New Zealand’s Cyber Security Strategy 2019

Building a Confident and Secure Digital New Zealand

Cyber security is an important part of protecting New Zealand’s people, businesses, organisations and critical systems.

New Zealand’s Cyber Security Strategy 2019 established a national framework for responding to cyber threats and improving the country’s ability to operate safely in the digital world.

The strategy was published by the Department of the Prime Minister and Cabinet on 2 July 2019.

The 2019 strategy has since been superseded by a newer national cyber security strategy. However, the 2019 strategy remains relevant because it demonstrates New Zealand’s approach to cyber security during that period.

What was the purpose of the strategy?

The strategy’s vision was for New Zealand to be confident and secure in the digital world.

Digital technology provides significant benefits to individuals, businesses and communities, but it also creates risks.

Cyber attacks can affect:

  • Personal information

  • Businesses

  • Government services

  • Financial systems

  • Critical infrastructure

  • Digital services

The strategy recognised that cyber security is not solely the responsibility of the government.

Individuals, businesses, communities and government organisations all have roles to play in keeping New Zealand secure.

The Five Priorities

The Cyber Security Strategy 2019 identified five key priorities.

Priority 1 — Cyber security aware and active citizens

New Zealanders need to understand cyber security risks and know how to protect themselves online.

This includes developing awareness of issues such as:

  • Phishing

  • Online scams

  • Password security

  • Malware

  • Social engineering

  • Protection of personal information

  • Safe use of online services

Education and awareness can reduce the likelihood of individuals becoming victims of cyber attacks.

For example, understanding how to identify a phishing email can prevent someone from accidentally providing their password or financial information to a cybercriminal.

Priority 2 — A strong and capable cyber security workforce and ecosystem

New Zealand needs skilled cyber security professionals and organisations capable of responding effectively to cyber threats.

The strategy recognised the importance of developing:

  • Cyber security skills

  • Technical capabilities

  • Professional expertise

  • Industry collaboration

  • Information sharing

  • Organisational resilience

For IT professionals, this means keeping knowledge and skills up to date as technologies and cyber threats continue to change.

Cyber security professionals need to understand emerging threats and technologies rather than relying only on security practices that were effective in the past.

Priority 3 — Internationally active

Cyber threats do not stop at national borders.

New Zealand therefore needs to work with international partners to:

  • Share cyber security information

  • Respond to international threats

  • Investigate cybercrime

  • Improve international cooperation

  • Contribute to global cyber security efforts

International cooperation is particularly important because cybercriminals can operate from other countries and cyber attacks can involve infrastructure located across multiple jurisdictions.

A cyber attack against a New Zealand organisation may therefore involve systems, attackers or services located overseas.

Priority 4 — Resilient and responsive New Zealand

Organisations need to be able to prevent, withstand and recover from cyber incidents.

Cyber resilience includes:

  • Preparing for cyber attacks

  • Protecting systems and information

  • Detecting unusual activity

  • Responding to incidents

  • Recovering systems and services

  • Learning from previous incidents

Organisations should therefore have appropriate security controls and incident response processes rather than assuming that an attack will never happen.

Examples of measures that can improve cyber resilience include:

  • Secure backups

  • Incident response plans

  • Security monitoring

  • Access controls

  • Multi-factor authentication

  • Regular security testing

  • Staff cyber security training

Priority 5 — Proactively tackle cybercrime

Cybercrime needs to be actively addressed through cooperation between relevant organisations and agencies.

This includes improving the ability to:

  • Prevent cybercrime

  • Detect cybercrime

  • Investigate cybercrime

  • Respond to cyber-enabled crime

  • Share information about threats

  • Support victims of cybercrime

Cybercrime can affect individuals, businesses, government organisations and critical infrastructure.

How does the strategy guide organisations?

The strategy provides a national direction that organisations can use when considering their own cyber security practices.

An organisation should consider:

  • What information and systems need protection?

  • What cyber threats could affect the organisation?

  • Who is responsible for security?

  • How will incidents be detected?

  • What happens if an attack occurs?

  • How will the organisation recover?

  • How will employees be educated?

  • How will suppliers and third-party services be managed?

Cyber security should be treated as an ongoing process rather than a one-time task.

Practical security measures can include:

  • Strong authentication

  • Multi-factor authentication

  • Regular software updates

  • Secure backups

  • Access controls

  • Encryption

  • Staff cyber security training

  • Security monitoring

  • Incident response plans

  • Regular security testing

Cyber security and IT professionals

IT professionals have an important role in turning cyber security principles into practical systems.

When developing software or managing infrastructure, professionals should consider security throughout the system’s lifecycle.

For example, a developer should not simply build a system and add security afterwards.

Security should be considered during:

  1. Planning

  2. Development

  3. Testing

  4. Deployment

  5. Operation

  6. Ongoing maintenance

Considering security throughout the lifecycle can reduce vulnerabilities and help protect users, systems and organisations.

IT professionals should also consider how their technical decisions could affect the confidentiality, integrity and availability of information.

Māori perspectives on digital safety

Cyber security also needs to consider the interests of Māori communities.

Māori Data Sovereignty recognises that Māori have rights and interests in Māori data and that data governance should support Māori wellbeing, language and culture.

Māori Data Sovereignty principles

The principles of Māori Data Sovereignty include:

Rangatiratanga — Authority and control

Rangatiratanga relates to Māori authority and control over Māori data and data ecosystems.

Whakapapa — Relationships and context

Whakapapa recognises the relationships, origins and context associated with data.

Whanaungatanga — Obligations

Whanaungatanga recognises the obligations and relationships between individuals, communities and data.

Kotahitanga — Collective benefit

Kotahitanga focuses on ensuring that data can provide benefits to Māori individuals and communities.

Manaakitanga — Respect and reciprocity

Manaakitanga emphasises respect, dignity and reciprocity when collecting and using data.

Kaitiakitanga — Guardianship

Kaitiakitanga relates to protecting and responsibly managing Māori data.

Why are Māori perspectives important to cyber security?

Protecting data is not only about preventing hackers from accessing a database.

It can also involve considering:

  • Who controls the information?

  • Where is the information stored?

  • Who has access to it?

  • How is the information interpreted?

  • How is the information being used?

  • Who benefits from the information?

  • Could the use of the information cause harm?

  • Are Māori communities involved in decisions about their data?

For example, an organisation could have strong passwords, encryption and firewalls while still failing to consider whether the organisation has appropriate authority to collect or use particular Māori data.

A stronger approach to cyber security can therefore combine technical protection with cultural awareness, appropriate data governance and community engagement.

Why does cyber security matter?

Cyber security affects everyone who uses digital technology.

A successful cyber attack can result in:

  • Financial loss

  • Identity theft

  • Loss of personal information

  • Business disruption

  • Reputational damage

  • Loss of public trust

  • Disruption to important services

Cyber attacks can also have wider effects when they target organisations that provide essential services or operate critical infrastructure.

Strong cyber security helps organisations protect their users, maintain reliable services and maintain confidence in digital technology.

Cyber security as a shared responsibility

The Cyber Security Strategy 2019 demonstrates that cyber security is not the responsibility of IT departments alone.

Different groups have different responsibilities.

Individuals

Individuals can help protect themselves by:

  • Using strong and unique passwords

  • Enabling multi-factor authentication

  • Recognising phishing attempts

  • Keeping software updated

  • Protecting personal information

  • Reporting suspicious activity

Businesses and organisations

Organisations can help protect their systems by:

  • Implementing security controls

  • Training employees

  • Protecting sensitive information

  • Monitoring systems

  • Preparing incident response plans

  • Maintaining secure backups

  • Managing third-party risks

Government

Government organisations have responsibilities for:

  • National cyber security

  • Supporting cyber security capability

  • Responding to significant threats

  • Working with international partners

  • Tackling cybercrime

  • Supporting organisations and communities

Effective cyber security therefore depends on cooperation between individuals, organisations, industry and government.

Summary

New Zealand’s Cyber Security Strategy 2019 established a national approach to improving cyber security and creating a confident and secure digital environment.

Its five priorities focus on:

  1. Cyber security aware and active citizens

  2. A strong and capable cyber security workforce and ecosystem

  3. International cooperation

  4. Resilience and responsiveness

  5. Proactively tackling cybercrime

For IT professionals, the strategy demonstrates that cyber security is both a technical and organisational responsibility.

Security needs to be considered throughout the technology lifecycle, from planning and development through to deployment, maintenance and incident response.

Ethical cyber security also requires consideration of the people and communities affected by digital systems.

In Aotearoa New Zealand, this includes Māori perspectives on data, authority, protection, cultural values and collective wellbeing.

References

Department of the Prime Minister and Cabinet. (2019, July 2). New Zealand’s Cyber Security Strategy 2019.

Te Mana Raraunga. (2018). Principles of Māori Data Sovereignty.

image on NZ's Cyber Security Strategy