iscover
Share this article on:
Powered by
MOMENTUM
MEDIA
Australia’s largest energy producer has called on the federal government to rethink a number of its cyber processes, including its potential move to outlaw ransomware payments.
In its submission to the 2023–2030 Australian cyber security strategy discussion paper, AGL has said that banning ransomware payments, while likely to reduce the number of ransomware attacks, could have dire consequences.
“Prohibiting the payment of ransom or extortion demands may reduce the volume of attacks,” said AGL.
“However, such a prohibition may result in potentially avoidable catastrophic damage, harm to community, loss of life, disruption of essential services or disclosure of sensitive information.
“In some circumstances and for some organisations, the payment of a ransom demand may be the only path to achieving acceptable outcomes.”
AGL said that instead, the federal government should “revisit imposing such a prohibition when Australia has a more resilient cyber security capabilities in place” and should, for now, focus strongly on discouraging organisations from paying ransom demands, but acknowledge that there are situations where payments may be the best option.
“Government can take a more active leadership role to help victim organisations and individuals to make better informed decisions on whether to pay a ransom, with consideration given to all relevant matters, including consequential harms across stakeholder groups,” said AGL.
The Australian government has previously expressed concern at the possibility of a “dystopian future” of attacks on critical infrastructure.
Home Affairs and Cyber Security Minister Clare O’Neil has said that one day, threat actors and groups could hold entire digitally connected Australian cities to ransom, with critical infrastructure attacks giving them control of things like surgery schedules in hospitals, traffic lights and more.
Instances like these are what AGL is concerned about, where not paying ransom could lead to “catastrophic damage, harm to community, loss of life, disruption of essential services or disclosure of sensitive information”.
AGL’s submission also had a number of other critiques of the federal government, including its implementation of the Essential Eight.
The energy producer said that the government should be a leader in the practice of better cyber security, particularly agencies that handle sensitive information.
AGL said that many of these agencies fall short of achieving Essential Eight maturity, as audits reveal more gaps in security processes.
“It is very concerning that a significant number of government entities fail to achieve Essential Eight maturity, and significant exposures and capability gaps continue to be identified in government audits and reviews at all levels of government,” said AGL.
“[The] government must show leadership by accelerating the hardening of government systems in line with relevant requirements.”
AGL continued, saying that trust in government and its ability to remain cyber secure “should be prioritised at all levels” and that it was a government responsibility to demonstrate what good cyber security processes are and to acknowledge shortcomings.
The energy producer said that the government could improve “public-private mechanisms for cyber threat sharing and blocking” in a number of ways, such as declassifying and broadly sharing relevant threat information and coordinating, facilitating and supporting information-sharing networks within the industry.
The full AGL submission can be found here.
Be the first to hear the latest developments in the cyber industry.
