Cyber Storm: Understanding the Cybersecurity Landscape in NSW

In a world where cyber criminals are evolving faster than cyber security teams can implement defences, the NSW government must rise to the challenge. We’re now dealing with generative AI attacks, data poisoning breaches and alarming cases where cyber criminals are keeping cyber security teams up against the ropes. Where NSW is a state leading the way in digital services (think Service NSW’s front-door app and the digital driver’s license), is it also keeping up with the evolving cyber threat landscape in the same way? 

While there are fast-moving innovations coming to fruition in the field of cyber defence and resilience, could the challenges and threats be too many to overcome currently? Here we’ll explore the current trends and challenges in NSW and the opportunities for the state to combat this volatile cyber environment. Because this landscape is ever-changing, we can’t say that the government “has won the war” but we can discover if it is winning any battles, learn from them and take this knowledge into the future of cyber defence to better prepare teams and the public. 

The Current Cyber Threat Scene in NSW: 

• Cyber-fraud increased by 95% by June 2022 and identity crime increased by 35% - these were the most common cyber offences, accounting for 79% of all reports.
• 52 data breaches were reported by NSW government agencies, councils, and universities in the seven months to June 2024
• 44% of data breaches in universities in the same time period were due to cyber incidents, with three breaches impacting over 5000 people
• There was a 23% increase in reports of cybercrime in the 2022-23 financial year
• 79% of incidents between November 2023 and June 2024 in government agencies were caused by human error

Top 3 Challenges 

#1 - Economic Impact on Funding:   

• Cyber-attacks that occur not only nationally but internationally can have a debilitating effect on the state’s economy – take the Crowdstrike outage in July 2024 for example, that cost NSW businesses $200 million in damages. 
• Unfortunately, the state of NSW as a whole is in a serious deficit of 3.6 billion according to the Treasurer, increasing pressure on the future of cybersecurity growth and transformation. 

• Uncovered by an audit carried out by the Audit Office of NSW in 2024, a number of agencies in NSW lack the necessary funding to implement cybersecurity improvements and meet the demands of this evolving threat landscape – they may have plans, but no money to back them up.

#2 - Significant Gaps in Cyber Risk Management:   

• It’s clear there aren’t too many places to hide in the face of audits - that same 2022-23 audit found that 48% of agencies failed to effectively review and validate user access to IT systems among other shortcomings. 
• Has much changed? The Cyber Security in Local Government Audit carried out in March 2024 found that the selected councils (including Cyber Security NSW) exposed gaps like missing cybersecurity plans, outdated response processes, and weak third-party risk management, all of which threaten community services and infrastructure.

#3 - Shortage of Cybersecurity Professionals & Training:  

• The ACS Digital Pulse report revealed that Australians tech workforce grew by 60% since 2014 but the report also forecasts that 1.3 million tech workers will be needed by 2030 to meet industry needs. 
• By 2024, Australia had just 11,387 cybersecurity professionals in key positions, making up just 3% of the country's ICT workforce.  
• Established training pathways through universities and TAFEs are unlikely to deliver the required number of qualified graduates to meet the sector's needs due to high tuition costs, limited capacity, traditional institutions struggling to update curricula quickly enough to match the fast-evolving cybersecurity landscape and programs lacking specialised focus like threat intelligence and ethical hacking.

Encouraging Trends to Help Fortify the State 

Cyber-Focused Investment:  

Yes, we’ve established that due to the state deficit, future funding is unclear but has of today there are funds being poured into tech and processes to keep citizen information safe and secure:  

• The 2024/5 Budget for NSW has routed funds of $21.4 million into protecting personal information through the Digital Identity and Wallet. 
• An additional $62.5 million to replace legacy systems and move 80 more licenses to the new online License NSW system.
• $53.6 million to the Department of Customer Service to improve cybersecurity, as well as an established schedule of online meetings and webinars with the Office of Local Government.

Efforts to Close the Skills Gap:  

• The NSW Digital Skills & Workforce Compact functions to bring together the government, digital industry, and education sectors to overcome the expected shortage of 85,000 digital workers by 2030.
• The Cyber Security Industry Placement Program incentivises industry to provide work placements that complement cybersecurity training, addressing skills gaps between formal education and industry standards.
• Continuation of the NSW Cyber Ambassador Program to advocate for career pathways in the cyber sector.
• Adding hands-on industry experience to university and TAFE programs by encouraging internships, traineeships, and apprenticeships with businesses through the NSW Cyber Hub.

Email Security:  

• NSW has moved to full DMARC enforcement for government domains, increasing protection from 33% to 85% which has elevated the state to be leading in email security.

Cybersecurity “Uplifts”:  

• Multiple strategic initiatives focused on boosting the cybersecurity strength and readiness of government agencies and local councils.

Bigger Emphasis on Community Engagement:  

• The government is working to strengthen engagement with local councils and other stakeholders including the Cyber Portal which serves as a centralised platform for NSW Government entities, including local councils, to request information, guidance, assessments, and support from Cyber Security NSW.

Focus on Essential Eight:  

• The NSW Cyber Security Policy 2023-2024 requires agencies to put the Australian Cyber Security Centre's (ACSC) Essential Eight strategies in place to reduce cyber risks..
• Every NSW Government agency has to review their cybersecurity maturity each year using the ACSC's 'Essential 8' strategies. This helps pinpoint what needs improvement and guides their efforts to strengthen security.

Increased Focus on Safe AI & Machine Learning Integration:  

Recognised now more than ever for its supernatural ability to enhance threat detection and response capabilities, this government has put policies and frameworks in place to make sure citizens and public sector employees are safe from its many risks: 

• The NSW Government released an updated AI Assessment Framework to guide the responsible use of AI technologies and help agencies identify and mitigate risks associated with AI applications. 
• The Department of Customer Service issued Circular DCS-2024-04, mandating all NSW Government agencies to comply with the AI Ethics Policy and the AI Assessment Framework.

Collaboration to Increase Protection of Critical Infrastructure:  

• In August 2024, Google teamed up with Australia's national science agency, CSIRO, to create digital tools that can automatically spot and fix software bugs
• The Australian Government signed off with Amazon Web Services (AWS) for a $2 billion deal to build three data centers for securely sharing information with allied countries.

What the Future Holds for NSW: 

The future of the cybersecurity landscape in NSW is marked primarily by the unknown amount of funding from the State after 2025, but due to the heightened risk of cyber-attacks, and those attacks evolving rapidly, we should be hopeful at the very least that significant support to build NSW’s cyber capabilities will keep on coming – they have to. As of now, continued investment in cybersecurity uplifts, advanced technologies like AI and machine learning, and strategic partnerships with global leaders are efforts to push NSW into a stronger contender against cybercrime and to continue to build its resilience. In this case, NSW is well-positioned to tackle evolving cyber threats - but addressing the ever-present challenges such as lack of funding, workforce shortages and increasing the cyber maturity of local councils and smaller agencies clearly remains critical.  The key here for NSW to lead by example and create a secure and trustworthy digital environment is to uphold the foundation built on resilience, innovation, collaboration and powerful policy frameworks.