When it comes to protecting Australia’s critical infrastructure, most organisations focus on the points of entry. They invest in stronger locks for doors, multi-factor authentication, perimeter defences, and compliance certifications.
But what if the problem isn’t the lock?
What if the door itself is hanging off weak hinges?
That’s the reality many water, energy, and transport operators are facing. Despite increasing investment in cybersecurity, the biggest risks aren’t always sophisticated attackers. More often, it’s the silent and preventable weaknesses caused by platform misconfigurations.
Compliance Pressure Is Tight
The regulatory bar for essential services has never been higher. Amendments to the Security of Critical Infrastructure Act (SOCI) now require risk management programs for essential entities – covering not just cybersecurity, but also supply chains, physical security, and governance.
Alongside SOCI, frameworks like the Essential Eight, NIST Cybersecurity Framework, CIS Benchmarks, and the Protective Security Policy Framework are no longer optional guidance. They’re quickly becoming the baseline expectation for managing critical assets.
On paper, these frameworks act as the “locks” on the door. They set standards for what secure environments should look like. But as many operators are discovering, compliance alone doesn’t stop attacks if the underlying foundations are weak.
The Silent Enemy: Misconfigurations
The majority of cloud platform breaches can be traced back to misconfigurations. These errors aren’t exotic zero-day vulnerabilities – they’re everyday mistakes:
- Overly permissive identity and access management (IAM) roles
- Open storage buckets exposing sensitive data
- Poor segmentation between IT and operational technology (OT) networks
- Unmonitored containers running in the cloud
Individually, each may seem minor. Collectively, they create structural weaknesses that no compliance tick-box can cover. It’s the equivalent of leaving the screws loose on the door hinges.
Case in Point: Australia’s Water Sector
We recently worked with an Australian statutory authority owned by the State Government, responsible for managing all essential water bodies in one of the country’s major cities. Given the critical nature of its services, the authority sought to further strengthen its already robust cyber defences and ensure its cloud platforms remained resilient against emerging threats.
By aligning remediation efforts with the Essential Eight and NIST, the authority was able to close gaps, fortify its cloud environment, and present regulators with a clear roadmap for resilience.
This is a common pattern – misconfigurations often lurk unnoticed until an audit uncovers them. Left unchecked, they create exactly the kind of vulnerabilities SOCI is designed to prevent. You can read the full case study here.
Beyond Compliance: Building Resilience
The lesson here isn’t that compliance frameworks are irrelevant – far from it. SOCI, the Essential Eight, and NIST provide valuable scaffolding for critical infrastructure operators. But compliance should be seen as a floor, not a ceiling.
True resilience means going further:
- Regular posture reviews to identify and remediate misconfigurations
- Landing zones to ensure environments are secure by design
- AI-enabled monitoring tools, such as Microsoft Copilot for Security, to provide continuous visibility and reduce reliance on manual oversight
Critical infrastructure organisations face enormous pressure to deliver safe, reliable, and trusted services to the public. But resilience won’t come from bolting more locks onto a door with loose hinges.
Misconfigurations may be mundane, but in essential services, they’re dangerous. They’re what turn a compliance exercise into a genuine vulnerability, and what regulators are increasingly watching for.
The organisations that will thrive under SOCI and future regulatory scrutiny are those that don’t just meet compliance but use it as a springboard to modernise their security, strengthen operations, and build long-term trust.
Because at the end of the day, it’s not the lock on the door that matters most.
It’s whether the door itself is built to stand firm.
To celebrate our recent ISO27001 Certification, we’re offering complimentary Security Posture Preview sessions. This is your chance to benchmark your environment and walk away with a clear roadmap for improvement- at no cost. Book yours today!
