with mandatory mitigation strategies, the potential exists that entities will overstate or understate compliance, make incorrect and inefficient cyber security investment decisions and inadequately mitigate cyber risks.

3.28 Given the multiple instruments in assessing the effectiveness of ICT security controls, there is likely to be uncertainty for entities in deciding whether to adopt: a controls-based assessment by using the Information Security Manual; or the simpler Essential Eight Maturity Model, which may not provide the required level of assurance.

Compliance arrangements for cyber security

3.29 Responsibilities for cyber security in the Commonwealth are with the Accountable Authorities of the particular Commonwealth entities for implementing effective cyber security arrangements in their entity, and various entities with broader responsibilities. These entities include:

• Attorney-General’s Department, as the policy owners of the Protective Security Policy Framework;
• Department of Home Affairs, responsible for cyber security policy coordination; and
• Australian Signals Directorate, as regulator of the policy for promoting compliance with the Information Security Manual.

3.30 This audit has identified a lack of guidance for entities to self-assess and report against compliance with the Top Four mitigation strategies, and problems with the accuracy of the Essential Eight Maturity Model in assisting entities to determine compliance.

3.31 As discussed in paragraph 3.3 (and Appendix 5), each of the previous three ANAO audits on cyber security identified high rates of non-compliance with the requirements of the Protective Security Policy Framework. The findings in this audit are of similar levels of non-compliance with the Top Four mitigation strategies, and in total only four of the 14 entities assessed have been compliant. Self-reporting of compliance also remains low (at around 60 per cent).

3.32 The cyber security framework as it stands only contains reporting based on self-assessment as a compliance mechanism. Reports to the Secretary of the Attorney-General’s Department are not made public, and are not used to inform further compliance activities by the Australian Signals Directorate. Audits by the ANAO are the only additional activity that provide transparency of compliance with the framework. Given the importance of managing cyber security, the current regulatory framework is not driving sufficient improvements in cyber security.

Changes to security reporting and cyber-related requirements under the Protective Security Policy Framework

3.33 Changes have been proposed to security reporting requirements under the Protective Security Policy Framework. The proposals include a requirement on ‘safeguarding information from cyber threats’ that explicitly identifies application whitelisting, application and operating system patching, and restricting administrative privileges as mandatory requirements of the Protective Security Policy Framework. In June 2018, the Government Security Committee is scheduled to consider supporting policy and guidance for this core requirement, that aims to more clearly articulate what is mandated for entities’ application whitelisting, application and operating system patching, and restricting of administrative privileges (with reference to guidance in the Information Security Manual).

3.34 In consultation with entities, the Attorney-General’s Department has developed a new approach to reporting against the Protective Security Policy Framework⁴³, to address identified concerns about the accuracy of self-assessed reporting. There will be a revised Protective Security Policy Framework reporting template and additional assurance measures to support accurate self-assessments, including for the first time the need to have supporting evidence.⁴⁴ The existing compliant/non-compliant approach will be replaced by a broader maturity rating model comprised of four grading levels⁴⁵, with maturity indicators for each maturity level.

3.35 The ANAO has not audited the proposed maturity model or draft reporting template but notes that technical guidance has not yet been developed that would provide detailed control assessment test plans that are well aligned to the controls outlined by the Australian Signals Directorate for the Top Four Mitigation Strategies, and accurately reflect security control effectiveness. It is important that the Australian Signals Directorate develops such guidance to support the reporting changes underway.

3.36 The revised security reporting and cyber-related requirements under the Protective Security Policy Framework are scheduled to be implemented in 2018–19. In line with the Joint Committee of Public Accounts and Audit’s Recommendation 4 of Report 456, after that time the ANAO would be in a position to consider conducting an audit of the effectiveness of the self-assessment and reporting regime under the Protective Security Policy Framework.

3.37 The changes underway to security reporting and cyber-related requirements under the Protective Security Policy Framework do not include any new proposals for verification of compliance. In light of the continued low level of compliance with the Top Four mitigation strategies, consideration should be given to also strengthening this aspect of the framework.

3.38 The proposed changes also do not include strategies or activities to improve the transparency of compliance with cyber security requirements or accountability for achieving or not achieving compliance—such as public reporting of the reports to the Secretary of the Attorney-General’s Department.

Background

4.1 As discussed in Chapter 1, JCPAA Report 467: Cybersecurity Compliance recommended that the ANAO outlines the behaviours and practices it would expect in a cyber resilient entity, and assesses against these in future audits of cyber security compliance.⁴⁶

4.2 To address this recommendation, the ANAO has drawn on previous audit work to assess the cyber resilience culture of the three audited entities. In particular, this audit has drawn on ANAO Audit Report No.37 2015–16 Cyber Resilience, which included a list of behaviours and practices that may improve the level of cyber resilience (Table 3.1 on p. 41 of that report). These criteria have been refined and expanded upon to form the basis of the current assessment.

4.3 The ANAO also recognises that the Australian Signals Directorate and relevant policy entities (Attorney-General’s Department and Department of Home Affairs) are responsible for security self-assessment and reporting processes, and, as such, are better positioned to articulate the appropriate cyber resilient behaviours and practices. If such criteria are incorporated into their guidance documents, the ANAO will reference that guidance in future cyber security audits.

Characteristics of a cyber resilient organisation

4.4 Robust and up-to-date technical security solutions alone cannot safeguard individuals’ data and economic information stored by government entities. The implementation of the mandatory strategies, effectiveness of an entity’s ICT general controls framework, and a fit for purpose cyber security culture forms the basis of its cyber resilience.

4.5 In 2015, the ANAO reported in its second cyber security performance audit that effective entities had a business model and ICT governance that incorporated ICT security into their strategy, planning and delivery of government services. For these entities, ICT systems were no longer considered an enabler to business—they were core business. These entities understood the risk profile across their enterprise ICT systems, and managed those risks systematically, including through assessments of the effectiveness of controls and security awareness training. They had taken steps to improve business processes to accommodate the security strengths and weaknesses of each ICT system. For these effective entities, ICT security was a priority.

4.6 The deployment of ICT security measures does not in itself ensure a strengthened ICT security posture across the enterprise environment. Effective entities adopted a risk-based approach to identify and prioritise security enhancements and to ensure the highest vulnerabilities are addressed first. These entities had an integrated and documented architecture for data, systems and security controls, designed and deployed security measures at a system-level rather than at a control-level, and were aware of the importance of looking beyond the Top Four mitigation strategies. The entities had taken varying steps to implement the remaining strategies from the Australian Signals Directorate Strategies to Mitigate Cyber Security Incidents.⁴⁷

4.7 Cyber resilient entities also demonstrate a leadership culture and behaviours that prioritise cyber security and focus on it, investing to strengthen their ICT environments to make the most of opportunities online. Executives and senior managers in these entities were informed of the cyber trends—the motives, opportunities and emerging technology—that might target and compromise their systems, and responded to cyber security incidents in a timely manner. These managers understood their roles and responsibilities for the business services and systems for which they were accountable. They did not expect ICT technical staff to be solely responsible for resolving ICT security matters.

4.8 Effective entities had key ICT operational staff with a sound understanding of the threats that may affect the enterprise ICT network, applications, databases and operating systems. They were aware of known security flaws affecting their assigned systems, and deployed mitigating controls in the absence of enterprise-wide security measures.

4.9 Security awareness and initiatives are a shared responsibility within an organisation. Entities that embedded security awareness as part of their culture adopted a mutual obligation approach towards security responsibility and accountability. All staff had a duty to monitor and report on observed cyber attacks. These entities had established ICT security officers⁴⁸, and provided information security awareness and training to all staff and contractors.

4.10 These characteristics of cyber resilient organisations have formed the basis of the ANAO’s assessment of the three audited entities.

Did entities have effective arrangements in place for managing cyber risks?

4.11 The review of management arrangements to assess cyber resilience covered: risk management and governance arrangements; and risk-based processes for prioritising improvements to cyber security. In assessing the other behaviours and practices of a cyber resilient entity, the ANAO considered the entities’ measures to build a culture of cyber resilience to fit their business needs.

Cyber security risk management and governance

4.12 Table 4.1 shows the ANAO’s assessment of the three entities’ cyber security risk management and governance arrangements.

Table 4.1: Entities’ cyber security risk management and governance arrangements

Source: ANAO analysis.

4.13 Two of the three entities (Treasury and National Archives) had incorporated ICT security into strategy, planning and delivery of services. Their respective corporate plans and annual reports had documented key enterprise risks and cyber strategies to support the effective delivery of government services. Geoscience Australia advised in May 2018 that it had developed a plan to update its strategic and planning documents to better incorporate ICT security.

4.14 Entities provided evidence to demonstrate that a number of key cyber security practices were in place. These practices included managing key ICT infrastructure, conducting threat assessments before rolling out new ICT systems and conducting security awareness programs at staff induction and annually after that. In practice, each of the three entities had a range of non-systematic approaches to managing cyber risks across their operations that did not always align with the enterprise strategic initiatives.⁴⁹

4.15 The ANAO expected entity business models and ICT governance to be informed by an integrated and documented architecture for data, systems and security controls, to ensure ‘security by design’ of the enterprise ICT systems. All three entities had a high-level enterprise-wide ICT systems architecture plan, but in two entities these plans were out-of-date and/or did not reflect the actual ICT systems design. Supporting documentation did not include: the security initiatives in use across the ICT systems and the effectiveness of the controls; and an endorsed storage strategy, outlining the business owner of the data, business importance of the data to the entity, and security classification of the data stored.

4.16 Each of the three entities had enterprise-wide governance arrangements in place, including risk management and business continuity frameworks, to manage their business and deliver government services.

4.17 According to Treasury, the department takes a deliberately cautious approach to managing risk, which it considers appropriate given the nature of its work. For example in preparing the annual Commonwealth Budget, the department conducts risk workshops in the lead up to the Budget period, including running desktop exercises for business continuity, disaster recovery and data backups. During the Budget preparation period, there is a ‘freeze’ on changes to the enterprise-wide ICT systems.

4.18 In all three entities, the audit and risk committees met regularly to review enterprise-level and operational-level risks, and focused on key delivery services and projects in-flight. There was no evidence that these committees reviewed vulnerabilities and cyber threats. For National Archives and Geoscience Australia, risk registers were prepared at the division or branch level but were not consolidated in an enterprise risk register to inform decision making on cyber risks and investments.

4.19 In all three entities, information security roles had been assigned to key positions and the responsibilities documented, however the positions were not all filled. At the time of audit fieldwork, Treasury had recently appointed a Chief Information Officer at the Senior Executive Service level to take on the role and responsibility of Chief Information Security Officer. Geoscience Australia had also recently appointed a Chief Information Officer at the Senior Executive Service level, and had separated that role from the Chief Information Security Officer position, with the Chief Operating Officer having responsibility for that role. The National Archives separated the roles of Chief Information Officer and Chief Information Security Officer in November 2017, appointing the Assistant Director-General Corporate Services to the latter role. National Archives was in the process of recruiting a Chief Information Officer at the time of the audit.

4.20 For all three entities, the frequent movement of experienced Chief Information Security Officers and Information Technology Security Advisors was a challenge. The ANAO considers that this increases the importance of a systematic rather than individual approach to cyber security—that can continue to be implemented and monitored by senior management even in the absence of ICT security management roles being filled.

4.21 The three entities had key ICT operational staff with a sound understanding of the vulnerabilities and cyber threats that may affect their ICT systems. In all entities, security awareness initiatives, including communication and training, were part of their culture. All staff had a duty to monitor and report on observed cyber threats.

Prioritising improvements to cyber security

4.22 Table 4.2 shows the ANAO’s assessment of the three entities’ initiatives and priorities to improve cyber security.

Table 4.2: Entities’ initiatives and priorities to improve cyber security

Source: ANAO analysis.

4.23 The three entities did not adopt a systematic risk-based approach to prioritise improvements to cyber security across their ICT systems. As a minimum, entities responded to current operational needs in delivering government services and in achieving compliance with government requirements. In general, the priority for additional cyber improvements was focused in delivering security controls for new ICT systems prior to deployment. There was limited evidence of assessment and formal planning to explain the level of priority given to other key enterprise assets (data and systems) and to high vulnerability systems.

4.24 In all three entities, cyber security investment initiatives were not addressing long-term strategic initiatives, instead being focused on short-term operational responses to identified cyber risks. Entities had approved annual capital and operations budgets for ICT systems. Entities did not have documented cyber initiatives beyond 2017–18 or a proposed investment budget for cyber security initiatives. However, at the time of the audit fieldwork in late 2017 the National Archives commenced an external review to inform its cyber investment initiatives in support of the Digital First program. Geoscience Australia also engaged an external reviewer to better understand its cyber resilience gap, including achieving compliance, and to inform its cyber investment initiatives beyond 2017–18.

Did entities have a cyber resilience culture?

4.25 The hallmarks of a cyber resilience culture are the set of shared attitudes, values and behaviours that characterise how an entity considers cyber risk in its day-to-day activities.⁵⁰ It requires more than compliance with government requirements and following a checklist of behaviours and practices that may improve an entity’s cyber resilience; however being able to evidence those requirements, behaviours and practices can be considered an indicator of those attitudes and values being in place.

4.26 A cyber resilience culture promotes an open and proactive approach to managing cyber risk that considers both vulnerabilities and opportunity; and is one where cyber risk is appropriately identified, assessed, communicated and managed across all levels of the entity. Cyber resilient entities demonstrate a leadership culture and behaviours that prioritise cyber security and focus on it.

Progress towards a cyber resilience culture

4.27 All entities are on a journey to better understand the shared attitudes, values and behaviours expected from their leaders and management, staff and service providers, where a shared understanding of cyber risk leads to well informed decision making and investments to make the most of opportunities online. They each have different challenges in adopting and embedding a cyber resilience culture, reflecting their different circumstances.

• Treasury is aware of the importance of its sensitive data holdings and has ongoing activities to strengthen its cyber security, with cyber investments focused on critical services such as the Commonwealth Budget. There is entity-level oversight through governance committees and regular reporting of the cyber risks to the enterprise ICT systems. Security awareness and initiatives are noticeable behaviours amongst staff.
• National Archives had a number of longstanding practices and could have learnt more from looking outwardly to the cyber resilience practices of other entities.
• Geoscience Australia has had a culture of scientific independence that has been allowed to override cyber resilience considerations.⁵¹ Insufficient cyber investments in past years reflect the entity’s modest understanding of the critical role it plays in coordinating and reporting on national disasters. A new leadership team has escalated the assessment of cyber risks and intended security posture; and is in the process of determining the investments required to achieve compliance.

4.28 The selected entities have implemented or are in the process of implementing a range of measures to build their cyber resilience culture to fit their business needs. Key measures included:

• an ICT program of work to maintain compliance and look beyond the Top Four mitigation strategies (Treasury and National Archives);
• a leadership culture and behaviours that prioritises cyber security, including appropriate investment (Treasury);
• key ICT operational staff with a sound understanding of the threats that may affect the enterprise ICT network, applications, databases and operating systems (all entities); and
• security awareness programs that address cyber security, including eLearning modules (all entities).

4.29 Further work is required by National Archives and Geoscience Australia to achieve compliance with the Top Four mitigation strategies. Until compliance is achieved—and a step closer to the goal of cyber resilience—it is inappropriate to assume that a positive cyber resilience culture is in place.

Behaviours and practices of cyber resilient organisations

4.30 As a result of this audit, the ANAO has outlined additional behaviours and practices of cyber resilient entities to assess against in future cyber security audits. Table 4.3 provides an updated checklist that may improve an entity’s level of cyber resilience, many of which relate to risk management and governance arrangements. All entities are encouraged to assess the benefits of implementing these behaviours and practices in light of their own circumstances. In the absence of other guidance from the relevant entities, this will also form the basis of any future assessment of cyber resilient culture by the ANAO.

4.31 Attention should also be given to contracted ICT service providers and cloud computing services when assessing whether an entity has established key elements of a cyber resilient culture. Third party providers play a key role in the delivery of government services. Commonwealth entities need to consider the contributions and behaviours expected from third party providers in supporting the entity’s cyber resilience culture, and reflect these in the service level agreements.

Table 4.3: Behaviours and practices that may improve the level of cyber resilience

Source: ANAO.

Appendix 1 Responses from the selected entities

Formal responses received by the ANAO following circulation of the draft report are reproduced below.

Responses were received from:

• Department of the Treasury;
• National Archives of Australia;
• Geoscience Australia;
• Attorney-General’s Department;
• Australian Signals Directorate; and
• Department of Home Affairs.

Appendix 2 Compliance grading scheme

1. In order to assess compliance consistently across the three entities, the ANAO applied a set of assessment criteria and developed a graphical key; a reporting convention similar to a ‘traffic light’ report. The keys are represented as either a Harvey Ball or cone. The key is outlined in Table A.1.

Table A.1: Key to grading scheme for assessing compliance with the Top Four mitigation strategies and ICT general controls

Source: ANAO.

2. The selected entities were assessed on their:

• compliance with the Top Four mitigation strategies and related controls; and
• maturity to effectively manage logical access and change management as part of normal business processes (ICT general controls).

3. The ANAO’s summary findings for each of the selected entities are reported in the context of a matrix, shown in Table A.1, which indicates entities’ overall level of protection against internal and external threats as a consequence of steps taken to implement the Top Four mitigation strategies and ICT general controls. The matrix, which is referred to as the Entity cyber security posture matrix, indicates where entities are positioned in terms of cyber resilient zones: vulnerable zone; externally resilient zone; internally resilient zone, and cyber resilient zone.

4. The zones are explained further in Table A.2 and illustrated in Figure A.1. An entity’s position indicates its overall cyber resilience—in essence how well the entity is protecting its exposure to external vulnerabilities and intrusions, internal breaches and disclosures, and how well it is positioned to address threats.

Table A.2: Definitions of the Cyber Resilient zones

Source: ANAO.

Figure A.1: Entity cyber security posture matrix

Source: ANAO.

Appendix 3 The Essential Eight Maturity Model

Source: Australian Signals Directorate, Essential Eight Maturity Model [Internet], 2018. Available from <https://www.asd.gov.au/publications/protect/essential-eight-maturity-model.htm> [accessed 18 April 2018].

Appendix 4 Analysis of Top Four Mandatory Strategies to the Essential Eight Maturity Model—Patch Applications and Patch Operating Systems

Source: ANAO analysis.

Appendix 5 Findings from previous audits

Drawing on comparisons from past audits

1. ANAO Performance Audit Report No.50 2013–14 Cyber Attacks: Securing Agencies’ ICT Systems (the first audit), was tabled in June 2014. In this audit, the ANAO examined seven entities’⁵² compliance with the Top Four mitigation strategies and found that none of the seven entities were compliant with these strategies. The ANAO made three recommendations, which were agreed by all agencies (see later section in this Appendix). The entities accepted the audit findings and endorsed the three recommendations proposed by the ANAO.

2. The Joint Committee of Public Accounts and Audit (JCPAA) reviewed the first audit in October 2014.⁵³ Three of the seven audited entities—Australian Taxation Office, Department of Human Services and the then Australian Customs and Border Protection Service—appeared before the hearing to explain their plans and timeframes to achieve compliance. Each of the three entities gave assurance to the JCPAA that they would achieve compliance during 2016.

3. The JCPAA published its report in March 2015 and recommended that the seven entities achieve full compliance with the Top Four mitigation strategies as soon as possible. The JCPAA also recommended the Auditor-General consider a follow-up audit, as well as undertaking regular audits of Commonwealth entities’ compliance with the Top Four mitigation strategies.

4. In 2015, the ANAO conducted a second performance audit to examine a further four government entities’ compliance with the Top Four mitigation strategies. The four entities were: Australian Federal Police; Australian Transaction Reports and Analysis Centre; Department of Agriculture and Water Resources; and the Department of Industry, Innovation and Science. The ANAO Performance Audit Report No.37 2015–16 Cyber Resilience was tabled in May 2016. In this audit the ANAO found that two entities—Australian Transaction Reports and Analysis Centre, and the Department of Agriculture and Water Resources—were compliant with the Top Four mitigation strategies.⁵⁴ The other two entities were not compliant with these strategies.⁵⁵ The ANAO made three recommendations and all entities agreed with all recommendations.

5. In 2017, the ANAO conducted a follow-up audit of the cyber resilience of the three audited entities that appeared before the JCPAA hearing in October 2014. ANAO Performance Audit Report No.42 2016–17 Cybersecurity Follow-up Audit (the third audit) was tabled in March 2017. In this audit, the ANAO found that only the Department of Human Services was cyber resilient. To progress to being cyber resilient, the Australian Taxation Office and the Department of Immigration and Border Protection needed to improve their governance arrangements and prioritise cyber security.⁵⁶ The ANAO made two recommendations and all entities agreed with all recommendations.

Recommendations from previous audits

Audit Report No.50 2013–14 Cyber Attacks: Securing Agencies’ ICT Systems

ANAO Recommendation No. 1

To achieve full compliance with the mandatory ISM strategies and related controls, the ANAO recommends that agencies:

2. complete activities in train to implement the top four ISM controls across their ICT environments; and
3. define pathways to further strengthen application whitelisting, security patching for applications and operating systems, and the management of privileged accounts.

Response from selected agencies: Agreed

ANAO Recommendation No. 2

To reduce the risk of cyber attacks to information stored on agency databases, the ANAO recommends that agencies strengthen logical access controls for privileged user accounts to the database by eliminating shared accounts, recording audit logs and monitoring account activities.

Response from selected agencies: Agreed

ANAO Recommendation No. 3

To strengthen their ICT security posture, the ANAO recommends that agencies:

1. conduct annual threat assessments across the ICT systems, having regard to the Top 35 Mitigations Strategies—as proposed by the Australian Signals Directorate; and
2. implement periodic assessment and review by the agency security executive of the overall ICT security posture.

Response from selected agencies: Agreed

Audit Report No.37 2015–16 Cyber Resilience

ANAO Recommendation No. 1

Entities establish processes to monitor patch levels across their enterprise ICT systems.

Response from selected entities: Agreed.

ANAO Recommendation No. 2

That entities:

1. conduct periodic assessments on the effectiveness of IT security controls across their enterprise ICT systems;
2. decide on the optimal and/or desired ICT security posture; and
3. define strategies to achieve and maintain the desired ICT security posture.

Response from selected entities: Agreed.

ANAO Recommendation No. 3

That entities:

1. capture and store audit logs for privileged user accounts; and
2. actively monitor privileged user accounts for unauthorised access and inappropriate behaviour, preferably with the support of a security information and event management (SIEM) tool.

Response from selected entities: Agreed.

Audit Report No.42 2016–17 Cybersecurity Follow-up Audit

ANAO Recommendation No. 1

The ANAO recommends that entities periodically assess their cyber security activities to provide assurance that: they are accurately aligned with the outcomes of the Top Four mitigation strategies and entities’ own ICT security objectives; and that they can report on them accurately. This applies regardless of whether cyber security activities are insourced or outsourced.

Response from selected entities: Agreed.

ANAO Recommendation No. 2

The ANAO recommends that entities improve their governance arrangements, by:

1. asserting cyber security as a priority within the context of their entity-wide strategic objective;
2. ensuring appropriate executive oversight of cyber security;
3. implementing a collective approach to cyber security risk management; and
4. conducting regular reviews and assessments of their governance arrangements to ensure its effectiveness.

Response from selected entities: Agreed.

Appendix 6 Top 4 Mitigation Strategies and other applicable controls

1. The Information Security Manual includes a section on Information Technology Security that sets out the specific controls for which compliance is required by the Protective Security Policy Framework. A table summarising these controls is reproduced below:

Source: Australian Signals Directorate, Information Security Manual, [Internet], 2017, p. 122, available from <https://www.asd.gov.au/publications/Information_Security_Manual_2017_Controls.pdf>, [accessed 18 April 2018].

2. The same section also identifies other applicable controls which, while not mandatory are ‘best practice for a Top 4 implementation and complement the mandatory controls listed above.’⁵⁷

Source: Australian Signals Directorate, Information Security Manual, [Internet], 2017, p. 123, available from <https://www.asd.gov.au/publications/Information_Security_Manual_2017_Controls.pdf>, [accessed 18 April 2018].