Foreign interference crackdown on tech used by government agencies

The Albanese government is scrutinising public servants’ use of major technology services under a broader crackdown on foreign interference.

Palo Alto Networks’ government affairs and public policy lead Sarah Sloan.

The Albanese government is targeting public servants’ use of major technology services and social media as part of a broader foreign interference crackdown.

The nation’s 189 government entities will have their technology stacks scrutinised, with new requirements forcing them to report to the Australian Signals Directorate on examples of foreign ownership, control and interference.

The new standards, issued by the Home Affairs Department last weekend, follow similar actions in the US where the government recently turned a spotlight on technology vendors who had been compromised in hacks.

The decision was welcomed by industry experts including Sarah Sloan, government lead at Palo Alto Networks, who said she expected many government entities would find staff using uncleared or unapproved software.

Unapproved software, known as shadow IT, has been rampant since the pandemic, when millions of employees were forced to work from home. Some employees have taken to using external platforms not approved by their employers to help with work.

“That directive we see as particularly important because it does help organisations understand their internet-facing assets and particular applications, programs and services that they have operating in their environment that they may not be aware of,” Ms Sloan told The Australian.

As more people switched to remote work, uncleared software and applications were rising beyond the knowledge of companies’ cyber security teams, she said.

“If they’re not aware they exist, then they’re not patching or maintaining those particular applications, which means they can provide this back door for our cyber adversaries to gain access to systems,” Ms Sloan said.

Government entities will face significant costs to fully take stock of technologies they use.

“In our experience of working with organisations globally, we … find they’re aware of maybe half of the things we find when we conduct our attack surface management service,” Ms Sloan said,