Australian Cyber Security Industry Roadmap – Executive Summary

Cyber security – vital for future industry growth

Cyber security has never been more important, both as an enabler for Australian industry and as a source of economic growth itself.

As an enabler for industry, cyber security’s importance is being driven by the global business environment becoming increasingly interconnected and reliant on data and digital technologies. As a result, organisations need to think of cyber security not just in terms of compliance and risk mitigation, but as an essential business function that is fully embedded in processes and systems.

And as a source of economic growth itself, Australia’s burgeoning cyber security industry has a unique opportunity to deliver services and solutions in a globally-competitive, export-facing industry.

This Roadmap primarily focuses on the first aspect: the role cyber security (as a horizontal sector) can play in enabling growth opportunities in other sectors. In particular, the report concentrates on the priority Australian sectors aligned with Australian Government’s Industry Growth Centres initiative.

 

At present, Australia’s cyber security sector is small; however, it is forecast to triple its revenue over the coming decade due to increased demand for cyber security products and services.

The majority of Australian organisations currently lack the capacity to employ large internal cyber security teams which, in turn, creates demand for external, often international cyber services.

AustCyber’s Cyber Security Sector Competitiveness Plan – a companion to this Roadmap – provides details about the cyber security industry and skills requirements that will allow the Australian sector to capture value from this increased demand.

Digital trends transforming industry

Digital transformation is providing numerous Australian industries with unparalleled opportunities for value creation.

These trends illustrate that digital technologies, connectivity and automation are having a profound impact on the way organisations operate. These trends are not discrete, and exert an influence on an evolving cyber security threat landscape, with diverse and unanticipated cyber security risks now affecting businesses, governments, and people.

Each trend creates cyber security implications for Australia’s industries, and will create opportunities for Australia’s cyber security sector.

Delivering a cyber secure future

Australia’s small but well-developed market provides an exemplary testing ground for pilot programs to then be rolled out in larger economies.

Three themes have been developed via diverse industry consultation to understand how cyber security solutions can lead to more effective organisation and business operations, and improve Australia’s overall cyber security posture to take advantage of digital transformation. Industry can engage immediately, in the short and medium terms in these themes, which are: (1) trusted ecosystem, (2) secure by design, and (3) robust and resilient. The themes cut across sectors, and discuss how Australia can embed cyber secure behaviour by building trust, improving design processes and raising overall cyber-resilience.

These themes build on the goals established by AustCyber to: (1) grow an Australian cyber security ecosystem, (2) export Australia’s cyber security to the world and (3) make Australia the leading centre for cyber education.

As cyber security solutions move from being a post-development consideration to a design-phase consideration that is tightly integrated with the industry vertical, time to market will improve, as will the reputation of the products and services being developed in Australia.

Actions for cyber secure growth

Realising the themes requires change via collaborative action, with the Australian cyber community working closely with businesses, research institutes, governments, industry associations and the Industry Growth Centres. Presented over immediate to medium-term timeframes, each action is aligned to one or more of the themes. Many of the immediate actions are already in process in cyber literate sectors such as finance and defence; however, further consideration is required in order for them to be implemented across broader Australian industry.

Trusted economy

Secure by design

Robust and resilient

	Immediate	Short Term (1-3 years)	Medium Term (3 – 5 years)
Guidelines and frameworks	Improve guidelines for best practice cyber security hygiene	Develop data sharing frameworks Improve baseline device and platform security	Develop agile frameworks for technology adoption Improve frameworks for international trade
Threat intelligence sharing	Improve shared threat intelligence		Improve global threat intelligence sharing
Skills and training	Improve basic cyber security practices Improve cyber literacy in company leadership	Build ‘secure by design’ workforce skills Embed cyber skills into ICT workforce	Embed cyber skills into general workforce development Create active education experiences
Cyber security awareness	Develop business awareness and cyber resources Build community Celebrate home awareness grown cyber solutions	Improve communication of secure by design features Ongoing
Collaboration with Australia's growth industries	Establish demonstration projects	Build solutions for Australia’s growth industries Transform business models	Build Australian exports and global reputation Ensure cyber security is considered in trade negotiations
Improved cyber-physical systems	Develop solutions for areas of poor connectivity	Mitigate legacy systems risk Improve data collection	Establish trusted inter-site networks

For detailed information on actions, please see chapter 3 of the PDF.

Cyber security for Australian industry

To be truly effective, Australian industry and the cyber community must tailor the enabling themes and actions to each industry’s specific opportunities for growth, such as the examples given in the diagram below.

By unpacking growth opportunities presented within the themes in this report, Australian industry and the cyber security sector can both work towards the development of competitive offerings for local and international markets.

For Australia to be globally competitive, cyber security must underpin the data-driven transition of every sector in the economy.

Medical Technologies and Pharmaceuticals (MTP)
Opportunity for growth	Company value creation	Cyber security challenges
Diagnostic products and services Novel business and service models around the collection, interrogation, interpretation and packaging of medical and population data.	New business opportunities Shortened R&D cycles Better patient insights Precision products with higher demand/profit Novel clinical trial models	Data sharing Data privacy and ownership Data integrity Insider threats Theft and extortion
Priority actions
Secure by design Trusted ecosystem	Improve healthcare networks and infrastructure Develop frameworks for improved clinical data sharing

Mining Equipment, Technology and Services (METS)
Opportunity for growth	Company value creation	Cyber security challenges
Data driven mining decisions Using data throughout the mining lifecycle to optimise mining operations, reduce timeframes for making high value decisions and optimise response to market demands.	Trusted insider access to data New business model opportunities Trusted engagement with mining companies	Operational technology (OT) Connected equipment and sensors Availability of data Anomaly detection Volatility of markets
Priority actions
Secure by design Trusted ecosystem	Improve the security across connected mining environment Improve the safe integration of legacy technologies and systems

Advanced manufacturing
Opportunity for growth	Company value creation	Cyber security challenges
Customised high margin solutions Develop manufacturing services that integrate suppliers and customers to provide customised products that can generate higher margins.	Customer willingness to pay Greater loyalty Novel processes and products Collection of more data Greater potential for range expansion	Security confidence Insider threats Supply chain integrity Data integrity Data availability Connected equipment
Priority actions
Secure by design Trusted ecosystem	Improve channels for supply chain data sharing Ensure secure integration of cyber-physical manufacturing systems

Oil and gas
Opportunity for growth	Company value creation	Cyber security challenges
Digital operations and maintenance Transform operations and maintenance activities across onshore and offshore developments through integration and adoption of digital technologies.	Improved workforce safety Improved productivity and cost efficiencies Predictive maintenance eliminates down-time	Legacy assets Control and availability of OT Security of networks Physical security Data sharing Intelligence sharing Data integrity
Priority actions
Secure by design Robust and resilient	Improve national and global intelligence sharing Implement active education programs

Food and agribusiness
Opportunity for growth	Company value creation	Cyber security challenges
Premium interactions Export products that generate a premium price due to their quality and novel attributes, underpinned by the ability to provide accurate reporting on provenance.	Preserve premium prices Reduced food fraud Trust based competitive advantage Potential for service and value-add	Digital maturity Security of sensors Data sharing Availability and authentication of provenance data Food supply chain security
Priority actions
Secure by design Robust and resilient	Build awareness of cyber solutions Improve collaborative data sharing