C over Th eme

AUKUS – Cyber Security Aspects

Vijay Varadharajan Australian businesses in general, for been enabled by a period of economic
Global Innovation Chair Professor and instance, in the context of regulatory growth. Though the pandemic has
Chief Cyber Strategist
Director: Advanced Cyber Security frameworks both within and between probably slowed down this military
Research Engineering Centre (ACSRC) AUKUS alliance partners. modernisation, it is likely this will be
I would like to explore cyber aspects continued to be prioritised.
We all know AUKUS is a trilateral that are relevant to AUKUS, and which Such regional military modernisation
security pact between Australia, the UK could and, in my view, perhaps should includes things like the advancement
and the US, announced in Sept 2021. form part of AUKUS in maritime surveillance, which
Under this pact, Australia will acquire clearly has implications for Australian
nuclear powered submarines from the Strategic Context of the operations in the region. New weapons
UK and the US. Indo-Pacific being introduced into the region with
But AUKUS is much more than just increased range, speed, precision and
nuclear submarines. It is much broader It has become a highly competitive lethality, potentially placing Australian
than that, with a focus on the security of environment and a more contested military forces at greater risk over
the Indo-Pacific region. Both our PMs one with tension, and assertive posture longer distances.
before and after the recent election by one country in the region, namely This brings me to another major
have referred to AUKUS as being a China, in the recent times. factor namely disruptive technologies,
comprehensive agreement covering A major driver is the strategic which is influencing the strategic
interoperability of defence assets competition between the US and context of the region. These disruptive
between the partners. China. We have been witnessing a technologies are being translated into
The pact is intended to include more assertive behaviour from China sophisticated weapons systems – such
cooperation on advanced technologies in the recent times in advancing its as autonomous systems – reducing
such as cyber, artificial intelligence, strategic preferences and seeking to decision times and improving weapon
autonomous systems and quantum exert greater influence in the Indo- lethality. This also gives opportunities
technologies. And the focus is more on Pacific region. for non-state actors such as potential
the military and defence capabilities, This strategic competition between terrorists to adapt new technologies for
separating it from the Five Eyes the United States and China is unlikely their purposes.
intelligence sharing alliance which also to abate, and in fact, with the pandemic All these have implications for
includes New Zealand and Canada. and the war in Ukraine and with security and peace in the region.
There have been several the recent tension with Taiwan, this Growing regional military capabilities,
statements in the public media about competition has sharpened even more. and the speed at which they can be
AUKUS including -- AUKUS will enable If one looks at the general trend in deployed, mean reduced warning
game changing technology transfer, the region, it is fair to say that there times. Reduced warning times
potentially creating opportunities not has been an acceleration of military mean defence plans can no longer
only for Australian Defence but also for modernisation in the region, which has assume that they will have time to

2
 C o ve r Th e m e

gradually adjust military capability political systems. They are often Various aspects of security, privacy
and preparedness in response to the conducted in ways designed to and trust arise with each of these
emerging challenges. facilitate deniability and complicate technologies and types of users.
Furthermore, such strategic attribution. And cyberspace transcends
circumstances with greater competition borders, making it easier for attackers Characteristics of Cyber
between major powers in the region and rogue states to carry out these Security
together with military modernisation cyberattacks. At a high level, cyber security is the
and potential economic coercion can application of technologies, processes
increase the potential for miscalculation Technology Scenery and
and controls to protect systems,
and their adverse consequences. Cyber Security networks, devices, data and users from
All these are putting an increasing It is clear technology is pervasive, and threats and attacks.
strain on the rule-based order which so is cyber security. Anywhere there Security is relative to threats being
has been the cornerstone of foreign is technology there can be aspects of perceived and the threats are dynamic.
policies for many years. This is being security, privacy, and trust. As threats constantly evolve, there
further exacerbated with developments If we look at the technology scenery, is a need for secure systems to be
in domains such as space and cyber. we have different types of networks continuously updated to counteract
In these domains, rules of engagement (such as fixed, wireless, and mobile new and emerging threats.
are not always clear, and the thresholds networks), large scale distributed We can think of cyber threats
for triggering a military response are systems and cloud services (these are as possible attacks on a system or
often confusing, and they lack the fixed). Then there is mobile software some digital asset. Threats exploit
more clearly defined boundaries of (such as mobile apps). Then there are vulnerabilities and vulnerabilities
national borders. Let us now look at small devices such as sensors and materialize as risks.
more closely the implications for cyber Internet of Things, to large scale data There will be some residual risks
security. centres, distributed databases, and as threats keep changing. So, there is
infrastructures. no absolute security. When it comes
Implications for Cyber So, we have various technologies to changing threats, I tend to think
Security and platforms in a melting pot, in of increasing threat velocity, this
When it comes to cyber, the strategic fact, a spaghetti of heterogeneous increasing threat velocity has several
context provides the opportunity for technologies, creating a pervasive dimensions:
the increasing willingness by some distributed mobile environment.
• More and more vulnerabilities being
countries and non-state actors to use Then there are users. Just like
discovered, so more attacks,
the cyber capabilities maliciously. At technology, it is not a monolith and
- Product Vulnerabilities
a broad level, cyberattacks directly there are different types of users, from
- System Misconfigurations
compromise military capability and individuals, small to medium enterprises
- Insider Threats
operations. They drive disinformation (SMEs), to large corporations and
- Social Engineering
with a destabilising interference to government agencies. They all have
• Evolving set of actors (bad guys)
the society and the economy, and different types of user requirements.
• Attacks happening sooner and
faster
• Easy to carry out attacks
Also, the attackers have some
advantages over the defenders
• Defender must defend all points.
Attacker can choose the weakest
point
• Defender can defend only against
known attacks. Attacker can probe
for unknown vulnerabilities
• Defender must be constantly
vigilant. Attacker can strike at will
• Defender play by the rules, whereas
attackers can play “dirty”.
There is also the problem of
attribution when it comes to attacks
Attribution.
Who is attacking” and the “Why”?

3
 C over Th eme

environment, any device can become

the weakest link in the security chain
and expose the entire enterprise to
risk.

AI and Cyber
AI technologies impact both sides of
the coin, so to speak, when it comes
to cyber. That is, both attackers
and defenders can benefit from AI
technologies.
Incidentally when I say AI, I want to
focus here only on machine learning,
which is probably the most relevant
technology of AI for our purposes.
In a nutshell, machine learning
algorithm has 3 main parts:
This is a difficult problem due to Cyber Security Centre, that impact the
several reasons: delivery of the essential services. 1. A Decision Process: Based on
The Enhanced Cyber Security some input data, algorithm will
• Open and unauthenticated nature produce an estimate about a pattern
Obligations include:
of the Internet in the data: often a prediction or a
• Information relating to source may • developing cyber security incident classification.
not exist or be inaccurate response plans to prepare for a 2. An Error Function: An error function
• People with relevant data may cyber security incident serves to evaluate the prediction
be reluctant to share, e.g., legal • undertaking cyber security exercises of the model. If there are known
constraints across boundaries to build cyber preparedness examples, an error function can
• Even when data is shared, may • undertaking vulnerability assess- help to assess the accuracy of the
still be hard to reach consensus on ments to identify vulnerabilities for model.
what the data means. remediation 3. A Model Optimization Process:
• providing system information to If the model can fit better to the
Hence when it comes to policy
develop and maintain a near-real data points in the training set, then
settings, it is more about probabilities
time threat picture. weights in the model are adjusted
and thresholds.
What is the right probability to reduce the discrepancy between
5G Infrastructures
threshold? What is the right tolerance the known example and the model
level for harm? And what action is 5G networks are much more than just estimate. The algorithm will repeat
proportionate? faster speeds. They introduce greater this evaluate and optimize process,
capacity, reduced latency, and more updating weights autonomously
Cyber and Disruptive flexible service delivery. They enable until a threshold of accuracy has
organisations to provide richer content, been met.
Technologies more real-time transactions, and better
One key point with machine learning
I would like to focus on certain user experiences.
systems is that they have the capacity
technologies where cyber plays a First, 5G can help to create powerful
to learn and modify their own behaviour
key role, and which are relevant for edge-based networks that can share
to achieve their objectives.
AUKUS. and process information locally as well
We have different types of learning,
as with cloud resources. For instance,
Critical Infrastructures a common one is supervised learning.
IoT devices can track other devices
Here we have data that have been
These are assets seen as being and users, monitor inventory, gather
labelled, such as bad data and good
most crucial to the nation, by virtue user and device information, and
data, and the algorithm learns using
of their interdependencies across provide real-time data.
these known labelled data. Once the
sectors, and the potential for cascading Such connected environments
algorithm has learned sufficiently, we
consequences to other critical have serious consequences for cyber
can use the algorithm on test data.
infrastructure assets and sectors, if security. The biggest challenge is
In my view, at present, defence is
disrupted. the dramatic growth of the attack
in a weaker position than offense due
The Legislation itself has several surface due to the rapid expansion
to the various factors that I alluded
security obligations. For instance, of IoT devices and edge-based
to earlier. Hence the help that AI
certain organisations are required to computing. With billions of IoT devices
can provide to improve the defence
report cyber incidents to the Australian interconnected across a meshed edge

4
 C o ve r Th e m e

capabilities will be useful for correcting so that they can collaborate with space assets are not all developed by
some of the imbalance between the trustworthy agents, and a single manufacturer.
attackers and defenders. • to take decisions based on data In fact, to keep the costs down,
Another important area is that that is accurate, as well as having space organisations often purchase
adversarial learning. This is about reliable mechanisms to evaluate components from catalogues of
finding the vulnerabilities in the machine the quality and consequences of approved vendors around the world.
learning algorithms themselves. their decisions and actions, and The approval process for these
Attackers use these techniques to learn from experience. vendors does not necessarily include
cheat and attack machine learning cyber security vetting standards.
algorithms. Space and Cyber When a space organisation
So, we need to design trustworthy The final area of critical technologies purchases a component from a vendor,
machine learning algorithms that that I want to mention about is that of for instance, it has little control over the
can withstand such attacks from the space, which I believe is important for code written by a software developer
attackers. AUKUS from cyber perspective of that component. This lack of insight
We also need to have a better With the increasing introduces considerable cyber security
understanding the decisions made by commercialization and militarization risk.
machine learning algorithms, that is, of the space sector, the attractiveness This makes space assets difficult,
why a particular decision has been of space as a target for attacks will only if not impossible, to patch for security
made and not just what the decision is. grow in the future. flaws, when they are discovered.
Most of the world’s terrestrial critical Then there are the new emerging
Autonomous Systems and infrastructures – communications, space services. For instance, the AWS
Cyber financial services, transport, logistics, Ground Station is a fully managed
An autonomous system is a collection weather monitoring etc. - are service that allows users to control
of distributed entities or agents, intrinsically dependent on space satellite communications, process
interacting and collaborating with each infrastructures. So, protecting space data, and carry out operations from
other, carrying out a multitude of tasks, assets is critical. their desktops and laptops, without
to realize the overall system goals. Space systems typically consist requiring the traditional ground station
This can be, for instance, a group of of 3 segments, namely the space infrastructure (such as from a space
drones interacting with each other in a segment (with satellites and space agency).
dynamic and contested environment. objects), the ground segment (with all This implies that such services
Autonomy can be partial in that its command control and management can be accessed by users from their
there can be some degree of human as well as user and customer networks desktops or laptops, from anywhere
involvement. receiving data and services) and the from the world. This introduces several
These autonomous agents need link segment that connects the two. security issues such as controlling
security mechanisms to: All these segments are exposed to actions from malicious users and
a range of cyber threats. ensuring malicious payload is not
• detect and counteract attacks, Another major area of concern is uploaded infecting space systems, as
• to determine which agents are the supply chain vulnerabilities. The well as preventing denial of service
friends or which ones are enemies, specialised components needed for attacks.
Another emerging technology is the
softwarization of space systems. On the
one hand, these technologies will make
space systems more flexible, allowing
introduction of new functionalities
as well as dynamic configuration of
satellite functions to meet changes
in demand. On the other hand, it also
introduces new security challenges.
When the new functionalities and
services are introduced dynamically
there is a need to ensure that they
are secure and trustworthy and that
sophisticated security attacks can be
prevented.
It is clear that mitigating cyber threats
in space require not only technological
solutions but also policy solutions that
Defence image can guide the technology efforts.

5
 C over Th eme

from the QUAD and AUKUS to

improve interoperability and resilience
capabilities.
Another area that should be
explored is in the context of foreign
policy, related to foreign aid. There
can be coordination of policies with
respect to foreign aid resources in
cyber and technology capacity building
in the region—a dual benefit for the
economies and resilience of our
regional partners, as well as our own
security.

Conclusion
In conclusion, cyber poses global
challenges, which can only be met
through close alignment and co-
operation amongst major powers.
Initiatives such as AUKUS and QUAD
For instance, with the increasing So, there is a great opportunity to provide ideal channels for Australia to
reliance of the space sector on enhance cooperation in the cyber skills enhance cooperation and collaboration
commercial technologies and the area and synchronize some of the in cyber, in particular, in enhancing
use of commercial off the shelf activities in education and research in its cyber security capabilities through
components, it is critical that polices cyber security between the QUAD and sharing of expertise, and investment in
should be established to enforce strict the AUKUS initiatives. For instance, skills, enabling the partners to develop
cyber security requirements for all mutual recognition of some specific and exchange advanced technologies
components of space systems and educational programs in cyber security. and strengthen their interoperability
their supply chains. In fact, mutual recognition of security and resilience.
Cyber security skills are another assessments like IRAP (Infosec For AUKUS to be successful, I
important piece in the policy framework. Registered Assessors Program) and believe it should play a significant role
A major challenge in securing security standards for procurement of in areas such as secure supply chain
space systems is the “systems of software, across AUKUS and QUAD and interoperable security standards,
systems” aspects, requiring a deep countries, will enable companies which are particularly relevant (and
that pass security assessments in require urgent consideration) for cyber
understanding of how such systems
one country to sell into the partners’ technologies in defence and space.
work and the various threats and
markets. Furthermore, I believe AUKUS
opportunities for the attackers to disrupt
On the technology side, there can should engage with the industry
them. With space systems, expertise
be some low-hanging fruits such as and bring them along in shaping the
in both system infrastructures such
AUKUS initiative. This will be critical
as servers, networks, and systems agreements on the next stages of
for its success. Increasingly, we are
as well as knowledge of specialised 5G/6G. Another area which comes
seeing an increasing focus on cyber
space infrastructures such as ground to my mind is in the establishment of
security in the boardrooms of US, UK,
control systems and satellites are a framework for identifying and fact-
and Australian organisations in both
needed. The policy framework should checking monitoring system targeted
public and private sectors. Alliances
identify specific steps in developing at cyber threats, which would be
like AUKUS can have a positive
professionals who have capabilities beneficial for both QUAD and AUKUS.
influence on such boardrooms, when
and expertise in both these areas. Also establishing government
every executive team will need to
agreements between the partners in
assess cyber risk and understand the
AUKUS and Other the tracking down of cyber criminals, mitigation opportunities afforded by
potentially putting pressure on financial
Initiatives entities enabling them to operate, as
technologies such as AI, autonomous
and cloud systems.
It is estimated that there are some 3 well enabling increased transparency.
Vijay Varadharajan
million cyber security professionals will This can also help with attribution The University of Newcastle
be needed throughout the world by the of activities of malicious actors and [email protected]
late 2020s. In Australia, this figure is cyber-related sanctions. images Adobe stock.
around 25000 over the next few years, Then there is the conducting of
whereas in the US it is over 800,000. joint cyber exercises with the partners