In 2016 Australia’s online census failed. Preparations for the 2021 edition have been rated ‘partly effective’
(2020/11/20)
- Reference: 1605841090
- News link: https://www.theregister.co.uk/2020/11/20/australia_census_2021_audit/
- Source link:
In 2016 Australia’s online census crashed and burned after legitimate attempts to complete the survey were mistaken for a DDOS attack, the routers funneling traffic failed and disaster recovery plans did likewise.
A probe into the fail revealed poor planning, little testing, and many red faces. The mess ultimately saw [1]IBM pay AU$30m to the Australian government to compensate for costs incurred in making the census available. Big Blue was vindicated, to some degree, by the fact that Australian government agencies signed off on its security plans. However the incident, which came to be known as #Censusfail, became a byword for Australia’s government being bad at technology.
Little wonder, then, that the Australian Bureau of Statistics (ABS) decided to commission an independent audit of its preparedness for the 2021 census.
The first conclusion of the [2]report [PDF] based on that audit is that planning to date has been “partly effective”.
The report goes on to damn preparations with faint praise, find that while “largely appropriate planning and governance arrangements” are in place, “The risk framework is compromised by weaknesses in the assurance arrangements.”
On the IT front, the Bureau’s preparations are again rated “partly effective”.
“Generally appropriate frameworks have been established covering the Census IT systems and data handling, and the procurement of IT suppliers. The ABS has not put in place arrangements to ensure that improvements to its architecture framework, change management processes and cyber security measures will be implemented ahead of the 2021 Census.”
Australia's IBM-assisted Census fail burned AU$30 MEEELLION [3]READ MORE
The report also found that “partly appropriate” security controls are in place, that the Bureau’s high-level security measures and controls are “sound”. However the agency’s security strategy has not been fully implemented.
Nor has the Bureau fully-implemented its new IT framework, so Census tech is not compliant and is in any event built outside the agency’s architecture standards. It also lacks controls for managing non-compliance. “The ABS has not established a process to mitigate the risk of unauthorised changes being implemented across systems supporting the Census.”
Data handling is not in great shape, either. The review rates current practices as "partly appropriate" and warns the ABS "has not fully implemented controls for managing the quality and protection of 2021 Census data and does not have in place appropriate arrangements to monitor control implementation."
The report therefore recommends an assessment of the risks created by non-compliance, plus the creation of controls for mitigating unauthorised and inappropriate system changes. Those controls will focus on developers that have access to migrate their own changes to Census-related systems. Regular review of progress on security was also recommended, as was a review process to make sure the review processes are working.
The ABS has agreed to all recommendations. It now has nine months to get them right: Census day is August 21st, 2021. ®
Get our [4]Tech Resources
[1] https://www.theregister.com/2016/11/25/ibm_clearly_failed_ddos_protection_for_australias_censusfail/
[2] https://www.anao.gov.au/sites/default/files/Auditor-General_Report_2020-21_16.pdf
[3] https://www.theregister.com/2016/10/19/oz_stats_bureaus_census_fail_burned_au30_meeelion/
[4] https://whitepapers.theregister.com/
A probe into the fail revealed poor planning, little testing, and many red faces. The mess ultimately saw [1]IBM pay AU$30m to the Australian government to compensate for costs incurred in making the census available. Big Blue was vindicated, to some degree, by the fact that Australian government agencies signed off on its security plans. However the incident, which came to be known as #Censusfail, became a byword for Australia’s government being bad at technology.
Little wonder, then, that the Australian Bureau of Statistics (ABS) decided to commission an independent audit of its preparedness for the 2021 census.
The first conclusion of the [2]report [PDF] based on that audit is that planning to date has been “partly effective”.
The report goes on to damn preparations with faint praise, find that while “largely appropriate planning and governance arrangements” are in place, “The risk framework is compromised by weaknesses in the assurance arrangements.”
On the IT front, the Bureau’s preparations are again rated “partly effective”.
“Generally appropriate frameworks have been established covering the Census IT systems and data handling, and the procurement of IT suppliers. The ABS has not put in place arrangements to ensure that improvements to its architecture framework, change management processes and cyber security measures will be implemented ahead of the 2021 Census.”
Australia's IBM-assisted Census fail burned AU$30 MEEELLION [3]READ MORE
The report also found that “partly appropriate” security controls are in place, that the Bureau’s high-level security measures and controls are “sound”. However the agency’s security strategy has not been fully implemented.
Nor has the Bureau fully-implemented its new IT framework, so Census tech is not compliant and is in any event built outside the agency’s architecture standards. It also lacks controls for managing non-compliance. “The ABS has not established a process to mitigate the risk of unauthorised changes being implemented across systems supporting the Census.”
Data handling is not in great shape, either. The review rates current practices as "partly appropriate" and warns the ABS "has not fully implemented controls for managing the quality and protection of 2021 Census data and does not have in place appropriate arrangements to monitor control implementation."
The report therefore recommends an assessment of the risks created by non-compliance, plus the creation of controls for mitigating unauthorised and inappropriate system changes. Those controls will focus on developers that have access to migrate their own changes to Census-related systems. Regular review of progress on security was also recommended, as was a review process to make sure the review processes are working.
The ABS has agreed to all recommendations. It now has nine months to get them right: Census day is August 21st, 2021. ®
Get our [4]Tech Resources
[1] https://www.theregister.com/2016/11/25/ibm_clearly_failed_ddos_protection_for_australias_censusfail/
[2] https://www.anao.gov.au/sites/default/files/Auditor-General_Report_2020-21_16.pdf
[3] https://www.theregister.com/2016/10/19/oz_stats_bureaus_census_fail_burned_au30_meeelion/
[4] https://whitepapers.theregister.com/