KB [00:00:14]: The Australian government has announced new cybersecurity regulations that will require businesses to increase their investment in cybersecurity protection. Companies deemed as running infrastructure critical to the country's national interest, including those in energy, healthcare, water, food, transport and communication sectors will have to comply with the new risk management protocol. The cost of compliance for affected companies has been estimated to be almost 10 billion Australian dollars over the next decade. The new protocol will cover cybersecurity physical security, personnel security, and supply chain security. It aims to encourage companies to enhance their overall protection measures to get up to the required standard rather than punish company directors for failing to comply. I wanted to investigate more on this topic, so I've gone to my network to retrieve some much needed answers. Marty Edwards of Tenable responded. So please keep on listening. Marty Edwards [00:01:18]: What's happening in Australia is very similar to what's happening in a number of other countries around the world. We're very encouraged to see governments starting to put in place baseline cybersecurity standards of care. I believe for far too long, entities, whether they're private or public entities and organizations have been left to their own devices with regards to cybersecurity. So although there are some organizations that have made relatively great strides and are doing a fairly good job of cybersecurity, there's others that really need, I guess, a little bit more of a nudge from the government in order to make sure that all of our critical infrastructure is secure. From a cybersecurity standpoint, I think everybody understands in the corporate or enterprise world where we do phishing tests or social engineering tests or there's a fairly good tempo and pattern of behavior that's been established with regards to securing those environments. But often what gets forgotten about, quite frankly, really ignored from a security standpoint are these operational technology systems, the industrial control systems that are required to do things like operate our electricity grids or our gas pipelines, or our water supply and water treatment facilities, or even transportation like railways and things like that. These systems have been significantly underinvested in from a cybersecurity perspective. And so it's very encouraging to start to see governments put out requirements for these kinds of systems and yes, even consider penalties for companies or organizations. As I said, this is not just a public sector problem. This is public sector or private sector organizations. They need to be aware that boards of directors should be held liable if companies or organizations are not performing their due diligence in investing in the security of these organizations.