Everyone needs to have basic literacy in cyber security across their digital lives, from their homes to school and work. The key to achieving Australia’s cyber strategy is to start with ensuring a national uplift of core cyber skills by embedding them at the grassroots level.

This must be geared to the Australian population as a whole, rather than a subset of it – including current, future and retired workers. After all, a chain is only as strong as its weakest link. As with any goal to impart knowledge across a population, it’s helpful to stratify people into recognisable categories and determine the levels of knowledge we would aim for each stratus to achieve.

For it to be successful, this framework needs to ensure that cyber knowledge is synonymous with general digital learning. These knowledge sets are intertwined; one cannot learn the latter without also learning the former.

With these considerations, there is then a need for the government to:

1. Determine a hierarchy of digital needs, with respect to the knowledge every person in Australia should have
2. Recognise that all aspects of government and society have a role to play
3. Ensure that specific investments focus on the key areas within the Cyber Security 2020 Strategy (e.g., the future of identity, supply chain risks and sovereignty), but recognise that these are elements within an overarching whole.

Creating this baseline will enable us to build further cyber skills across organisations, as well as remove barriers to entry and enhance cyber as a career for any who desire it. But to achieve this, we need a framework that binds together the education system, government bodies, private organisations and professional bodies. While the Cyber Security 2020 Strategy identifies varying cyber crimes and threats under focus, it does not note the roles and strategies these players will fulfil to address these challenges.

This responsibility needs to be shared and distributed across all sectors by implementing standards and frameworks. It can include numerous simple tools: a phishing email video before a user accesses their email account; an ad on how to protect data and privacy before logging into a social media account; privacy protection messages when logging in to an online bank account; cyber bullying awareness in schools; making it easier to report cybercrime, and combining cyber security education with other degrees.

The simplest solutions and ideas will be the most effective and resonate most with individuals. Stranger danger is understood when kids go out to play, but what about the threat posed by people online? Do we need to have universal baseline cyber protection measures in place for each industry, such as banking?

Within this, we see the government’s role as being a vocal advocate and promoter for this fundamental shift in how Australians understand cyber security. Australia has a rich history of successful nation-wide public awareness campaigns. Though now decades old, “slip-slop-slap" is still so ingrained in the minds of most, that skin cancer awareness in the public consciousness is second nature. Equally “stop, look, listen, think” is instinctively repeated in our minds before we cross the road. A similar approach needs to be implemented to integrate cyber protection measures in the psyche of individuals, regardless of age.

For businesses, their role will be to explicitly acknowledge and focus on the need for cyber skills to be embedded across all industries. Right now, cyber security is where health and safety was 30 years ago: disparate, patchy and often optional. A more concerted effort will see cyber security undergo a similar evolution to be a key part of employee safety – from initial inductions when they start a role, all the way through their employment at that organisation.

The flow-on effect will be the advancement of cyber security as a career pathway. By debunking unhelpful stereotypes of the cyber workforce and making information security a commonly accepted practice, cyber will become a pathway of choice for many, bridging the forecasted skills shortage in this industry.

By removing and reversing the stigma of what a cybersecurity professional looks like, this will open this career choice up to more people including those currently under-represented – females, young Australians, the less-technically minded and those looking at a mid-career change – increasing and diversifying the talent pool available.

A path to a comprehensive cyber skills strategy that brings all Australians along the journey is critical. Every sector and every individual can be impacted by a cyber threat. Directing education outcomes towards a better understanding of cybersecurity will not only take a concerted effort from government, individuals, businesses and learning institutions – but will benefit each of them too.