A submission published by a UNSW research group has revealed details of a closed NSW government cyber security consultation. The consultation was launched late in 2022 and accompanied by a draft framework for the operation of a mooted NSW government vulnerability disclosure framework.
Cyber Security NSW has not made the consultation documents public. According to the submission, the consultation covers how infosec researchers could be given legal safe harbour; how NSW should handle reports that fall outside the definition of “good faith research”; and response timeframes.
The submission also suggests that any vulnerability reporting system implemented by the NSW government should pass reports both to the agency whose system had the vulnerability, and Cyber Security NSW (in case the agency is unresponsive). The researchers also suggest that denial-of-service attacks, physical attacks, and attempts to modify or destroy data should be excluded from the list of tests if the policy were put into place.
A spokesperson from the NSW Department of Customer Service confirmed that it’s a closed consultation. Cyber Security NSW is examining possibilities for a common report entry point and how a vulnerability disclosure framework could support the new NSW Cyber Security Policy. Cyber Security NSW is also waiting for the release of the Australian Cyber Security Strategy 2023-2030 to identify any needs for vulnerability disclosure programmes before presenting policy ideas to the NSW Government for consideration.
