1

The Department protects its computer systems from external attack through the use of firewall software, segregating external connections from internal systems and considerable logging of activity.Access to internal systems are protected by unique user identifiers and passwords. All activity is logged.

2

No intrusions have been detected.

2 (a)

Not Applicable

2 (b)

Not Applicable

2 (c)

Not Applicable

2 (d)

Not Applicable

3

3 (a)

Not Applicable

3 (b)

Not Applicable

3 (c)

Not Applicable

1

The Australian Maritime Safety Authority uses a number of security measures to protect its computer network from outside unauthorised access. These include the provision of Internet Gateway Router, comprehensive Access Control Lists and a separate external network segment to screen any unauthorised access.

2

The Australian Maritime Safety Authority network security logs have not indicated any external unauthorised access to its computer systems.

2 (a)

Not Applicable

2 (b)

Not Applicable

2 (c)

Not Applicable

2 (d)

Not Applicable

3

3 (a)

Not Applicable

3 (b)

Not Applicable

3 (c)

Not Applicable

1

Systems are passworded and a firewall is in place to protect corporate systems

2

There has been no detected external unauthorised access.

2 (a)

Not Applicable

2 (b)

Not Applicable

2 (c)

Not Applicable

2 (d)

Not Applicable

3

3 (a)

Not Applicable

3 (b)

Not Applicable

3 (c)

Not Applicable

1

Australian River Co Limited has no significant information technology capabilities or requirements. Four leased personal computers are used for word processing and the like, and the accounting software is MYOB, which is primarily used for general ledger/trial balance purposes.All personal computers have password protection, which is altered on a regular basis."

2

There has been no external unauthorised access to the above mentioned personal computers.

2 (a)

Not Applicable

2 (b)

Not Applicable

2 (c)

Not Applicable

2 (d)

Not Applicable

3

3 (a)

Not Applicable

3 (b)

Not Applicable

3 (c)

Not Applicable

1

SIFC has no computer systems or hardware.

2

Not Applicable

2 (a)

Not Applicable

2 (b)

Not Applicable

2 (c)

Not Applicable

2 (d)

Not Applicable

3

3 (a)

Not Applicable

3 (b)

Not Applicable

3 (c)

Not Applicable

1

IT facilities for MIFCo are provided by the Department of Transport and Regional Services. The Department protects its computer systems from external attack through the use of firewall software, segregating external connections from internal systems and considerable logging of activity.Access to internal systems are protected by unique user identifiers and passwords. All activity is logged.

2

No intrusions have been detected.

2 (a)

Not Applicable

2 (b)

Not Applicable

2 (c)

Not Applicable

2 (d)

Not Applicable

3

3 (a)

Not Applicable

3 (b)

Not Applicable

3 (c)

Not Applicable

1

Access to CASA computer systems is controlled through uniquely identifiable user identification and passwords. Passwords are regularly changed in accordance with CASA security policy.There are a limited number of external access points to CASA systems.·Access for internet users is limited to the CASA internet site through the use of firewall products.·Access to CASA e-mail through the Internet is restricted to CASA authorised individuals through the use of valid user identification and passwords.·Access to CASA's internal business systems, by remote access facilities for authorised individuals, is controlled using authentication of valid user identification and passwords.CASA's infrastructure provider, IPEX ITG, monitors all methods of external access to CASA systems for intrusion.

2

2 (a)

There has been one documented unauthorised access to CASA computer systems since 1 January 1999

2 (b)

In that one incident, the security of the CASA Intranet Web site was breached by an unauthorised external access on Monday 10 July 2000 at approximately 1400 hours and again at 1420 hours. Evidence of the intrusion was in the form of `graffiti' over the CASA website, or script intrusion. This involved the hacker painting over the CASA introduction page with a message. Expert advice indicates that a novice hacker most probably performed the "Hack", possibly from overseas.

2 (c)

The intrusion was detected when the CASA web master undertaking normal system checks launched the web browser and immediately detected that the home Web page had been changed. He re-launched the correct CASA home page and commenced investigation of the issue, referring the problem to CASA officers responsible for security. The site was then breached again within 20 minutes in the same manner.

2 (d)

As a result, action was immediately taken to shut down the external access to the CASA Internet site while the security breach was investigated. A full security audit was undertaken including an assessment of the incident and potential impact on other CASA systems. As a result of the security reports recommendation, a number of changes to the configuration of the CASA Internet site were undertaken.

3

3 (a)

At the time of the incident, the CASA Internet site contained unclassified publicly available documents.

3 (b)

As part of the process of resolving the security breach, both the Australian Federal Police and the Defence Signals Directorate were contracted for assistance and advice. As part of the security review the unauthorised access was tracked back to its origin.

3 (c)

No further action could be undertaken as the attack on the CASA Internet site was undertaken from an overseas locality.

1

The NCA currently has a firewall running Windows NT 4.0 and also CheckPoint Firewall-1 software which protects the internal network from external threats. The NCA Internet site is currently hosted at Total Peripherals Group where it is protected by a firewall.

2

There has been no unauthorised access.

2 (a)

Not applicable

2 (b)

Not applicable

2 (c)

Not applicable

2 (d)

Not applicable

3

3 (a)

Not applicable

3 (b)

Not applicable

3 (c)

Not applicable

1

Airservices Australia is protected from unauthorised external access to computer systems with the deployment of security measures ensuring appropriate authentication for the delivery of on-line services. These measures include controlled, encrypted, remote access services utilising virtual private network capability as well as the installation of a Firewall facility for general Internet based transactions.All external access points are monitored within the access applications through audit trails and checked at regular intervals for abnormal trends or occurrences.

2

There has been no external unauthorised access to computer systems operated by Airservices Australia.

2 (a)

2 (b)

Not applicable

2 (c)

Not applicable

2 (d)

Not applicable

3

Not applicable

3 (a)

Not applicable

3 (b)

Not applicable

3 (c)

Not applicable