Cyber Security
A Roadmap to enable growth opportunities for Australia

EXECUTIVE SUMMARY

2018

CSIRO FUTURES

CSIRO Futures is the strategic advisory arm of Australia’s national science agency.

www.csiro.au

 	 	 	

AUSTCYBER
The Australian Cyber Security Growth Network (AustCyber) is the industry‑led Cyber Security Growth Centre, one
of the centres under the Australian Government’s Industry Growth Centres Initiative. AustCyber is working with organisations across the economy
to ensure that Australia is a global industry leader, and is able to export cyber security solutions in the growing global marketplace while helping Australian organisations of all sizes and across all sectors to be more resilient  to the growing threat of malicious cyber activity.

CSIRO FUTURES
CSIRO Futures is the strategic advisory arm of Australia’s national science agency. We work with senior decision makers in Australia’s largest companies and government to help them translate science into strategy and plan for an uncertain future. We build on CSIRO’s deep research expertise to help our clients create sustainable growth and competitive advantage by harnessing science, technology and innovation.

DATA61
CSIRO’s Data61 is addressing the challenge of how to create Australia’s data‑driven future with science and technology, by partnering with industry, government and universities globally
to deliver economic, societal and environment outcomes. As Australia’s largest digital innovation network, Data61’s capabilities range from cyber security, confi  ential computing,
IoT, robotics, machine learning and analytics, software and programming to behavioural sciences and more.

CSIRO acknowledges the Traditional Owners of the lands that we live and work on across Australia and pays its respect to Elders past and present. CSIRO recognises that Aboriginal and Torres Strait Islander peoples have made, and will continue to make, extraordinary contributions to Australian life including in cultural, economic and scientifi  domains.

COPYRIGHT AND DISCLAIMER
© 2018 CSIRO. To the extent permitted by law, all rights are reserved and no part of this publication covered by copyright may be reproduced or copied in any form or by any means except with the written permission of CSIRO.

Foreword

Rapid global disruption and disintermediation is creating new industries and dramatically transforming old ones. As traditional boundaries collapse, Australia has a strategic national advantage in the critical cyber security space. Growing a strong and competitive Australian cyber security sector will not only underpin the future evolution of every Australian industry as it embraces digital opportunities, but forge a new economic pillar of its own. But our national advantage will only materialise through deep collaboration to fuel continued growth of the Australian economy – we need a common vision.
This Cyber Security Industry Roadmap brings together the expertise and networks of CSIRO and AustCyber, the Australian Cyber Security Growth Network, to recognise that common vision and map out the road to success for  our cyber security sector. We apply world-class scientific and technological expertise to steer business, government and society through the challenges we must navigate over the next 10 to 15 years, deflecting the threats and
seizing the opportunities presented. For example, Australians are already starting to benefit from an emerging industry focused on collection and use of genomic and health data, which is both improving the nation’s health and providing jobs and economic growth. As we integrate data and digital technologies into everything we do, its integrity and security will be key to our healthy future.
We have an opportunity to be a world leader in this field. We can build this industry with skills from our world-class education system, testbeds supported by our small but sophisticated market, and alignment with cultures and time zones in our geographic region. The concentration of some of the world’s brightest minds, in a thriving economy, working in shared languages and business hours through the Indo-Pacific is an incredible advantage.
As Australia responds to major global disruption, a strong local cyber security sector will not just enable our economy to grow and compete, but create an opportunity to excel on the world stage. It will take collaboration, coordination and commitment to deliver, and this Roadmap sets out the clear steps along the path to achieving this bold vision for Australia’s future prosperity.

At CSIRO, we are focused on the excellent science that drives breakthrough innovation, and gives our businesses and industries the edge in an increasingly
competitive global marketplace. Though the integration of our Data61 business unit across the depth and breadth of CSIRO, we’re creating Australia’s data-driven future and leading the digital change. We work closely with industry and the Australian Industry Growth Centres to align our science with your needs.

Larry Marshall
CSIRO Chief Executive

At AustCyber, we are working with organisations across the economy—public, private and research sectors alike—to ensure that Australia is a global industry leader, able to export cyber security solutions in the growing global marketplace while helping Australian organisations of all sizes and across all sectors to be more resilient to the growing threat of malicious cyber activity.

Michelle Price
AustCyber Chief Executive Officer

 	

3

Cyber security –
vital for future industry growth

Cyber security has never been more important, both as an enabler for Australian industry and as a source of economic growth itself.

Vision for Australia’s Cyber Security Sector
A globally competitive Australian cyber security sector that enables Australian organisations to pursue digitally driven growth, and supports greater trust and confidence to participate in the international economy.

Cyber
Security

Medical
Technologies and Pharmaceuticals

Mining
Equipment, Technology and Services

Advanced
Manufacturing

Oil
and Gas

Food and
Agribusiness

Cyber Security

At present, Australia’s cyber security sector is small; however, it is forecast to triple
its revenue over the coming decade due to increased demand for cyber security products and services.

As an enabler for industry, cyber security’s importance is being driven by the global business environment
becoming increasingly interconnected and reliant on data and digital technologies. As a result, organisations need to think of cyber security not just in terms of compliance and risk mitigation, but as an essential business function that is fully embedded in processes and systems.
And as a source of economic growth itself, Australia’s burgeoning cyber security industry has a unique opportunity to deliver services and solutions in a globally-competitive, export-facing industry.
This Roadmap primarily focuses on the first aspect:  the role cyber security (as a horizontal sector) can play in enabling growth opportunities in other sectors.
In particular, the report concentrates on the priority Australian sectors aligned with Australian Government’s Industry Growth Centres initiative.

$2.2 billion
2016 revenue
$6.0 billion
2026 revenue

10 year CAGR 10.6%
 	
19,500
2017 cyber security workforce
31,600
2026 cyber security workforce

The majority of Australian organisations currently lack the capacity to employ large internal cyber security teams which, in turn, creates demand for external, often international cyber services.
AustCyber’s Cyber Security Sector Competitiveness Plan –
a companion to this Roadmap – provides details about the cyber security industry and skills requirements that will allow the Australian sector to capture value from this increased demand.

Digital trends transforming industry
Digital transformation is providing numerous Australian industries with unparalleled opportunities for value creation.

These trends illustrate that digital technologies,
connectivity and automation are having a profound impact on the way organisations operate. These trends are not discrete, and exert an influence on an evolving cyber security threat landscape, with diverse and unanticipated cyber security risks now affecting businesses, governments, and people.

Each trend creates cyber security implications for Australia’s industries, and will create opportunities for Australia’s cyber security sector.

INCREASED DATA EXCHANGE
The volume of data generated and exchanged between equipment, people and businesses is leading to meaningful insights that support disruptive business models and technologies.

ENHANCED EXPERIENCES
Digital technologies are allowing people to have increasingly personalised and enhanced experiences, which is leading to changes in human expectations  and behaviours.

GLOBALLY CONNECTED
Global connection through the digital world is enabling trade, empowering people with access to information and novel products and services; and allowing seamless communication for improved social connections.

TRANSFORMED SUPPLY CHAINS
Digital technologies are transforming supply chains, creating greater transparency, increasing efficiencies and blurring traditional boundaries.

Trusted ecosystem
Creating digital ecosystems that  are highly trustworthy, allowing for rapid exchange of information and providing a stronger environment for trade.

Trusted partners
User-friendly and trusted sharing of information within supply chains, with third parties and with customers.
Threat intelligence sharing
Information about credible cyber security threats is shared within industry efficiently, allowing credible threats and risks to be quickly understood.
Collaborative demonstration projects Demonstration projects illustrate how a trusted ecosystem may be established to create commercial value within Australia’s priority growth sectors.
Resources and guidelines
Best-practice guidelines and tailored cyber security assessment resources are available, customised to Australia’s various industries and adaptable to the unique circumstances of businesses.
Onshore capability
The judicious procurement of locally developed cyber security solutions is encouraged where available, helping to maintain a critical mass of onshore
cyber capabilities.

Australia’s small but well-developed market provides an exemplary testing ground for pilot programs to then be rolled out in larger  economies.

Three themes have been developed via diverse industry consultation to understand how cyber security solutions can lead to more effective organisation and business operations, and improve Australia’s overall cyber security posture to take advantage of digital transformation.
Industry can engage immediately, in the short and medium terms in these themes, which are: (1) trusted ecosystem, (2) secure by design, and (3) robust and resilient. The themes cut across sectors, and discuss how Australia can embed cyber secure behaviour by building trust, improving design processes and raising overall cyber-resilience.
These themes build on the goals established by AustCyber to: (1) grow an Australian cyber security ecosystem,
(2) export Australia’s cyber security to the world and (3) make Australia the leading centre for cyber education.

As cyber security solutions move from being a post-development consideration to a design-phase consideration that is
tightly integrated with the industry vertical, time to market will improve, as will the reputation of the products and services being developed in Australia.

Secure by design

Ensuring new products, services,
platforms and processes are designed with cyber security as a key consideration.

Assurance of secure products
Guidelines establish a baseline for built-in cyber security in products and services that harmonises with international standards, allowing for improved exportability.
Secure by design skills in workplaces
Cyber security workplace skills are strong. Companies involved in the development and commercialisation of new technologies embed strong cyber security early in the design process.
Security embedded in ICT training
The gap between cyber security and ICT education is bridged by embedding more cyber security aspects into all tertiary information technology courses.
Research and industry collaboration Australia’s cyber security sector and the research community collaborate to help Australian industry underpin innovation with strong cyber security.
Secure trade and supply chains
Contractual negotiations and trade agreements clearly integrate cyber security measures in the development phase, leading to much greater security across
supply chains.

Robust and resilient

Building greater cyber maturity and
resilience in Australian industry and communities by developing a robust security culture.

Awareness in the community
Community awareness about the importance of cyber security is strong, supported by a targeted, high-profile education campaign.
Workforce skills
Awareness of cyber security basics in the context of workplaces is strong throughout all levels of staff, with companies adopting appropriate risk based practices.
Frameworks for cyber security
New frameworks and improved governance enables more innovation, while ensuring cyber resilience
is prioritised.

Strong leadership
Executive and Board level cyber security literacy and education initiatives are supported and well attended, leading to improved cyber security awareness within company leadership structures.
Australia’s reputation
Australia’s cyber security sector in collaboration with the priority sectors have built a national reputation for cyber security excellence across key cyber security pillars, leveraging strengths of the research  community.
Universal cyber care
Technology solutions focused on helping to raise the general cyber security hygiene of the Australian public and businesses have been investigated and developed.

Realising the themes requires change via collaborative action, with the Australian cyber community working closely with businesses, research institutes, governments, industry associations and the Industry Growth Centres. Presented over immediate to medium-term timeframes, each action is aligned to one or more of the themes.
Many of the immediate actions are already in process in cyber literate sectors such as finance and defence; however, further consideration is required in order for them to be implemented across broader Australian industry.

IMMEDIATE

Guidelines and frameworks

Improve guidelines for best practice cyber security hygiene

Threat    intelligence    sharing	Improve shared threat intelligence

Skills and training

Improve basic cyber security practices Improve cyber literacy in company leadership

Cyber security awareness

Develop business awareness and cyber resources

Build community	Celebrate home
awareness	grown cyber solutions

Collaboration with Australia’s growth industries

Establish demonstration projects

Improved    cyber-physical    systems	Develop solutions for areas of poor connectivity

For detailed information on actions, please see the full report.

Trusted ecosystem	Secure by design	Robust and resilient

MEDIUM TERM (3 – 5 YEARS)

SHORT TERM (1-3 YEARS)

Develop data sharing frameworks

Develop agile frameworks for technology adoption

Improve baseline device and platform security

Improve frameworks for international trade

Improve global threat intelligence sharing

Build ‘secure by design’ workforce skills

Embed cyber skills into general workforce development

Embed cyber skills into ICT workforce

Create active education experiences

Improve communication of secure by design features

Build solutions for Australia’s growth industries

Build Australian exports and global reputation

Transform business models

Ensure cyber security is considered in trade negotiations

Mitigate legacy systems risk Improve data collection

Establish trusted inter-site networks

To be truly effective, Australian industry and the cyber
community must tailor the enabling themes and actions to each industry’s specific opportunities for growth, such as the examples given in the diagram below.
By unpacking growth opportunities presented within the themes in this report, Australian industry and the cyber security sector can both work towards the development of competitive offerings for local and international markets.

For Australia to be globally competitive, cyber security must underpin the
data-driven transition of every sector in the economy.

Medical Technologies and Pharmaceuticals (MTP)

Opportunity for growth
Diagnostic products and services

Company value creation

Cyber security challenges

Novel business and service models
around the collection, interrogation, interpretation and packaging of medical and population data.

•
•
•
•

•

New business opportunities
Shortened R&D cycles Better patient insights
Precision products with higher demand/profit
Novel clinical trial models

Data sharing
Data privacy and ownership
Data integrity
Insider threats
Theft and extortion

Priority actions

Secure by design

1. Improve healthcare networks and infrastructure

Trusted ecosystem

2. Develop frameworks for improved clinical data sharing

Mining Equipment, Technology and Services (METS)

Opportunity for growth
Data driven mining decisions

Company value creation

Cyber security challenges

Using data throughout the mining
lifecycle to optimise mining operations, reduce timeframes for making high value decisions and optimise response to market demands.

Trusted insider access to data
New business model opportunities
Trusted engagement with mining companies

Operational technology (OT)
Connected equipment and sensors
Availability of data
Anomaly detection
Volatility of markets

Priority actions

Secure by design

1. Improve the security across connected mining environment

Trusted ecosystem

2. Improve the safe integration of legacy technologies and systems

Advanced manufacturing

Opportunity for growth
Customised high margin solutions

Company value creation

Cyber security challenges

Develop manufacturing services that
integrate suppliers and customers to provide customised products that can generate higher margins.

Customer willingness to pay	• Security confidence
Greater loyalty	•  Insider threats
Novel processes and products	• Supply chain integrity
Collection of more data	• Data integrity
Greater potential for range expansion	•  Data availability
Connected equipment

Priority actions

Trusted ecosystem

1. Improve channels for supply chain data sharing

Secure by design

2. Ensure secure integration of cyber-physical manufacturing systems

Oil and gas

Opportunity for growth	Company value creation	Cyber security challenges

Digital operations and maintenance

Transform operations and maintenance activities across onshore and offshore developments through integration and adoption of digital technologies.

Improved workforce safety
Improved productivity and cost efficiencies
Predictive maintenance eliminates down-time

Legacy assets
Control and availability of OT
Security of networks
Physical security
Data sharing
Intelligence sharing
Data integrity

Priority actions

Trusted    ecosystem	1. Improve national and global intelligence sharing

Robust   and   resilient	2. Implement active education programs

Food and agribusiness

Opportunity for growth	Company value creation	Cyber security challenges

Premium interactions

Export products that generate a premium price due to their quality and novel attributes, underpinned by the ability to provide accurate reporting on provenance.

Preserve premium prices
Reduced food fraud
Trust based competitive advantage
Potential for service and value-add

Digital maturity
Security of sensors
Data sharing
Availability and authentication of provenance data
Food supply chain security

Priority actions

Trusted    ecosystem	1. Build awareness of cyber solutions

Robust   and   resilient	2. Improve collaborative data sharing

Access the full report at www.csiro.au/futures
and www.austcyber.com

CONTACT US
t   1300 363 400
+61 3 9545 2176
e    csiroenquiries@csiro.au
w  www.csiro.au

WE DO THE EXTRAORDINARY EVERY DAY
We innovate for tomorrow and help improve today – for our customers, all Australians and the world.
Our innovations contribute billions of dollars to the Australian economy every year. As the largest patent holder in the nation, our vast wealth of intellectual property has led to more than 150 spin‑off companies.
With more than 5,000 experts and a burning desire to get things done, we are Australia’s catalyst for innovation.
WE IMAGINE
WE COLLABORATE WE INNOVATE

FOR FURTHER INFORMATION
James    Deverell Director, CSIRO Futures t    +61 2 9490 8456
e   futures@csiro.au
w   www.csiro.au/CSIROfutures
Michelle Price
Chief Executive Officer, AustCyber
t   +61 407 139 182
w   www.AustCyber.com

B&M | 18-0097