Cybersecurity Capacity Building Research Articles

Evaluating the Impact of Cybersecurity Capacity Building

Evaluating the Impact of Cybersecurity Capacity Building

Evaluating the Impact of Cybersecurity Capacity Building

Evaluating the Impact of Cybersecurity Capacity Building

Structured Field Coding and its Applications to National Risk and Cybersecurity Assessments

Data on cybersecurity capacity building efforts is critical to improving cybersecurity at national levels. Policy should be informed not only by measures that allow internal assessment of strengths and weaknesses that enable cross-national comparisons. The International Telecommunications Union (ITU) and its Global Cybersecurity Index (GCI) has used a standardized survey that has been adapted and used in multiple national assessments by the Global Cyber Security Capacity Centre. This adaptation includes an addition of open field coding assessments that rely heavily on trained experts and interactions with national focus groups. These assessments are checked using multiple coders to increase reliability and reduce bias. This process of ‘structured field coding’ (SFC) is an approach to collecting and coding observations based on multiple methods, quantitative as well as qualitative. This approach differs from open field coding in providing a set structure for coding observations from the field based on established frameworks for assessment. The SFC process is explained along with a discussion of the origin and the advantages and limitations of this methodological approach. It can be used in a variety of studies but is presented here as a means to integrate data for cross-national comparative analyses. Its application to improving the reliability and validity of data collection across a region, such as the EU, would help stakeholders evaluate where they should invest resources to improve their cybersecurity capacity.

Interview with Will Middleton: The UK's approach to cyber security capacity building in a changing world

Interview with Will Middleton: The UK's approach to cyber security capacity building in a changing world

Evaluating Cybersecurity Capacity Building of ASEAN Plus Three through Social Network Analysis

The strategic rivalry between the United States and China is out in full swing in Southeast Asia. As the result, ASEAN is emerging both as a key player as well as a playground for pivotal global and regional actors. South Korea, Japan, and China known as ASEAN Plus Three, have strong economic, political, and technological ties with the region, and have leveraged their cyber capabilities to compete for influence in the region. This study evaluates the relative performances of the Plus Three’ cyber outreach efforts to the region by visualizing the complex web of actors and cyber cooperation and assistance activities with network analysis tools and open-source databases. We quantitatively analyze national cyber security cooperation of ASEAN including South Korea, Japan, and China through capacity building indicators and social network methodology. This study (1) analyzes cybersecurity cooperation in ASEAN Plus Three, (2) explores factors that influence cooperation, and (3) lays out a quantitative basis for establishing national information policy and cybersecurity strategy. We find that the Plus Three, despite the outward similarity in their respective regional strategies, are a study of contrasts, with one of them emerging as an influential yet silent power in the regional cyber diplomacy domain.

Cyber security training in Finnish basic and general upper secondary education

Cyber security in Finland is part of other areas of comprehensive security, as digital solutions multiply in society and technologies advance. Cyber security is one of the primary national security and national defense concerns. Cyber security has quickly evolved from a technical discipline to a strategic concept. Cyber security capacity building can be measured based on the existence and number of research and developments, education and training programs, and certified professionals and public sector agencies.
 Cybersecurity awareness and the related civic skills play an increasingly important role as our societies become more digitalized. Improving citizens' cyber skills through education is an important goal that would strengthen Finland as a country of higher education and expertise and lay the foundation for the society of the future.
 Pursuant to the Finland’s Cyber Security Strategy (2019) “National cyber security competence will be ensured by identifying requirements and strengthening education and research.” Finland’s Cyber Security Development Programme (2021) necessitates that in basic education ensures young people have sufficient skills to operate in a digital operating environment and that they understand cyber security threats and know how to protect themselves from them. So, cybersecurity is an important subject for everyone, not just industry or public organizations. It’s also vital for our children to understand how to stay safe online, and the need to be aware of any dangers that might come their way. Cybersecurity awareness training is important because it teaches pupils how they can protect themselves from cyber-attacks (MTC, 2021).
 The study of cybersecurity education in Finland was made in autumn 2021 and spring 2022 for the National Cyber Security Director. According to the study, measures are needed so that cyber security becomes an important aspect when planning education and teaching. There are different models to choose from to make training more effective. This paper presents the results of the research focusing basic and general upper secondary education.

Cybersecurity Crisscrossing International Development Cooperation: Unraveling the Cyber Capacity Building of East Asian Middle Powers Amid Rising Great Power Conflicts

Why do states aid other states' economic development? This has long been pondered in international relations (IR) and addressed by realism, humanitarian internationalism, and other theories. However, the recent establishment of cybersecurity capacity building (CCB) centers calls for a renewed investigation of the subject due to the nature of new digital technology. This article is particularly concerned with both the national security and economic development domains of CCB, because cybersecurity has become a critical national security concern for many nations and because internet-related technology has become essential for economic development, requiring its secure and safe operation. This paper argues that CCB, a new form of international development, has been pursued with disparate goals by different states, conditional upon the donor's surrounding international environment. With cases of CCB centers recently established by Japan and the Republic of Korea (ROK), this research demonstrates that while Japanese CCB efforts are aligned with Japan's national strategy, the ROK has approached CCB largely from the perspective of developmental assistance. The study suggests that academics uncover disparate rationales behind similar CCB activities, that potential recipients need to recognize the difference, and that foreign policymakers must recognize the versatile implications of CCB when internationally coordinating such efforts.

The Normative Enactment of International Cybersecurity Capacity Building Assistance: A Comparative Analysis on Japanese and South Korean Practices

The international community encourages states to embrace the international cooperation to support and assist each other in reducing risks stemming from the digital divide. However, they cannot agree upon how international norms apply to cyberspace, let alone shaping and regulating international cybersecurity capacity building (CCB) assistance. States use international CCB assistance to impose cyber-norms based on their perceptions. It results in different forms of assistance provided by each donor country. Using social constructivism theory and the CCB concept as international assistance, this paper compares the practice of CCB assistance from two donor countries: Japan and South Korea. It emphasises the role of each donor country’s normative structure in shaping their identities, roles, interests, and behaviours in international CCB assistance. Japan’s international cybersecurity cooperation normative structure shapes Japan’s identities and roles that prioritise security-dominant normative and material interests. Meanwhile, South Korea’s developmental focus constructs the country’s identities and roles that shape developmental normative and material interests. This research finds that Japan’s assistance is highly security-oriented while South Korea’s is less security-oriented. Their differences highlight the fragmentation of global cyber-norms caused by different perception processes.

Cybersecurity education, awareness raising, and training initiatives: National level evidence-based results, challenges, and promise

This paper assesses the impact of cybersecurity education, awareness raising, and training (CEAT) on the vitality of internet use and services at the national level. CEAT encompasses one of five dimensions of a larger cybersecurity capacity building model (CMM) that was developed by the Global Cybersecurity Capacity Centre. The paper describes this dimension of capacity building within the CMM, and its indicators of education, awareness, and training in cybersecurity capacity. The paper then presents a cross-national analysis of the outcomes of CEAT on internet use based on comparative data from 80 nations. Controlling for contextual variables, such as the wealth of the nations and scale of internet use, the analysis shows a positive and statistically significant impact of CEAT on the vitality of internet use and services, as well as a distribution of CEAT scores that indicates key issues for low-income and developing nations. A qualitative analysis of responses from these nations is used to identify key reasons for their levels of maturity in this area. While recognising key limitations of these findings, it offers suggestions for policy and practice to meet the need for effective programs for education, awareness raising, and training. In addition, the research suggests the need for more detailed indicators of CEAT initiatives in more nations and over time to assess the validity of the findings and the recommendations for policy and practice in this area of capacity building offered in this paper.

STRENGTHENING THE CYBER DEFENSE CENTER OF THE MINISTRY OF DEFENCE OF THE REPUBLIC OF INDONESIA (PUSDATIN KEMHAN) TO SUPPORT THE INDONESIAN DEFENSE DIPLOMACY IN CYBER DEFENSE SECURITY COOPERATION IN ASEAN

<div><p class="Els-history-head">The development of information technology in the international world impacts cyberspace, covering all aspects of national life. So, the government must understand the condition of cyber security in Indonesia and build a national defense system to overcome various threats that come through cyberspace. ASEAN has become one of the platforms for Indonesia to fight for its national interests to support national security in the cyber field. The purpose of this research is to analyze the efforts to strengthen the national defense system based on five aspects of cybersecurity capacity building to realize Indonesia's defense development in cyber defense security through the role of Cyber Defense Center as an actor in Indonesia's defense diplomacy in enhancing cyber defense security cooperation in ASEAN. These strategies and efforts were analyzed through a qualitative approach, and primary data were collected through interviews with informants from various government agencies. In addition, literature, journals, and related documents are also used as supporting data. These efforts resulted in an agreement in the form of making a cyber-portal between countries and equality of view to continue to conduct cybersecurity training in the form of seminars and workshops to build the capacity of the national defense system.</p></div>

Cybersecurity capacity building of human capital: Nations supporting nations

Capacity building of human capital can be described as the experience, knowledge, skill sets, and intangible assets that add economic value to individuals and the organizations they work for. With the ever-growing gap in cybersecurity skill sets, it is essential to have a shared understanding of the necessary current skills and what those skills represent in the form of human capital to not only individuals, but also the organizations they work for. As nations around the world are struggling with the increased dependencies on Information Systems (IS) and the massive cybersecurity incidents resulting from adversaries, it is evident that cybersecurity human capital is the key in overcoming such challenges. With that said, while major players fighting cyber adversaries such as the United States (U.S.) and other western nations are struggling with their own significant cybersecurity human capital shortage, less developed nations are even further challenged. For example, African nations continue to acquire and implement ISs, the pace in which these technologies are adopted outnumbers the rate at which the skills to protect these technologies are captured. In this study we introduce the concept of cybersecurity human capital at the national level in the African region, as well as specific steps necessary to develop and embed current cybersecurity skills in cybersecurity human capital. We discuss the challenges faced by Sub-Saharan African nations in the journey to develop their cybersecurity human capital at the national level. An overview of the programs developed by the U.S. Department of State’s Office of the Coordinator for Cyber Issues is provided across three case studies.

Understanding cybersecurity capacity building and its relationship to norms and confidence building measures

ABSTRACT International cybersecurity capacity building emerged in the mid-2000s as a mechanism for countries and organisations to assist each other, across borders, in protecting the safe, secure and open use of the digital environment. In parallel with this practical cooperation, the international community negotiated norms and confidence building measures to support peace and stability in cyberspace. The purpose of this paper is threefold. Having critiqued previous definitions and frameworks for cybersecurity capacity building, the paper proposes alternatives that both better represent actual practice and are of more use to the negotiations on stability in cyberspace. The proposed framework shifts capacity building beyond developed-developing country relationships and stresses the many goals that it serves. The paper then explores the relationship between cybersecurity capacity building, norms and confidence building measures. It contends that capacity building does not just support norms and confidence building measures, but is also an instance of them, and it benefits from norms of its own. The paper concludes by considering the proposals for cybersecurity capacity building principles that emerged from the 2019–2021 round of cyberspace diplomacy at the United Nations and by recommending the next steps.

The social and cultural shaping of cybersecurity capacity building: a comparative study of nations and regions

This paper presents an empirical study of the social and cultural aspects of cybersecurity capacity building in 78 nations. While nations within geographically defined regions might be expected to share similar attitudes, values, and practices around cybersecurity, this analysis finds that regional differences can be explained largely by cross-national differences in development and the scale of Internet use. These results question the centrality of regions in shaping social and cultural attributes directly tied to cybersecurity capacity. However, the analysis identifies some countries with greater and some with lesser levels of maturity in capacity building than expected only on the basis of their development and scale of Internet use. Further research focused on the dynamics of under- and over-performance of different nations might illuminate where regional contexts could place a brake on, or provide an impetus for, under- or over-performance in cybersecurity capacity building. That said, national development and the scale of Internet use are the most explanatory of cultural attitudes, values, and practices of societies tied to cybersecurity, such as trust on the Internet.

Cybersecurity Capacity Building: Cross-National Benefits and International Divides

The growing centrality of cyber-security has led many governments and international organizations to focus on building the capacity of nations to withstand threats to the online security of the public and its digital resources. These initiatives entail a range of actions that vary from education and training, to technology and related standards, as well as new legal and policy frameworks. While efforts to proactively address security problems are intuitively valuable, there is a lack of evidence on whether they achieve their intended objectives. This paper takes a cross-national comparative approach to determining whether there is empirical support for investing in capacity building. Marshalling field research from 73 nations, the comparative data analysis: 1) describes the status of capacity building across the nations; 2) determines the impact of capacity building when controlling for other key contextual variables that might provide alternative explanations for key outcomes; and 3) explores the factors that are shaping national advances in capacity building. The analysis underscores a relatively low, formative status of cyber-security capacity in most of the nations studied, but also shows that relatively higher levels of maturity translate into positive outcomes for nations. The analysis also reveals a capacity divide between countries based on income levels, that reinforces economic divides. The study provides empirical support to international efforts aimed at building cyber-security capacity, and mitigating gaps based on the wealth of nations.

Cybersecurity Capacity: Does It Matter?

Abstract National cybersecurity capacity building involves the development of managerial, technical, social, legal, policy, and regulatory initiatives by a growing ecology of actors to enhance the resilience of nations to cybersecurity breaches, cybercrime, and terrorism. Capacity building is therefore resource intensive, requiring attention across sectors of society, ranging from governments to Internet users. However, it is difficult to justify commitments to capacity building when the benefits of building national cybersecurity capacity are largely based on logical reasoning, limited case studies, anecdotal evidence, and expert opinion rather than systematic empirical evidence. To explore the value of capacity building, this article reports on the early phase of a systematic effort to bring together cross-national data from multiple sources to examine whether indicators related to the cybersecurity capacity of a nation help explain the experiences of Internet users—one of the final payoffs of cybersecurity capacity building.

Cybersecurity Capacity: Does It Matter?

Abstract National cybersecurity capacity building involves the development of managerial, technical, social, legal, policy, and regulatory initiatives by a growing ecology of actors to enhance the resilience of nations to cybersecurity breaches, cybercrime, and terrorism. Capacity building is therefore resource intensive, requiring attention across sectors of society, ranging from governments to Internet users. However, it is difficult to justify commitments to capacity building when the benefits of building national cybersecurity capacity are largely based on logical reasoning, limited case studies, anecdotal evidence, and expert opinion rather than systematic empirical evidence. To explore the value of capacity building, this article reports on the early phase of a systematic effort to bring together cross-national data from multiple sources to examine whether indicators related to the cybersecurity capacity of a nation help explain the experiences of Internet users—one of the final payoffs of cybersecurity capacity building.

The Necessity and Pitfall of Cybersecurity Capacity Building for Norm Development in Cyberspace

This this paper positions cybersecurity capacity building in the realm of the debate on international norms. It is argued that cybersecurity capacity building on the one side is a necessity to make adherence to discussed norms feasible. On the other side, it can serve as a tool for fostering donor state’s interests in recipient states. The latter can lead to cybersecurity capacity building measures being used to foster geopolitical interests. As a result, rather than advancing the effort to agree on international norms and make adherence possible, it might lead to a fragmentation of norms and different understandings of these norm’s contents.

Collaborative Approaches to a Wicked Problem: Global Responses to Cybersecurity Capacity Building

Collaborative Approaches to a Wicked Problem: Global Responses to Cybersecurity Capacity Building

Politics of cybersecurity capacity building: conundrum and opportunity

ABSTRACTA rapidly increasing uptake of Information and Communication Technologies across the globe, coupled with the uneven levels of readiness of societies to address security challenges associated with this process, has pushed the international community to deal with potential ‘safe havens’ and ‘weakest links’ around the world. Capacity building emerged in international cybersecurity debates as a possible remedy to this problem, also advocated by developing countries and emerging economies, thereby opening the cybersecurity policy community to development actors as well. The purpose of this article is twofold. By presenting conceptual underpinnings of cybersecurity capacity building (CCB), it aims to improve a general understanding of dilemmas and politics associated with its actors, drivers and processes. At the same time, by taking a critical view on the current pace and practice of capacity building in this field, it attempts to inject a more strategic reflection about the process. The article concludes by proposing some ideas for moving forward in establishing a strong CCB community. It highlights the need for institutional investment in ‘cyber knowledge brokers’ at all levels of government and across policies as well as the emergence of a principle-based approach to capacity building in cyberspace with a sustainable outlook towards closing the ‘cyber capacity gap’.

Best Practice for Cybersecurity Capacity Building in Bulgaria’s Public Sector

Best Practice for Cybersecurity Capacity Building in Bulgaria’s Public Sector