Learn from the Pros

To appreciate how security will infiltrate every part of business, consider how security services operate. ASIO is Australia's premier national security agency. One of its prime roles is protecting what is known as Australia's National Information Infrastructure (NII) - that set of information networks essential for our society to function. It comprises the telecommunications and information networks that support the nation's banking, finance, transport, distribution, energy and water, and critical government functions such as defence and emergency services. As our society becomes increasingly interconnected, the vulnerability of the NII to attacks from hackers, criminals, terrorists or hostile foreign powers increases.

ASIO says international relationships have become more fluid and spying remains widespread. Australia has information and technology that other countries could use to their advantage. Agents of foreign governments are posted here to collect such intelligence. Some carry shopping lists of scientific and technical knowledge their governments want. One of ASIO's priorities is to monitor the interests and activities of these agents.

Risk is a key concept in such planning. ASIO uses a risk management model to assess and manage levels of risk to national security. Quantifying the risk involves examining the harm that might be done, for example, by operatives of a foreign government's intelligence service and comparing this with the level of threat. By considering the harm (How bad would it be?) against the actual threat (How likely is it to happen?), ASIO calculates an assessment of the level of risk.

The ASIO model for assessing risk has wide application and other government agencies have begun using it to determine their own risk levels and security needs. The intention is to help security personnel understand the distinction between risky management and risk management.

And so it is in business. Those who have been employed for years to manage risk know the ASIO approach. They say it is a strategy that will become common among Australia's public and private organisations since they are all in some way attached to the NII or have their own interconnected infrastructures to protect.

The Shadow Minister for Information Technology, Senator Kate Lundy, continuously pursues the federal government with claims that it does not do enough to protect Australia's NII. She says that in the wake of the increased terrorist threat posed to Australia the government cannot afford to trail international standards on e-security by investing such small amounts.

According to Leif Gamertsfelder, the leader of the e-security group at law firm Deacons, Canberra spends 32 cents for every man, woman and child on e-security, compared to the US government's outlay of $28 per head.