Prevention of environmental harm from cyber security incidents

As operators integrate more technology into their activities, the risk of malicious cyber security incidents increases. Globally, cyber security incidents have targeted providers of critical infrastructure to disrupt and destruct operations. For example, incidents targeting water and electricity suppliers. Cyber security incidents have the potential to cause environmental harm. For example, highly contaminated material could be released to the environment due to a cyber incident that targeted an operator’s control system.

To comply with their general environmental duty, operators of regulated activities should take all reasonably practicable measures to prevent or minimise the risk of environmental harm caused by potential cyber security incidents.

Advice on best practice for prevention of cyber security incidents can be found on the Australian Signals Directorate (ASD) webpage, resources for business and government. The ASD has developed the Essential Eight which are mitigation strategies for cyber security incidents. Operators can also become members of the ASD Cyber Security Partnership Program who can provide information, skills and capability to partners to lift cyber resilience across the Australian economy.

The Security of Critical Infrastructure Act 2018 outlines the responsibilities of operators managing critical infrastructure assets, ensuring they implement suitable measures to secure their systems. This legislation mandates that these operators actively engage in risk management and preparedness to safeguard their infrastructure against potential threats, which can also safeguard environmental values. Critical infrastructure is infrastructure that is essential to the functioning of Australia’s economy, society and / or national security and includes water, sewage and energy providers as well as other sectors. Operators undertaking activities that do not fall under the definition of critical infrastructure should still be aware of their cyber security obligations to ensure appropriate measures are undertaken to protect their business and the environment.

The National Institute of Standards and Technology (NIST) Cybersecurity Framework provides guidance to industry, government agencies and other organisations to manage Operational Technology (OT) cybersecurity risks. The ASD provides the principles of operational technology cyber security publication, that has been created in conjunction with several global agencies to guide decision makers on their impacts to cyber security of the OT environment.

What can operators do to mitigate the risks of cyber incidents?

• Follow best practice cyber security, such as ASD’s Essential Eight Mitigation Strategies, or an equivalent framework.
• Prioritise secure-by-design or secure-by-default products.
• Thoroughly understand networks, map them and maintain an asset registry to help manage devices and all networks, including OT.
• Scrutinise the organisation’s ICT supply chain vulnerabilities and risks.
• Develop and test robust business continuity and disaster recovery plans to ensure your organisation can quickly respond in the event of a cyber incident.
• Report cyber security incidents early to ReportCyber at cyber.gov.au/report.
• Join the ASD Cyber Security Partnership Program and help build the nation’s collective cyber resilience.