Details of a closed cyber security consultation conducted by the New South Wales (NSW) government have been revealed through a submission published by a research group at UNSW (University of New South Wales). The consultation, which took place in late 2022, involved the development of a vulnerability disclosure framework for the NSW government. However, the documents related to the consultation have not been made public by Cyber Security NSW.
According to the submission published by the UNSW Allens Hub for Technology, Law and Innovation, the consultation covered various aspects, including the provision of legal safe harbor for information security researchers, handling of reports falling outside the scope of “good faith research,” and response timeframes. The submission suggests that in order to define “good faith research” within the vulnerability disclosure policy, amendments may need to be made to the Crimes Act to explicitly authorize participation in a vulnerability disclosure program.
Additionally, the submission recommends that the draft framework should outline the process for checking, reviewing, assessing, auditing, and remediating vulnerability reports. The researchers suggest that reports should be shared with both the agency responsible for the vulnerable system and Cyber Security NSW to ensure a responsive approach. The submission also highlights the need to specify prohibited testing activities, with recommendations to exclude denial-of-service attacks, physical attacks, and attempts to modify or destroy data.
A spokesperson from the NSW Department of Customer Service confirmed that the consultation was closed and involved discussions with attendees of the Cyber Insights Series and other federal and state government entities. Cyber Security NSW is currently evaluating options for a standard entryway for vulnerability reports and assessing how a vulnerability disclosure framework can align with the new NSW Cyber Security Policy. The department is also awaiting the release of the 2023-2030 Australian Cyber Security Strategy to inform any requirements related to vulnerability disclosure programs before presenting policy options to the NSW Government for consideration.