The Australian Security of Critical Infrastructure (SOCI) Act 2018 was designed to safeguard Australia’s essential services and infrastructures from security risks, be it cyber or physical. While the focus often lies on external threats, one must not overlook the looming danger that comes from within— the ‘trusted insider.’
In particular, Part 2A of the SOCI Act (added by amendments in 2022) requires responsible entities for certain critical infrastructure assets to adopt and maintain a Risk Management Program to protect their critical assets. The program should foster a comprehensive understanding of the threat environment and create processes and procedures to respond effectively to material risks. This article aims to delve into why proportionate visibility into how trusted insiders handle sensitive data and systems, supported by specialised insider risk detection, is valuable for any organisation aiming to comply with Part 2A of the SOCI Act.
Why Insider Threats are Critical
When thinking of security threats to critical infrastructure, the mind naturally wanders to hackers and external agents. However, the ‘trusted insiders’—employees with privileged access—are often in an opportune position to disrupt systems and cause significant damage. Their intimate knowledge of organisational processes makes them uniquely capable of navigating security protocols, sometimes bypassing them altogether.
The Consequences of Inadvertent Actions by Trusted Insiders
It is essential to note that not all insider threats are malicious in nature. In fact, history has shown that inadvertent actions by trusted insiders have led to significant data breaches and compromises in critical infrastructure. Whether through accidental data leakage, improper disposal of sensitive information, or misconfiguration of security settings, the unintentional errors made by employees can have consequences just as severe as those stemming from deliberate actions. These incidents underscore the need for robust insider threat programs that are designed to catch not just malicious activities but also inadvertent errors. In this context, Insider Risk Management Platforms serve a dual purpose: they act as a deterrent for malicious insider activity and as a safety net to catch unintentional errors before they escalate into crises. Ignoring this facet of the insider threat landscape could mean failing to address a significant portion of the risk, a lapse that could have dire consequences for any critical infrastructure.
The SOCI Act Part 2A: Risk Management Program and the Role of Trusted Insiders
Part 2A of the SOCI Act is a pivotal component that mandates critical infrastructure entities to develop and adhere to a comprehensive Risk Management Program. While this section wisely encompasses a variety of risks, including cyber threats, natural disasters, and supply chain vulnerabilities, the rules made under it also require entities to address personnel hazards – the risk that critical workers, through negligence or malice, compromise a critical asset.
Trusted insiders, who often have privileged access to sensitive systems, data, and infrastructure, represent a unique and complex risk. These individuals are typically employees, contractors, or partners who have been vetted and are considered reliable. However, their privileged status provides them with the opportunity to cause disproportionate harm, either maliciously or inadvertently. Under Part 2A, entities need a well-defined scope and policy for managing the risks these insiders can create.
In practice, effective Risk Management Programs feature multi-faceted approaches that include assessing the suitability of critical workers, regular training on security protocols, and timely detection of risky activity. That detection should focus on potential indicators of insider risk, like unauthorised data access, sensitive data leaving the organisation, or irregular patterns in system usage – not on general job performance. This holistic understanding of the trusted insider risk enables entities to create countermeasures that are not just reactive but also proactive.
In a nutshell, Part 2A of the SOCI Act serves as a constructive guideline for organisations to recognise and act upon the complex threats posed by trusted insiders. By integrating rigorous insider threat protocols within their Risk Management Programs, organisations can more effectively identify, assess, and mitigate the risks associated with this particularly sensitive group. Doing so not only aligns with the compliance requirements of the Act but also significantly elevates the overall security posture of the critical infrastructure.
Proactive Detection: An Effective Way to Mitigate Risks
In support of Part 2A, adopting a proactive approach towards insider risk detection can be very effective. It is here that Insider Risk Management Platforms can add real value. These platforms provide timely visibility into how sensitive data moves and use analytics to identify unusual activity, such as data handling that departs from what is normal for a role.
For example, a platform might flag unauthorised access to sensitive data or sensitive files being sent to a personal email account. These are critical insights that can alert an organisation to potential threats before they escalate into full-blown crises. Not only does this reduce the risk, but it also serves to uplift the security culture within an organisation, making each member more aware of their role in maintaining a secure environment.
Legal and Ethical Considerations
Insider risk detection does raise questions about employee privacy. The SOCI Act’s focus on national security does not set aside privacy or workplace surveillance laws, so measures must be proportionate, lawful and transparent. Focusing on how sensitive data moves rather than on individuals’ every action, informing employees about what is reviewed and why, and remembering that most insider incidents are accidental can go a long way in alleviating privacy concerns.
In Summary
The Australian Security of Critical Infrastructure Act 2018, particularly Part 2A, serves as a critical blueprint for entities to manage their risk landscape effectively. A balanced approach that takes into account both external and internal threats is essential for compliance and for securing critical assets. Adopting proportionate insider risk detection for the data and systems ‘trusted insiders’ can reach should be considered a cornerstone for a secure, alert, and responsible organisation. By doing so, entities will not only be adhering to the mandates of the SOCI Act but will be setting a standard for what a comprehensive, nuanced approach to security risk management should look like. It’s time we recognise that safeguarding our future means looking within, as much as looking out.
CEO & Co-Founder, ShadowSight
Who is Christopher McNaughton
Chris is a proficient problem solver with a strategic aptitude for anticipating and addressing potential business issues, particularly in areas such as Insider Threat, Data Governance, Digital Forensics, Workplace Investigations, and Cyber Security. He thrives on turning intricate challenges into opportunities for increased efficiency, offering pragmatic solutions derived from a practical and realistic approach.
Starting his career as a law enforcement Detective, Chris transitioned to multinational organisations where he specialised and excelled in Cyber Security, proving his authority in the field. Even under demanding circumstances, his commitment to delivering exceptional results remains unwavering, underpinned by his extraordinary ability to understand both cyber and business problems swiftly, along with a deep emphasis on active listening.