Australia announced Monday it is establishing a board to conduct independent reviews following major cyberattacks, joining a small number of other jurisdictions that have created similar programs. <\/p>\n
The Cyber Incident Review Board will carry out no-fault, post-incident reviews of significant cyberattacks on Australian government and industry, focusing on systemic lessons rather than individual or corporate culpability.\u00a0 <\/p>\n
Tony Burke, the Australian home affairs and cybersecurity minister, announced seven appointments to the board, which is majority female \u2014 a rarity in a field that skews heavily male at senior levels. <\/p>\n
It will be chaired by Narelle Devine, the global chief information security officer at Telstra. Other members are drawn from Boeing Australia, NBN Co, the University of New South Wales, law firm Allens, Toll Group and SA Power Networks. <\/p>\n
\u201cWe know that cyber attacks are constant. This guarantees we learn from every attack and keep increasing our resilience,\u201d Burke said. <\/p>\n
The board follows a series of high-profile cyberattacks in Australia in recent years \u2014 including those affecting health insurer Medibank<\/a> and telecommunications company Optus<\/a> \u2014 which put pressure on Canberra to strengthen the country’s cyber defences. <\/p>\n It is modeled on the Cyber Safety Review Board established by the Biden administration in 2022, though with a narrower membership drawn largely from critical infrastructure industries. <\/p>\n The U.S. board produced three reports before it was disbanded<\/a> by the Trump administration. At the time it was scrapped, the board had been in the middle of an investigation into Salt Typhoon, a sweeping Chinese intelligence operation targeting telecommunications networks. Several Democratic senators criticised<\/a> the administration\u2019s move and called for the board to be reinstated. <\/p>\n While a similar mechanism has also been set up in the European Union under its Cyber Solidarity Act \u2014 tasking the EU’s cybersecurity agency ENISA with conducting post-incident reviews of significant cross-border attacks \u2014 this review function has yet to be exercised. <\/p>\n The U.S. board\u2019s most consequential report accused<\/a> Microsoft of a cascade of avoidable errors that allowed Chinese state-linked hackers to access email accounts belonging to senior U.S. government officials and demanded \u201creal cultural and leadership changes\u201d at the company. <\/p>\n Following the release of that report, Microsoft chief executive Satya Nadella issued a company-wide directive declaring<\/a> that prioritizing security \u201cabove all else\u201d was critical to the company’s future. <\/p>\n The board\u2019s earlier reviews into the Log4j vulnerability<\/a> and the Lapsus$ hacker group<\/a> had less impact. Writing in Lawfare, Jeff Greene \u2014 a former Biden administration cyber official who helped establish the board \u2014 argued<\/a> that the initial reviews fell short by failing to focus on a specific incident attributable to a single company’s failures, limiting their ability to drive accountability. <\/p>\n Unlike its U.S. counterpart, which relied entirely on voluntary cooperation, Australia’s board can compel information from entities that decline to participate \u2014 something included in Greene\u2019s recommendations. The Australian government\u2019s plans do not follow other suggestions he made, such as the board being able to expand their composition for individual reviews requiring specialist knowledge. <\/p>\n Get more insights with the <\/p>\n Recorded Future<\/p>\n Intelligence Cloud.<\/p>\n