New Zealand’s Cyber Security Strategy 2019 was released by the Department of the Prime Minister and Cabinet (DPMC). Its vision was for New Zealand to be confident and secure in the digital world and to enable New Zealanders to thrive online. The strategy recognised that cyber-enabled threats were increasing in number, scope and scale and that government, businesses, communities and individuals all had a role in reducing cyber risk (Department of the Prime Minister and Cabinet [DPMC], 2019).
Increase awareness of cyber security and encourage people to take active steps to protect themselves online.
Develop a strong and capable cyber security workforce and ecosystem.
Work internationally with other countries and organizations to respond to cyber threats.
Build a resilient and responsive New Zealand that can continue operating during cyber incidents.
Proactively tackle cybercrime and reduce the harm caused by malicious online activity.
Five priority areas:
1. Cyber security aware and active citizens.
2. A strong and capable cyber security workforce and ecosystem.
3. Internationally active New Zealand.
4. A resilient and responsive New Zealand.
5. Proactively tackling cybercrime.
Identify important systems and information and understand the risks affecting them.
Use appropriate security controls, including access management, authentication, patching, backups and monitoring.
Train staff so they can recognize phishing, scams, malware and other common threats.
Prepare incident response procedures so the organization knows what to do if an attack occurs.
Work with suppliers, partners and relevant authorities because cyber security is a shared responsibility.
Regularly review systems and improve security controls as threats change.
The strategy focuses on protecting New Zealand’s people, businesses, communities and nationally important systems. A stronger bicultural approach can also recognize Māori data sovereignty and the importance of protecting Māori data, language, cultural information and community interests. Cyber security controls should therefore consider not only individual users and organizations but also potential collective harm to Māori communities.
For example, a digital system holding iwi or hapū information could require stronger governance around who can access the information, where it is stored, how it is shared and how incidents are communicated. This connects cyber security with rangatiratanga, kaitiakitanga and responsible data governance.
IT professionals design, develop, configure and maintain systems that hold valuable information. Poor security can lead to data breaches, financial loss, service disruption, reputational damage and harm to individuals or communities. Therefore, cyber security should be considered throughout the system life cycle, from planning and development through to maintenance and disposal.