Information Security Threat Environment

Robert Lowe, AusCERT Training Team Leader, gave an informative and frightening overview of the treats to computer systems at the ACS meeting in Canberra on Tuesday. He is also speaking in Perth 19 August, Hobart 21 August, Wollongong 26 August, Sydney 25 August, Adelaide 27 August and Darwin 11 September.

AusCERT is Australia 's national Computer Emergency Response Team, providing advice and monitoring security treats on the Internet. It provides a national alerting service and an incident reporting scheme.

Robert provided statistics showing many home computers have out of date operating systems and security software. Even when home users are alerted to a security problem with their computer, many simply ignore it. Robert pointed out that corporate users can't be complacent about their own security. Home computers are used to connect to corporate systems and can compromise them.

Some of the discussion was about cooperation between AusCert and government security authorities, with information on threats passed on for action. But AusCert is different to the other response teams around the world: it is not funded by a parent body. Other national response teams are directly funded by their national governments. AusCert has to raise funds from its members, by running courses and from short term government contracts.

AusCert's funding came to my attention some years ago, when I had a call at the Department of Defence from a well known Queensland security expert. They first asked me what sort of phone I was using. Having established that the line was secure enough, they explained that AusCert was about to run out of money and could DoD help with a bit? I send off a recommendation into the defence bureaucracy and a few days later someone whispered it was "sorted". The process was somewhat mysterious.

Ad-hoc funding is not the way to run an service essential to Australia's national security. The Minister for Broadband, Communications and the Digital Economy and the Attorney General must be aware that an attack on Australia's networks threatens the national economy, as well as the lives of Australians. Adequately funding those who are protecting the infrastructure is an easy first step in combating the threat.

I attended part of the AWB inquiry, into bribery and breaking of UN sanctions with the UN Oil-for-Food Programme in Iraqi. Senior public servants and ministers were asked what they knew and why they did not act. In that case they were able to successfully argue that they could not have reasonably known what was going on.

But if there is a major attack on Australia's network infrastructure, the Ministers and their senior advisors will have difficulty convincing the judge that they could not have anticipated it. If the resulting loss to the economy, damage to infrastructure or loss of life is large enough, those responsible can expect to be jailed.

EDUCATION ACROSS THE NATION - SECURITY (The Information Security Threat Environment)

AusCERT is the national Computer Emergency Response Team for Australia and a leading CERT in the Asia/Pacific region.

As a trusted Australian contact within a worldwide network of computer security experts, and an active member of the Forum for Incident Response and Security Teams (FIRST) and Asia Pacific Computer Emergency Response Team (APCERT), AusCERT has access to accurate, timely and reliable information about emerging computer network threats and vulnerabilities on a regional and global basis and provides computer incident prevention, response and mitigation strategies for members, a national alerting service and an incident reporting scheme.

Providing computer information security advice to the Australian public and its members, including the higher education sector, AusCERT are the single point of contact for dealing with computer security incidents affecting or involving Australian networks.

The very nature of AusCERT's role makes this an Education across the Nation event not to be missed.

Biography: Robert Lowe

Robert Lowe has worked at AusCERT since June 2003 as a Computer Security Analyst. He is now AusCERT's Training Team Leader and assists in the development and delivery of AusCERT training courses. Prior to joining AusCERT Robert was a Senior Client Services Engineer for an Internet gaming software provider. Robert's previous experience includes systems and database administration, development, training delivery, as well as application integration and support. Robert graduated from the University of Technology, Sydney in 1999 with a Bachelor of Science (Computing) and has over 10 years experience in the IT industry.