Government can strengthen security without rushing to replace proven systems

The Department of Home Affairs is right to demand urgent action on the cybersecurity risks within government technology environments.

Its new direction requires Commonwealth agencies to identify legacy technology, assess the risks it presents and develop plans to reduce those risks. Home Affairs has been unequivocal, warning that the continued operation of vulnerable legacy systems, combined with accumulated exploitable vulnerabilities, now poses an “unacceptable risk” to government.

The key point here, however, is vulnerability. There is a danger that the directive is interpreted too simplistically: legacy technology is old; old technology is insecure; therefore, old technology must be replaced. My concern is that would confuse modernisation with cybersecurity and obscure the real challenges.

The immediate lesson from recent events is not simply that government has old systems. Old technology did not create the problem. The problem is that weaknesses in technology environments can be discovered and exploited with increasing speed. Artificial intelligence makes that more urgent because it can accelerate the discovery and exploitation of vulnerabilities.

The first priority should be understanding where those vulnerabilities actually are.

Every agency should know what it is running, which systems are exposed, whether critical vulnerabilities are being addressed, who can access them and whether appropriate monitoring, segmentation and other security controls are in place. Home Affairs itself recognises this, calling for agencies to strengthen vulnerability and patch management across their entire technology estates.

Modern applications, SaaS and AI will not make these requirements disappear. If anything, they will amplify them. While modernisation can take years, we need to uplift our cybersecurity capabilities now. Only then should the conversation turn to what needs replacing, whether because of rationalisation, modernisation or simply its risk profile is too high.

Some existing systems undoubtedly should be retired or modernised, but wholesale replacement is neither practical nor necessarily the fastest way to reduce risk. Government operates large, complex technology estates containing systems that may take years and substantial investment to replace.

Government also needs to be wary: vendors also have an incentive to sell the next version of their technology. The end of a vendor support agreement may create a support challenge, but it does not automatically make the underlying software more vulnerable. That is a sourcing issue that can potentially be addressed through an alternative support strategy. Rather, the security question should remain: what is the actual risk posed by the system and how can it best be mitigated?

Unfortunately, cyber threats will not wait for those transformation programs to finish.

There is another danger. If an organisation with poor cybersecurity simply migrates to newer technology, it can take those weaknesses with it and introduce new integrations, identities, APIs and dependencies that need to be secured.

Modern does not automatically mean secure

Government needs a pragmatic, risk-based approach focused on accelerating time to security: identify the systems that genuinely represent an unacceptable risk and prioritise them for remediation or replacement; strengthen controls around systems that need to remain; and direct limited modernisation budgets towards the areas where they can deliver the greatest security and operational benefit.

The Home Affairs directive should be an opportunity to do more than compile an inventory of legacy technology. By March next year, agencies should understand not just what is old, but what is vulnerable, why it is vulnerable and what action will materially reduce that risk.

The direction requires both a stocktake and a legacy technology risk management plan, including targets for reducing legacy technology and mitigations for systems that must be sustained.

The distinction matters: the objective is not to make government technology newer; it is to make government more secure.

Image credit: iStock.com/solarseven