The extended timeframe associated with being listed on the CCSL;

Transcription

1 13 October 2017 The Hon. Angus Taylor, MP Assistant Minister for Cities and Digital Transformation Parliament House CANBERRA ACT Dear Assistant Minister Certified Cloud Services List (CCSL) Firstly, congratulations again from the Australian Information Industry Association (AIIA) for your leadership progressing the digitisation of government agenda. AIIA strongly supports the changes you have made to the Digital Transformation Agency this year and the momentum for reform you are driving through the Agency. However, the purpose of this letter, is to bring to your attention industry concerns regarding the current process for Certification of Cloud Services by the Australian Signals Directorate (ASD). As you are aware, this is not a new issue and to date not an issue that is being resolved in any substantive way. Current arrangements are both stifling progress on the digital transformation of government and undermining the ability to have a competitive cloud service market that services government in Australia. While a small number of additional certified cloud service providers have been listed in the past 12 months, only eight companies are certified to be on the CCSL. Based on feedback of some of those eight that are AIIA members, the process is fundamentally flawed. They are questioning the outcomes and value to government and industry generally of the process as it stands. Many of our members remain uncertified despite having made significant investments. By comparison, the UK Government have certified the security of almost 1000 cloud service providers through a modernised scheme. I preface our detailed comments with assurance that AIIA is not proposing changes that compromise the integrity of the IRAP process. Our concerns relate specifically to the complex, opaque and expensive processes imposed by ASD. A more timely, transparent and consistent framework is urgently needed and AIIA believes this is achievable with some pragmatic changes to current arrangements. AIIA has three key areas of concern: The extended timeframe associated with being listed on the CCSL; The lack of transparency in the process of reviewing IRAP assessment reports and the discrepancy between the requirements of certification and the practice of ASD; and The cost of the process, particularly for multiple products, which often already satisfy a range of global certification processes. Time It is important to distinguish between IRAP assessment as an established process and the process ASD undertakes from review of an IRAP assessment to listing on the CCSL. The IRAP assessment is a thorough and proven process that is considered by government and industry to have high value and integrity. AIIA members advise that assessment typically takes between 3 to 6 months depending on the complexity of the service, the number of services 1 of 5 13 October 2017

2 to be assessed and any deficiencies or significant findings of the assessor. These assessments are undertaken by one of the 120 assessors endorsed by ASD to have a high level of expertise and experience and is supported by a strong governance and endorsement process, oversighted by ASD that ensures the quality of IRAP assessor credentials. The IRAP assessment process is comprehensive, covering detailed technical reviews, documentation reviews, technical configuration analysis, interviews and if deemed necessary, technical and penetration testing. The rigour of this process provides assurance both to industry providers and to government. Once the assessment is complete, our members submit the resulting Assessment Report and Recommendation for Certification to ASD. It is at this point that the process breaks down. According to AIIA members, it takes many months, often more than 12 months and in some instances up to two years to conclude the certification process. During this time, our members report minimal interaction with ASD. When following up progress members report being advised that their assessment is in a queue of some 80 others and that they simply must wait with no indication of timeframes. Inquiries from government agencies to ASD on the progress of cloud vendors seeking certification receive similar responses. This is now a persistent issue. In the meantime, vendors are effectively barred from pursuing a range of business opportunities. Although our members report a small number of government agencies engaging in their own compliance review and risk assessment processes to overcome the blockers imposed by ASD, those agencies are few and far between. Members report that many agencies will not engage with vendors regarding digital transformation opportunities until their services are certified by ASD. Further, in 2016, ASD introduced a new requirement into the Information Security Manual effectively prohibiting a government department from using cloud services that have not been certified by ASD (see control 1395: Agencies must only use outsourced cloud services listed on ASD s Certified Cloud Services List(CCSL) ). By comparison, both the UK and New Zealand adopted more modern assurance processes that achieve equivalent outcomes in less than 1 month, unblocking and indeed driving their rapid progress in digital transformation. Transparency and Inconsistency with Policy Transparency of the ASD process is very poor. As far as AIIA is aware there is no documented or published process for how an assessment progresses through certification. Vendors are not advised of progress and experience long periods where ASD is unresponsive to their enquiries. Our members report that IRAP Assessors frequently work extensively with our members for weeks and months to validate and enhance security controls to a level that the IRAP assessor considers to be effective, only for their recommendations to be dismissed by ASD without clear reasoning or explanation. Alternatively, ASD simply respond that the security control implementation is not consistent with ASD s (subjective) requirement. This is exacerbated by the fact that there is no opportunity for challenge or review. We would question in fact whether ASD is following their own process and requirements as outlined in the Information Security Manual (ISM) and further still, their consistency with the guidance of the Protective Security Policy Framework (PSPF). The ISM clearly articulates the process of Certification as: The aim of certification is to ensure the security assessment or audit for a system was conducted in an appropriate manner and to a sufficiently high standard. The outcome of certification is a certification report to the accreditation authority outlining the security Page 2 of 5 13 October 2017

3 measures that have been implemented for a system and the residual risk it poses to the system and the information that it processes, stores or communicates 1. In addition, the ISM states: To award certification for a system the certification authority needs to be satisfied that the security measures identified by the system owner have been implemented and are operating effectively. However, certification only acknowledges that the identified security measures were implemented and are operating effectively and not that the residual security risk is acceptable or an approval to operate has been awarded. The ISM is very clear in the distinction between Certification and Accreditation, with Accreditation being a clear responsibility of the relevant government department, not ASD: Certification (described in the Conducting Certifications section of this chapter) provides the accreditation authority with information on the security posture of a system. This allows the accreditation authority to make an informed decision on whether the residual security risk of allowing the system to operate is acceptable. This is further underscored in the Protective Security Policy which outlines how a government department must own the risk management decisions and policy for their department. Interpreting the above, our view is that the ASD process is going beyond certification to perform a pseudo-accreditation function. AIIA members report that ASD is withholding certification based on a perceived risk of non-compliance or uncertainty in the effectiveness of security controls to address unspecified risks. These are, however accreditation activities. Normally a certification process confirms the integrity of an assessment and may identify areas of risk to be considered. By withholding certification ASD is effectively denying government agencies the opportunity to perform their own risk assessment and accreditation decisions (in accordance with the PSPF). Members have gone through extensive processes of assessment with IRAP assessors and are prepared to work with agencies on their specific risk requirements. Risk mitigation and acceptance must be done by agencies in context, i.e., at the point where residual risk can be controlled/managed. ASD current practice effectively abrogates agencies from ultimate risk decisions and denies them the opportunity to take carefully managed risks. Cost AIIA accepts there is a cost associated with the certification process. This is an investment vendors make to do business with Government. These costs are variable but our members report that the indicative cost of an IRAP assessment is $50,000 to $100,000 per product (with many vendors having multiple products to be assessed). While this process can produce valuable outcomes, and inform the decisions and risk management plans of government agencies, the challenge is that it does not assure the outcome of the certification process. Even after a successful assessment and recommendation by highly reputable assessors, the next phase of the certification process by ASD takes between 12 to 24 months - with little transparency or accountability in terms of timeframes and responsiveness to vendors. The IRAP assessment is a significant upfront investment for any business and arguably prohibitive for small and medium sized businesses (SMEs). Because this expense is incurred irrespective of whether certification is granted, it is especially high risk for SMEs. 1 Information Security Manual 2016, Page 48 Page 3 of 5 13 October 2017

4 As well as IRAP assessor costs, there is heavy internal investment in assessment and certification preparations. These assessor costs are repeated every two years, when a product or service requires re-certification. Typical investment by several of our members is, at a minimum, around $200,000 to $300,000 every two years. Several members reported costs an order of magnitude higher. It is important to note that in most cases, these processes result in minimal or no change in the security posture of the assessed cloud services. Consequences The consequences of these issues are threefold. There is no effective competitive cloud product and services market in support of the Federal Government cloud agenda. Other state governments in Australia, as well as peer governments in the UK and New Zealand have successfully modernised their security assurance processes to build this competitive market. The absence of such a market results in higher costs for government and reduced access to innovation. Despite a desire by Government to be agile to develop and deliver digital solutions, the barriers imposed by ASD make progress complex, expensive and slow. Our members invest in their security and value the IRAP assessment process, but are discouraged from innovating and investing with Australian government as a direct result of ASD s CCSL listing process. In comparison the UK and New Zealand governments recognise they do not have the technical security expertise and resources to perform in the manner ASD has assumed. Instead, they focus their limited cybersecurity resources on higher order security threats, education and partnership with industry on outcomes. Given the costs and time involved, there is a real risk that some vendors may limit their involvement in or withdraw completely from the Federal cloud market. Action Required As noted, it is not the intention to suggest any diminution of the integrity of the IRAP program. The work of the 120+ Australian endorsed IRAP assessors is highly valued by our members and government. AIIA believes a workable solution can be achieved very rapidly by adopting a relatively simple framework comprised of three elements. A well-defined, transparent process which follows a clear progression path and is consistent with prescribed government policy. We recommend that ASD sustain the integrity of the program for endorsing IRAP assessors. Once an IRAP assessment report is submitted to ASD along with an IRAP assessor s recommendation, it should be listed publicly as having been assessed along with the letter of recommendation from the assessor within 2 weeks. ASD should be advised to adhere to a certification process that is consistent with the ISM and PSPF. Notably this process should validate the integrity of the assessment report and describe risks as appropriate. Explicitly, it must not be a pseudoaccreditation process, as is currently the case. ASD should have no more than 4 weeks to describe deficiencies in the integrity of the assessment process and any notable risks. Engagement of the Digital Transformation Office (DTA) to take a more active role in educating agencies to understand and make appropriate risk decisions by leveraging the certification and other inputs. The CCSL process has degraded agencies abilities to understand and manage risk. This needs to be restored. AIIA is confident that members are happy to contribute to and assist with this education. Page 4 of 5 13 October 2017

5 The AIIA would also highlight that options to recognise comparable international or other standard certifications should also be open to consideration. Some of these international certifications like ISO27001 and SOC are valuable in reducing the cost and burden of compliance. Other certification regimes like FedRAMP in the US have both positives and negatives that would require very careful consideration, such as the possibility they would increase the burden of compliance or restrict non-local organisations. Our members have expertise in these regimes that they would be happy to share. The AIIA considers this situation a critical risk to the Government s ability to successfully prosecute its digital transformation agenda. With that in mind, we hope that our proposed way forward can help to effectively mitigate this risk. AIIA is happy to discuss these issues with you in more detail Yours sincerely Rob Fitzpatrick Chief Executive Officer Australian Information Industry Association rob@aiia.com.au Page 5 of 5 13 October 2017