Countries which launch cyberattacks against Australia should be named and face serious consequences, an industry panel advising the federal government on cybersecurity has said.

The advisory panel’s report, released on Tuesday, comes ahead of the government’s widely-anticipated 2020 cybersecurity strategy, which is due to be made public in the coming months. The previous strategy expired in April.

The panel is chaired by the Telstra chief executive, Andy Penn, with members including the former US secretary of homeland security, Kirstjen Nielsen, the Vocus chair, Robert Mansfield, and the Tesla chair, Robyn Denholm.

Among 60 recommendations made in Tuesday’s report, the panel called on Canberra to increase transparency around the cybersecurity threats facing Australia, including increased attribution where appropriate and when the source of the cyberattack was known.

“A key priority is increasing transparency on government investigative activity with more frequent attribution and consequences applied where appropriate,” the panel stated.

Tuesday’s report called on the federal government to adopt a more “forward-leaning posture” on the attribution of attacks, and deterrence, including using industry-provided information in order to alert the public of cybersecurity incidents.

“This should all occur against a backdrop of promoting and adhering to international law, building on the existing work of the Department of Foreign Affairs and Trade and Australia’s ambassador for cyber affairs.”

The prime minister, Scott Morrison, in June declined to name the state actor behind an increasing number of attacks on Australia in recent months – widely believed to be from China.

Experts said it was likely Australia would wait and join other countries in calling out the activity in a joint statement in the future, as has previously occurred.

In a conference call when launching the report, Nielsen said deciding when to attribute an attack to another country was “very complex” due to the nature of international relations.

“There is a right time, the right way in which to do it,” she said.

“I think the [panel] discussions, in the end, were more about using attribution as a form of deterrence, along with economic sanctions, diplomatic sanctions, other authorities, and resources that are available to government to deter the behaviour.”

Penn said ultimately it was a decision for government.

“The point we were making is that attribution is a very important deterrent and so it should be looked at in that light but, ultimately, it’s really a matter for the government.”

Despite the lack of attribution, Penn said the prime minister’s comments in June were helpful in raising awareness about the ongoing attacks.

“They were incredibly helpful. When the prime minister says something you take notice.”

The panel was critical of the government’s current approach to communication about cybersecurity, noting it was coming from several different departments, and a minister, with no consistent message.

“The government needs to be very careful about coordinating and make it as powerful as possible with the ultimate one being the prime minister, with a coordinated approach on whatever they’re going to say on cybersecurity so that it really has the power behind it,” Mansfield said.

“If it’s all over the place, people are going to shake their head and say ‘If the government can’t get it right, how can we get it right?’”

The panel has called for legislative protection for companies like Telstra to block malicious websites and other sources of attacks on Australian internet users, and for safe harbour protections for companies to share information - even classified information - with governments on cybersecurity threats.

Penn said companies would also need protection when they were under attack and the government had to step in and act.

“If we were subject to a very significant attack, then those operators with those systems in critical infrastructure need some protection for the consequences for that,” he said.

“If you’re a telecommunications operator … and there’s some sort of massive cyberattack and the government needs to become involved in the defence of that, which requires some intervention in your operations and your systems, we as an operator have legal obligations to customers.”

Following the UK going a step further than Australia and requiring its telecommunications companies to remove Huawei from existing network infrastructure, Penn noted Telstra was the only company in Australia not using technology from a Chinese manufacturer in its networks.

The panel suggested increasing supply chain diversification, as well as increased local research and development, as a way of ensuring critical infrastructure companies were not reliant on a small pool of suppliers when one was deemed a cybersecurity risk or banned like Huawei.