Home / Cybersecurity / How the ASD balances cyber security and offensive operations – Computerworld Australia

How the ASD balances cyber security and offensive operations – Computerworld Australia

Once a closely guarded secret, the role of the Australian Signals Directorate (ASD) in what the organisation’s director-general, Mike Burgess, describes as “offensive cyber operations” has been acknowledged by Canberra since 2016.

The “cyber” side of the organisation can be a balancing act, however: The ASD is tasked with helping protect Australia against online threats, but at the same time gather foreign intelligence and wage offensive operations against Australia’s adversaries.

Under Burgess’ leadership, the organisation has been undertaking the most significant transformation in its history, with a new level of independence since its July 2018 transformation into a statutory authority. As part of this new era, Burgess has had a more public role than former ASD leaders and the organisation has been more transparent about its operations.

Now, the ASD, which leads the Australian Cyber Security Centre (ACSC), has revealed details of how it balances the needs of its offensive operations with its efforts to keep networks safe. The organisation last week published an outline of the principles that apply to its decision-making about vulnerability disclosure.

The document says that for the ASD the “starting position is simple: when we find a weakness, we disclose it”.

“As part of our work, we sometimes discover security weaknesses or vulnerabilities in technology that are unknown to the vendor and may pose a threat to Australians and Australian systems,” the ASD said in an outline of its policy posted on its website last week.

“For many years, we have made these vulnerabilities known to vendors so they can patch or otherwise mitigate the threat to their systems and customers.”

However, the document adds, there “are occasions when a security weakness will present a novel opportunity to obtain foreign intelligence that will help protect Australians”.

“In these circumstances, the national interest might be better served by not disclosing the vulnerability,” it adds.


Source link

Check Also

Rep. Langevin Says Lack of Data 'Baselines' Hinders US Cybersecurity Efforts – MeriTalk

Rep. Jim Langevin, D-R.I., a co-chair of the House Cybersecurity Caucus and one of the …

Leave a Reply

Your email address will not be published. Required fields are marked *