Australian Cyber Resilience in a High Threat World Learning from Estonia

 

Greetings from Australian Computer Society's TechUplift 2025. At the Hyatt Hotel Canberra. Next to me is the first speaker, Ms Kersti Eesmaa, former Estonian ambassador. She is now working for Vertical Scope Group, a Canberra security company. I first met Kersti, as the ambassador in 2021, speaking on digital Estonia. As she pointed out today, by building a new nation based on digital technology they were able to create efficiency, but create a target for attack by nation states. 

Over the last few years, Australian National University hosted a series of talks by small european states under threat, or in the case of Ukraine under direct attack. This may not seem relevant to Australia, but out online systems are under constant online attack. Ms Eesmaa described Estonia's industry security vetting system, which allows staff from those companies to more easily assist the government when needed. This is something perhaps Australia should adopt. Another suggestion was exercises with industry involvement. As a defence civilian employee I have been involved in defence exercises, but while these included personnel from allied countries, the only industry involved were contracted companies providing services. The ACS has run some hackathons for the Australian and NZ defence forces, and ANU has run simulations for students with support of security agencies (I mentored teams). This format could be used to include industry at low cost. 

A more radical proposal was Capture the Flag (CTF) competitions for school children, funding by industry and the Department of Defence. In these students learn about cyber defence in a fun way. The Australian Signals Directorate and the Australian National university have run CTF Competitions for school students. I asked the next speaker from ASD about expanding this to industry. Bsides do some of this but could do with government suupport.