TOLA and CIMA: Is Your Data Safer Now?
Last week the Australian government released its first Cyber Incident Management Arrangements report. Just days earlier, the TOLA anti-encryption act passed both houses of Parliament, despite strong public and tech industry opposition. What’s the key takeaway? Understanding your personal and corporate cyber security risks is more important than ever.
First, let’s look at why the TOLA Act (Telecommunications and Other Legislation Amendment) is so unpopular. Its goals are laudable – certainly catching child abusers and stopping terrorist threats are important to the country’s physical security. Perhaps the risk of opening an encryption back-door is a price worth paying, and the government has offered explanations to “myth-bust” (LINKS TO: https://asd.gov.au/speeches/20181212-tola-act-statement.htm ) this new legislation.
The bottom line, however, is that opening a back door to data encryption not only allows government agencies access, it potentially allows hackers access to operating systems. Like most cyber threats, the question is not if a breach will occur because of this new policy, but when. Let’s look back at the WannaCry ransomware attack. The vulnerability that allowed WannaCry access was discovered by the U.S. National Security Agency, but was not reported to anyone in private sector information security. Instead, they developed code to exploit the vulnerability, and that code was stolen by a hacking group.
This brings us to CIMA (Cyber Incident Management Arrangements). This report outlines how to coordinate government responses in case of a national cyber incident. Each governmental entity is developing specific protocol for incident management. A national cyber incident is defined as one that “significantly impacts… multiple Australian jurisdictions.” This could include malicious activity, a large-scale information breach, or the compromise of the system of a major public or private organisation that operates across multiple jurisdictions.
CIMA includes specific information about how a national cyber incident would be declared and designates the National Cyber Security Committee as the body to manage response efforts. The responsibilities of various levels of government are also outlined.
One of CIMA’s principles is shared responsibility, which “extends to business and the community, including small, medium, and large businesses, which are responsible for maintaining their own cyber security.”
If you are not certain about your personal or business cyber security, it’s time to learn more about My Personal Helpdesk. We offer a number of flexible membership levels, along with concierge computer services. If you want to secure your business operations, just get in touch and we’ll consult with you to give you the 24/7 coverage you need.