Lessons From #Censusfail

Dane Meah
August 10, 2016


In the lead up to what was meant to be the digitalisation of the largest survey in Australian history, privacy concerns were front and centre.  A number of Senators and even former NSW Deputy Privacy Commissioner Anna Johnston, publically refused to provide their personal details.

Government Ministers and senior bureaucrats made the usual comforting noises.  Then #CensusFail happened.

Shortly after opening last night the Census website was taken down at 7.30 pm after four separate attacks.  #CensusFail

Given the hype about data security and privacy in the lead-up, we have to take the ABS’s word that it was indeed a cyber attack and not poor IT infrastructure that brought the system down.

This is hugely embarrassing to the ABS. Indeed as I write there is no guarantee the census will be successfully completed on time.  But taking a longer view the cyber attack does leave some big questions marks over the confidence the public can have in the ABS’s (and other Commonwealth Departments’) ability to safely deliver online services.  #CensusFail

Can the Commonwealth deliver online services in a secure way that will not compromise the safety of the public’s most intimate and confidential information?

As a cyber security provider to over 70 local governments around Australia, Infotrust has deep understanding of the cyber security environment faced by governments in Australia.  Based on that experience we’d recommend the ABS and the Commonwealth ask three big questions.

First, has the ABS attributed enough priority and resources to ensuring the security of their environment?

Second, has the ABS considered every eventuality of a Cyber Attack and undertaken penetration testing to test its ability to block and mitigate the impact of an attack?

Finally, what holistic security strategy has been implemented to cover off not only technical controls, but also process and staff training.

These are important questions. They must be addressed with urgency and serious intent. But they are not rocket science.

As is often the case with cyber security, getting the basics right takes you a very long way towards protecting your assets and reputation.