'Stop calling it cybersecurity' – it's safety, inquiry told

Reframing cybersecurity as critical safety work aimed at protecting "people, systems, and data" would help make the topic more attractive to Australian businesses and organisations, a parliamentary inquiry has heard.

The comments were made on Monday during a virtual hearing of the inquiry into cybersecurity for small-to-medium enterprises (SMEs), which has been running since June.

Jakub Zverina, the technical program lead of CyberPath – a government-supported pilot for cybersecurity professionalisation – appeared before the inquiry representing the Australian Computer Society (ACS), which leads the consortium of organisations behind the scheme.

"The best thing we can do to improve cybersecurity is to stop calling it cybersecurity," said Zverina, who admitted this "might be a controversial statement".

"The framing that I use is safety," he said.

"... Because, as the other submissions have said, [cybersecurity] is not sexy, it doesn't sell – nobody wants to go out and buy cybersecurity.

"We're actually looking at the safety of people, systems, and data."

Zverina suggested framing cybersecurity "around safety, treating it as enterprise risk, an existential sort of business continuity crisis" is a better "starting point".

"There's also quite a bit of disservice done when we start calling things 'technical'," he said.

"It's just as important to consider those non-technical aspects of cyber.

"... Who does that work? How do we train those people? What does that learning pathway look like?"

CyberPath seeks to create clearer career pathways in cybersecurity, and to define professional standards for cybersecurity workers and organisations across Australia.

The program is co-funded by the Department of Home Affairs and driven by an ACS-led consortium which also includes the Australian Information Security Association (AISA) and the Australian Cyber Collaboration Centre (Aus3C).

Community-owned professionalisation 'critical'

Developing a "community-owned, decentralised model" for the professionalisation of Australia's cybersecurity workforce is "critical" to protecting the nation's online safety, Zverina suggested.

Asked whether the federal government should provide SMEs with a list of approved cybersecurity providers, he said while it is important for government to have "a seat at the table", it is also important that it is "not owning the entire solution outright".

"Given the diversity of businesses, organisations, government, the only way that really makes sense is to have a decentralised model – an independent body that can actually establish, maintain, and own what the standards look like and what that guidance looks like," Zverina told the inquiry.

"That's critical because it's an operational consideration of who's going to maintain it? Who has the authority to actually prescribe standards? Is it respectful and representative of the diversity of the industry and the ecosystem?"

_{CyberPath's Jakub Zverina (left) with Australian Cyber Collaboration Centre marketing and program manager Nguyen Biszak (right). Image: CyberPath}

Appearing alongside Zverina for a panel discussion on the IT sector was Elizabeth Whitelock, CEO of the Australian Information Industry Association (AIIA), which advocates for Australia's digital ecosystem and is not a member of the CyberPath consortium.

She suggested that while an approved list of cybersecurity providers would be "a good thing to have" for SMEs, they also require practical tools.

"I think more information is all well and good, but at the moment they're already drowning," she said.

"... We can't just keep feeding them information, we have to start to turn it around and make it far more practical – or, [make sure] the pipes that they build their business on are secure."

To regulate, or not to regulate?

Asked whether major companies at the top of technology supply chains should face greater regulation to make sure their cybersecurity gaps do not negatively impact SMEs using their products at the bottom of the stack, Whitelock said she believes "there is a place for regulation".

"SMEs are going to be in that cascading downflow if anything happens at the top level," she said.

"So therefore, yes, there probably should be more control, more demands, requirements placed on the larger end of town, to ensure that the flow down effect to the SMEs is minimised."

Zverina said "a lot of legislative instruments already exist" to make sure large IT providers protect cybersecurity, including the Security of Critical Infrastructure (SOCI) Act and the Corporations Act.

He said multinational organisations are operating under regulations from multiple jurisdictions, and suggested "we don't want to make it harder".

"The challenge that I have around a lot of those compliance obligations is they're very focused on processes and technical controls," he said.

"Some of them do go as far as making sure that certain roles and responsibilities are defined, but there's nothing within a lot of those compliance frameworks which actually help tell the story of, 'Can the people doing the work actually do their job?'

"And what's the quality outcome? How do we know that that quality outcome is being achieved?

"That's where I see the gap – that's what we're trying to solve for with CyberPath."

ACS CEO Dr Prins Ralston said SMEs "often lack a clear, consistent way to assess capability" of cybersecurity providers.

“We are calling for a common standard, rather than a new licensing requirement, to help businesses compare providers, understand the services being offered and make informed decisions about who they trust," he said in a statement.

ACS recently encouraged employers and cybersecurity practitioners to sign up to test its CyberPath framework, which is expected to enter its pilot phase in February 2027.

The parliamentary inquiry into SME cybersecurity is expected to table its final report by 31 March.

ACS is the publisher of Information Age.