Security is part and parcel of any modern enterprise. Whether small or large, an enterprise is entrusted by shareholders and their customers to protect their interests. This has become increasingly more difficult with the rise of sophisticated attacks.
In 2018 the Australian Government published the Security of Critical Infrastructures Act (Cth) (SOCI Act) to drive the creation of a framework to protect critical infrastructure assets. The Act would target the electricity, water, gas and ports sectors. In November 2020, a draft Bill was introduced to increase the scope of the SOCI Act to include 11 sectors, with enforcement anticipated to commence in January 2022.
The purpose of SOCI is to create a unified view of domestic and foreign attacks on critical Australian infrastructure. By collecting this information, the Australian Government can assess the scope of the attack and trigger an appropriate response.
The amendments to the SOCI Act that will come into effect this year will place new obligations, such as Positive Security Obligations, that will include adopting and maintaining a critical infrastructure risk management program. Two of the immediate actions that an organisation needs to take is to firstly assess the maturity of your Risk Management Program as it relates to CI and secondly to complete the discovery, cataloguing vulnerability assessment of all IT assets and devices connected to their network, then ensure this is kept up to date.
SOCI requirements cannot be easily addressed through traditional delivery models as they are often manual, labour intensive and challenging to keep up to date so don't really support robust risk management
Understanding the state of an infrastructure deemed critical can be challenging let alone attempting to decipher how its changing over time. An additional challenge for some sectors is you'll need to include your Operating Technology (OT) as part of the monitoring.
Failure to comply with the framework can result in financial penalties and in some cases, can attract 2 years imprisonment.
ML Digital, using its ecosystem of tech partners, are helping organisations deliver to their obligations using advanced automation and analytics. We can work with your organisation to quickly identify and prioritise your response and readiness for Critical Infrastructure impacts.
Ensuring resilience of CI requires infrastructure owners and operators to firstly provide an assessment of their asset’s unique attributes. We will work with you to conduct a review of your Risk Management Program as it relates to CI and work with you to identify key vulnerabilities and areas for improvement and your SOCI obligations.
It is critical to understand your current state of play. We will work closely with you to understand your critical infrastructures and build a source of truth (CMDB). This CMDB is custom built with an extended schema to capture all requirements under SOCI Act.
We will design and build a digital worker to audit all infrastructures against the baseline. The digital worker can run on demand or scheduled.
Based on your business rules, digital workers can escalate discrepancies to a service desk for resolution or can execute other digital workers to remediate on your behalf. Second line digital workers can be invoked to perform additional testing or implement a more aggressive security posture in the face of a threat.
Our value proposition is to deliver a digitised and automated approach to the discovery, cataloguing, monitoring and reporting of your critical infrastructure assets. Ensuring compliance with SOCI obligations and providing robust risk management capabilities.
Please reach out to grant@mentorlist.com.au to organise a discussion on how we can help.