Australia could become a leader in cybersecurity research

This article is part of our series on the Science and Research Priorities recently announced by the Federal Government. You can read the introduction to the series by Australia’s Chief Scientist, Ian Chubb, here.

Alex ZelinskyChief Defence Scientist, Defence Science and Technology

The national science and research priorities have been developed with the goal of maximising the national benefit from research expenditure, while strengthening our capacity to excel in science and technology.

Cybersecurity has been identified as a research priority due to Australia’s increasing dependence on cyberspace for national well-being and security. Cyberspace underpins both commercial and government business; it is globally accessible, has no national boundaries and is vulnerable to malicious exploitation by individuals, organised groups and state actors.

Cybersecurity requires application of research to anticipate vulnerabilities, strengthen cyber systems to ward off attacks, and enhance national capability to respond to, recover from, and continue to operate in the face of a cyber-attack.

Cyberspace is a complex, rapidly changing environment that is progressed and shaped by technology and by how the global community adopts, adapts and uses this technology. Success in cyberspace will depend upon our ability to “stay ahead of the curve”.

Research will support the development of new capability to strengthen the information and communications systems in our utilities, business and government agencies against attack or damage. Investment will deliver cybersecurity enhancements, infrastructure for prototype assessment and a technologically skilled workforce.

Accordingly, priority should be given to research that will lead to:

1. Highly secure and resilient communications and data acquisition, storage, retention and analysis for government, defence, business, transport systems, emergency and health services

2. Secure, trustworthy and fault-tolerant technologies for software applications, mobile devices, cloud computing and critical infrastructure

3. New technologies for detection and monitoring of vulnerabilities and intrusions in cyber infrastructure, and for managing recovery from failure.

Andrew GoldsmithDirector of the Centre for Crime Policy and Research, Flinders University

Sensible science and research on cybersecurity must be premised upon informed, rather than speculative, “what if”, analysis. Researchers should not be beholden to institutional self-interest from whichever sector: government; business; universities; or security/defence agencies.

We need to be clear about what the cybersecurity threat landscape looks like. It is a variable terrain. Terms such as “cyber-terrorism” tend to get used loosely and given meanings as diverse as the Stuxnet attack and the use of the internet by disenchanted converts to learn how to build a pipe bomb.

We need to ask and answer the question: who has the interest and the capability to attack us and why?

References to “warfare” can be misleading. A lot of what we face is not “war” but espionage, crime and political protest. More than two decades into the lifecycle of the internet, we have not yet had an electronic Pearl Harbour event.

Cybersecurity depends upon human and social factors, not just technical defences. We need to know our “enemies” as well as ourselves better, in addition to addressing technical vulnerabilities.

We should be sceptical about magic bullet solutions of any kind. Good defences and secure environments depend upon cooperation across units, a degree of decentralisation, and built-in redundancy.

Cybercrime is a growing problem, and it’ll take concerted efforts to prevent it escalating further.Brian Klug/Flickr, CC BY-NC

Jodi SteelDirector, Security Business Team at NICTA

Cybersecurity is an essential underpinning to success in our modern economies.

It’s a complex area and there are no magic bullet solutions: success requires a range of approaches. The national research priorities for cybersecurity highlight key areas of need and opportunity.

The technologies we depend on in cyberspace are often not worthy of our trust. Securing them appropriately is complex and often creates friction for users and processes. Creation of secure, trustworthy and fault-tolerant technologies – security by design – can remove or reduce security friction, improving overall security posture.

Australia has some key capabilities in this area, including cross-disciplinary efforts.

The ability to detect and monitor vulnerabilities and intrusions and to recover from failure is critical, yet industry reports indicate that the average time to detect malicious or criminal attack is around six months. New approaches are needed, including improved technological approaches as well as collaboration and information sharing.

Success in translating research outcomes to application – for local needs and for export – will be greater if we are also able to create an ecosystem of collaboration and information sharing, especially in the fast-moving cybersecurity landscape.

Vijay VaradharajanDirector, Advanced Cyber Security Research Centre at Macquarie University

Cyberspace is transforming the way we live and do business. Securing cyberspace from attacks has become a critical need in the 21st century to enable people, enterprises and governments to interact and conduct their business. Cybersecurity is a key enabling technology affecting every part of the information-based society and economy.

The key technological challenges in cybersecurity arise from increased security attacks and threat velocity, securing large scale distributed systems, especially “systems of systems”, large scale secure and trusted data driven decision making, secure ubiquitous computing and pervasive networking and global participation.

In particular, numerous challenges and opportunities exist in the emerging areas of cloud computing, Internet of Things and Big Data. New services and technologies of the future are emerging and likely to emerge in the future in the intersection of these areas. Security, privacy and trust are critical for these new technologies and services.

For Australia to be a leader, it is in these strategic areas of cybersecurity that it needs to invest in research and development leading to new secure, trusted and dependable technologies and services as well as building capacity and skills and thought leadership in cybersecurity of the future.

As more information is stored in the cloud, we need to be mindful of how to protect it from attack.FutUndBeidl/Flickr, CC BY

Craig ValliDirector of Security Research Institute at Edith Cowan University

ICT is in every supply chain or critical infrastructure we now run for our existence on the planet. The removal or sustained disruption of ICT as a result of lax cybersecurity is something we can no longer overlook or ignore.

The edge between cyberspace and our physical world is blurring with destructive attacks on physical infrastructure already occurring. The notion of the nation state, and its powers and its abilities to cope with these disruptions, are also significantly being challenged.

The ransacking of countries' intellectual property by cyber-enabled actors is continuing unabated, robbing us of our collective futures. These are some of the strong indicators that currently we are getting it largely wrong in addressing cybersecurity issues. We cannot persist in developing linear solutions to network/neural security issues presented to us by cyberspace. We need change.

The asymmetry of cyberspace allows a relatively small nation state to have significant advantage in cybersecurity, Israel being one strong example. Australia could be the next nation, but not without significant, serious, long-term, collaborative investments by government, industry, academy and community in growing the necessary human capital. This initiative is hopefully the epoch of that journey.

Liz SonenbergProfessor of Computing and Information Systems, and Pro Vice-Chancellor (Research Collaboration and Infrastructure) at University of Melbourne

There are more than two million actively trading businesses in Australia and more than 95% have fewer than 20 employees. Such businesses surely have no need for full-time cybersecurity workers, but all must have someone responsible to make decisions about which IT and security products and services to acquire.

At least historically, new technologies have been developed and deployed without sufficient attention to the security implications. So bad actors have found ways to exploit the resulting vulnerabilities.

More research into software design and development from a security perspective, and research into better tools for security alerts and detection is essential. But such techniques will never be perfect. Research is also needed into ways of better supporting human cyberanalysts – those who work with massive data flows to identify anomalies and intrusions.

New techniques are needed to enable the separation of relevant from irrelevant data about seemingly unconnected events, and to integrate perspectives from multiple experts. Improving technological assistance for humans requires a deep understanding of human cognition in the complex, mutable and ephemeral environment of cyberspace.

The cybersecurity research agenda is thus only partly a technical matter: disciplines such as decision sciences, organisational behaviour and international law all must play a part.

Sven RoggeProfessor of Physics and Program Manager at the Centre for Quantum Computation & Communication Technology at UNSW

Cybersecurity is essential for our future in a society that needs to safeguard information as much as possible for secure banking, safe transportation, and protected power grids.

Quantum information technology will transform data communication and processing. Here, quantum physics is exploited for new technologies to protect, transmit and process information. Classical cryptography relies on mathematically hard problems such as factoring which are so difficult to solve that classical computers can take decades. Quantum information technology allows for an alternative approach to this problem that will lead to a solution on a meaningful timescale, such as minutes in contrast to years. Quantum information technology allows for secure encoding and decoding governed by fundamental physics which is inherently unbreakable, not just hard to break.

Internationally, quantum information is taking off rapidly underlined by large government initiatives. At the same time there are commercial investments from companies such as Google, IBM, Microsoft and Lockheed Martin.

Due to long term strategic investments in leading academic groups Australia remains at the forefront globally and enjoys a national competitive advantage in quantum computing and cybersecurity. We should utilise the fact that Australia is a world leader and global player in quantum information science to provide many new high technology industries for its future.

Read more in our Science and Research Priorities series

The future of manufacturing in Australia is smart, agile and green

On the road: research can improve transport across Australia

Research priority: make Australia’s health system efficient, equitable and integrated

Alex Zelinsky is the Chief Defence Scientist of the Department of Defence; research within Defence Science and Technology is Government funded.

Andrew Goldsmith receives funding from the Australian Research Council.

Craig Valli is Research Director of the Australian Cyber Security Research Institute. He has received funding from NSST/PMC, European Union FP7 Program, NCRIS and various Australian agencies. Craig is a Fellow of the Australian Computer Society.

National ICT Australia is funded by the Australian Government as represented by the Australian Research Council and the Department of Communications through the ICT Centre of Excellence program.

Liz Sonenberg receives funding from the Australian Research Council and has conducted joint projects with DSTO scientists.

Sven Rogge receives funding from the Australian Research Council.

Vijay Varadharajan receives funding from Australian Research Council, NSST/PMC