Cybersecurity Capacity Research Articles

Report on Cybersecurity Maturity Level in Albania

At the invitation ofthe National Authority for Electronic Certification and Cyber Security (AKCESK) and in collaboration with World Bank (WB) the Global Cyber Security Capacity Centre (GCSCC) has conducted a review of cybersecurity capacity of Albania.The objective of this review was to enable Albania to determine areas of capacity in which the government might strategically invest in, in order to improve their national cybersecurity posture.

Cybersecurity Capacity Review Independent State of Samoa

In collaboration with the International Telecommunication Union (ITU), the Global Cyber Security Capacity Centre (GCSCC, or ‘the Centre’) together with its regional partner, the Oceania Cyber Security Centre (OCSC) undertook a review of the maturity of cybersecurity capacity in the Independent State of Samoa at the invitation of the Ministry of Communications and Information Technology (MCIT). The objective of this review was to enable the government of Samoa to benchmark national cybersecurity capacity and set priorities for strategic investment and capacity development. Over the period 18-20 April 2018, the following stakeholders participated in roundtable consultations: academia, criminal justice, law enforcement, information technology officers and representatives from public-sector entities, critical-infrastructure owners, policy makers, information-technology officers from the government and the private sector (including financial institutions), the banking sector, as well as international partners.

Reviewing National Cybersecurity Strategies

The damages caused by cyber-attacks are becoming larger, broader and more serious and to include monetary losses and losses of lifeline. Some cyber-attacks are arguably suspected to be parts of national campaigns. Under such circumstances, the public sector must endeavour to enhance the national cybersecurity capacities. There are several benchmarks for national cybersecurity, i.e., a snapshot relative assessment of a nation’s cybersecurity strength at a global level. However, by considering the development of technology, attackers’ skills and capacities of other nations, we believe that it is more important to review the national strategy for cybersecurity capacity enhancement and to ensure that the national capacity advances adequately in the coming years. We propose a method of reviewing national strategies. Additionally, we performed a trial review of the Japanese cybersecurity strategy using the Cybersecurity Capacity Maturity Model for Nations (CSCMMN) developed by the Global Cyber Security Capacity Centre. This trial proved to be workable because it detected various possibly inadequate (insufficient, inappropriate or inefficient, although further investigation is needed) approaches in the Japanese strategy. Moreover, the review also discovered the shortcomings of the capacity areas in the CSCMMN. We plan to improve the reviewing method and develop the improvement process of national strategies for cybersecurity capacity enhancement.

Cybersecurity Capacity Review Bangladesh

In collaboration with NRD Cyber Security (NRD CS), the Global Cyber Security Capacity Centre (GCSCC, or ‘the Centre’) undertook a review of the maturity of cybersecurity capacity in Bangladesh at the invitation of the Bangladesh Computer Council (BCC). The objective of this review was to enable Bangladesh to gain an understanding of its cybersecurity capacity in order to strategically prioritise investment in cybersecurity. Over the period 2-4 July 2018, the following stakeholders participated in roundtable consultations: academia, criminal justice, law enforcement, information technology officers and representatives from public sector entities, critical infrastructure owners, policy makers, information technology officers from the government and the private sector (including financial institutions), telecommunications companies and the banking sector. Remote follow-up interviews were conducted with representatives from civil society and international partners.

A comprehensive security approach: bolstering Finnish cybersecurity capacity

ABSTRACTFinland, at the easternmost border of the European Union (EU), has set itself apart as a global leader in cybersecurity technology. Yet, despite Finland’s relative technological strength in this space, the government has actively intervened in the market in order to bolster cybersecurity capacity and competency. Why? There is an important distinction between the presence of technological expertise and a strategy for the security of society writ large, the latter of which necessitates resilient critical infrastructure and services within a country. To this end, the government has utilised a pre-existing logic for market intervention: Finland’s geopolitical position and its corresponding defence doctrine’s emphasis on defence of society by maintaining society-wide resilience in the event of a crisis. In comprehensive security (kokonaisturvallisuus), which includes cybersecurity, the responsibility for and the safeguarding of the vital functions of society are jointly held by private and public actors, industry and government, defence forces and citizens. Notably, given this focus on industry and civil society’s role within the provision of security, Finland’s approach provides an institutional foundation that is well suited to the realities of addressing cybersecurity at the national level.

Collaborative Approaches to a Wicked Problem: Global Responses to Cybersecurity Capacity Building

Collaborative Approaches to a Wicked Problem: Global Responses to Cybersecurity Capacity Building

Cybersecurity Capacity Review Former Yugoslav Republic of Macedonia (FYR Macedonia)

Cybersecurity Capacity Review Former Yugoslav Republic of Macedonia (FYR Macedonia)

Cybersecurity Capacity Review Republic of Lithuania

The Global Cyber Security Capacity Centre (GCSCC, or ‘the Capacity Centre’) has facilitated a review of the maturity of cybersecurity capacity of the Republic of Lithuania, hosted by Vilnius University and NRD Cyber Security. The objective of this review is to enable the government of Lithuania to reassess its cybersecurity capacity in order to prioritise strategic investment in national cybersecurity. From 24-26 April 2017, stakeholders from the following sectors participated in a series of consultations with GCSCC research and analysis staff: government departments and ministries, legislators and policy owners, criminal justice, defence, academia, as well as the private and financial sectors.

Cyber Security Capacity: Does It Matter?

It is assumed that the benefits of building national cyber security capacity are widespread, largely based on common sense, limited case studies, anecdotal evidence, and expert opinion. This paper reports on the early phase of a systematic effort to bring together cross-national data from multiple sources to examine indicators related to the cyber security capacity of a nation. We use these to determine if capacity matters – does it translate into conditions affecting end users of the Internet. Using data from approximately 120 countries, a multivariate analysis of indicators related to national cyber security capacity are shown to have had a strong impact in lowering end-user security problems. The sources for this analysis include data collected for the World Economic Forum Network Readiness Index, the World Bank, Internet World Statistics, and Microsoft, which are openly available. The results of this study reinforce the case that building cyber security capacity is a worthwhile investment, while also raising important issues around global inequalities in the ability to build greater cyber security capacity. The analysis also points to ways in which the data and analyses can be refined, such as through gathering more direct indicators of capacity-building efforts, such as those being developed by the GCSCC at Oxford University.

Politics of cybersecurity capacity building: conundrum and opportunity

ABSTRACTA rapidly increasing uptake of Information and Communication Technologies across the globe, coupled with the uneven levels of readiness of societies to address security challenges associated with this process, has pushed the international community to deal with potential ‘safe havens’ and ‘weakest links’ around the world. Capacity building emerged in international cybersecurity debates as a possible remedy to this problem, also advocated by developing countries and emerging economies, thereby opening the cybersecurity policy community to development actors as well. The purpose of this article is twofold. By presenting conceptual underpinnings of cybersecurity capacity building (CCB), it aims to improve a general understanding of dilemmas and politics associated with its actors, drivers and processes. At the same time, by taking a critical view on the current pace and practice of capacity building in this field, it attempts to inject a more strategic reflection about the process. The article concludes by proposing some ideas for moving forward in establishing a strong CCB community. It highlights the need for institutional investment in ‘cyber knowledge brokers’ at all levels of government and across policies as well as the emergence of a principle-based approach to capacity building in cyberspace with a sustainable outlook towards closing the ‘cyber capacity gap’.

Best Practice for Cybersecurity Capacity Building in Bulgaria’s Public Sector

Best Practice for Cybersecurity Capacity Building in Bulgaria’s Public Sector

Cybersecurity Capacity Review of the Republic of Madagascar

In collaboration with the International Telecommunication Union (ITU), the Global Cyber Security Capacity Centre (GCSCC, or ‘the Centre’) was invited to undertake a review of the maturity of cybersecurity capacity in the Republic of Madagascar. The review was hosted by the Agency for Regulation of Technology and Telecommunication (Autorite de Regulation des Technologies de Communication), ARTEC. The objective of the review was to enable the Republic of Madagascar to gain an understanding of its cybersecurity capacity in order to develop an investment strategy for the development of Madagascar’s cybersecurity capacity. Between 24th and 26th August 2016, stakeholders from the following sectors participated in roundtable consultations: public sector entities, academia, civil society, legislators and policy makers, information technology officers from government and the private sector, Internet Service Providers and the banking sector.

Cybersecurity Capacity Review: Republic of Sierra Leone

Through collaboration with the International Telecommunications Union (ITU), the Global Cyber Security Capacity Centre (GCSCC, or ‘the Centre’) has facilitated a review of the maturity of cyber-security capacity of the Republic of Sierra Leone, hosted by the Ministry of Information and Communications. The objective of this review is to enable the Republic of Sierra Leone to gain an understanding of its cyber-security capacity in order to strategically prioritize further investment in capacities. Between 29th June and 1st July 2016, stakeholders from the following sectors participated in round-table consultations: government departments and ministries, academia, civil society, legislators and policy owners, diplomatic missions, Information Technology leaders from government and the private sector, Internet Service Providers and the banking sector.

Cyber Harm: Concepts, Taxonomy and Measurement

Coherent, adaptable and durable cybersecurity capacity-building requires a comprehensive and in-depth understanding of harms that can be caused by cyber-events. At the national level, the avoidance and reduction of harm is a central feature in all efforts to develop cybersecurity policy, strategy and capacity. This article offers a taxonomy of cyber harm, which enables a better understanding of how harm is manifested within and outside of cyberspace, and proposes an initial set of metrics and methods to assess cyber harm in national contexts. Based on this framework, a national Cyber Harm Model (CHM) would form the basis for a comprehensive and durable cybersecurity policy by contextualising and validating cybersecurity capacity research that has resulted in the development of the National Cybersecurity Capacity Maturity Model (CMM).

Cybersecurity Capacity Review of the Republic of Senegal

Through collaboration with the Dutch Government under the auspices of the Global Forum on Cyber Expertise (GFCE), the Global Cyber Security Capacity Centre (GCSCC) has conducted a review of cybersecurity capacity maturity in the Republic of Senegal, supported by the national host team from the Ministry of Post and Telecommunications. The objective of this exercise is to enable the government to prioritise areas of capacity in which the country might strategically seek invest in order to improve their national cybersecurity posture.

Cybersecurity Capacity Review of the United Kingdom

At the invitation of the government of the United Kingdom, the Global Cyber Security Capacity Centre (GCSCC) has conducted a review of cybersecurity capacity in the UK, supported by the host team (Office of Cyber Security and Information Assurance within the Cabinet Office – OCSIA). The objective of this review is to enable the UK to determine areas of capacity in which the government might strategically invest in order to become more cyber secure. The GCSCC review will contribute to the development of the UK National Cybersecurity Strategy 2016–2020.

Building Cyber-security Capacity in the Kingdom of Bhutan

The Kingdom of Bhutan is undergoing a major shift with regards to its technological infrastructure. The government is updating its ICT Roadmap by June of this year, exploring an alternate submarine cable connection through Bangladesh and a new payment gateway, and is considering establishing a national data centre, among other initiatives. However, as Bhutan increases national investment into its ICT infrastructure, the risk of inadequate security mechanisms to protect these technologies simultaneously increases as well. It is important to understand the cybersecurity capacity in Bhutan in order to invest effectively in both security and new technologies.Through a Collaboration Agreement with The World Bank, The Global Cyber Security Capacity Centre has facilitated a self-assessment of cybersecurity capacity in the Kingdom of Bhutan. The objective of the self-assessment is toenable Bhutan to determine the areas of capacity the country might strategically invest in to become more cyber secure.

Cyber Security in the Gulf Cooperation Council

The Internet is one of the fastest growing areas of infrastructure development in the union of the Cooperation Council for the Arab States of the Gulf commonly referred to as Gulf Cooperation Council (GCC). It is clear that the adoption of Information and Communication Technologies (ICTs) worldwide has helped to quicken communication and facilitate the exchange of information. The number of Internet users and Internet-enabled technological devices is increasing exponentially, including an estimated 40 million Internet users within the area of the GCC that continues to grow. It considers the fastest growing and most economically competitive region in the world. This growth is largely fuelled by oil although the region is also becoming an increasingly popular destination for local and international tourists. This trend is set to continue with upcoming global events such as the Abu Dhabi and Bahrain Grand Prix, the Expo 2020 in Dubai and the FIFA World Cup in Qatar in 2022.As the Internet grows and reaches most aspects of society, staying up-to-date with effective security measures and ensuring online safety remains a challenge. For example, modern cars are effectively computers, and many of which are connected to the Internet. These computing devices embedded in everyday life bring about new risks. In addition, the cybercrime landscape has evolved considerably over the past decade becoming more sophisticated with an increasing diversification of organizational forms of criminal actors. Failure to understand the impact of cybercrime and the threats pose to economy, national security, and the critical infrastructure; will leave GCC states vulnerable to all cyber-attacks and easy targets. There is now evidence of malicious actors that work alone, within cohesive group structures and as larger ephemeral online communities. In addition, vectors used to perpetrate cyber crime are constantly evolving due in part to innovative tactics of criminals which continues to evolve. Attacks typically occur unbeknown to the victims and through processes that guarantee anonymity to malicious actors. For example, many cyber-attacks are propagated through networks of compromised computers and intermediary systems masking the identity, which in certain cases make it difficult to identify the source and intention of cybercrime. The countries of the GCC share culture, and political, geographic and socio-economic interests. As “communities of shared fate”, all Internet-connected nations are at the mercy of online threats. Yet, mechanisms to respond to such activity have been reactive at best with a deficiency of crime prevention efforts. A major block to the effective control of cyber crime is its transnational characteristic. Cyber attacks occur across borders, and perpetrators and their victims are rarely located in the same jurisdiction. Cyber criminals have also taken advantage of safe haven countries - states that lack Internet crime-related legislation and the capability to enforce them. In 2014, the World Summit on the Information Society (WSIS) 10 High Level Event in Geneva, co-organised by ITU, UNESCO, UNCTAD and UNDP, highlighted the significant risks posed by insufficient responses to cyber security. As connectivity develops cyber security must be recognised as a major threat for the Middle East.One approach to curtail malicious activities has been through international frameworks. For example, the Council of Europe (CoE) Convention on Cybercrime, known as the Budapest Convention, is an international treaty that provides a comprehensive international approach to cybercrime investigation and law. The Convention formalises mutual legal assistance arrangements between jurisdictions and primarily includes European states, as well as a number of non-European states such as the USA, Japan, Australia and Canada. However, as of March 2015, no countries among the GCC have joined the Convention. Also there is no treaty or cooperation between the GCC states on cybercrime.Among the six GCC countries, Qatar and Oman are the only two to have developed technical, organisational and legal measures to address cybercrime (Table 1). Other countries are working on these measures but still lack capacity to address cyber issues. The following four main recommendations offer some avenues to increase cyber security capacity in the GCC: 1 - Create a national (and regional) cyber awareness initiative 2 - Establish a centralised mechanism to share information, assets and expertise with GCC states and abroad3 - Establish technical standards to combat cyber crime through a national (and regional) framework4 - Engage in international police and judicial cooperation, for example, by signing the Budapest Convention.

China-Asean Relations, September 2013 to December 2013: Chronology of Events

China-Asean Relations, September 2013 to December 2013: Chronology of Events WU Dan (bio) As a research institute based in Singapore, the EAI monitors developments in relations and interactions between China and the individual countries of Southeast Asia as well as the ASEAN grouping as a whole. This material is presented in the form of (1) a chronology of events, and (2) important documents. —the Editors September 2013 2nd The ASEAN-China Transport Ministers’ Special Meeting on Connectivity is held on the sidelines of the 10th China-ASEAN Expo in Nanning, China. China’s Minister of Transport of Yang Chuantang and Lao PDR Minister of Public Works and Transport Sommad Pholsena co-chair the meeting, which sees in-depth discussions on transport connectivity and constructive exchanges of views and ideas between transport ministers of ASEAN and China and representatives from the industry. The ministers consider it opportune to continue to build upon the existing collaborative mechanisms to deepen transport connectivity cooperation as both China and ASEAN member states are working to upgrade the ASEAN-China Free Trade Area and advance negotiations on the “Regional Comprehensive Economic Partnership”. In this connection, the ministers have reached the following consensus: (i) to optimise the working mechanism; (ii) to consider establishing a financing platform; (iii) to dovetail with the connectivity master plans of both sides; (iv) to encourage the participation of enterprises in the connectivity cooperation; (v) to strengthen maritime transport connectivity; (vi) to strengthen air connectivity; and (vii) to maintain a balanced development. 3rd Chinese Premier Li Keqiang delivers his keynote speech titled “Bring the China-ASEAN Strategic Partnership of Long-Term Friendship and Mutually Beneficial Cooperation to a New High” at the 10th China-ASEAN Expo and China-ASEAN Business and Investment Summit in Nanning, China. Li stresses that China and ASEAN need to deepen and upgrade pragmatic cooperation, and push for new progress in the strategic partnership. To this end, Li proposes the following for cooperation: (i) to build an upgraded version of the China-ASEAN Free Trade Area (CAFTA); (ii) to promote connectivity; (iii) to enhance financial cooperation; (iv) to carry out maritime cooperation; and (v) to increase people-to-people exchange. 4th China and Singapore hold the Senior Officials Meeting of Joint Committee of Bilateral Cooperation, co-chaired by China’s Vice Foreign Minister Liu Zhenmin and Singapore’s Permanent Secretary of the Ministry of Trade and Industry Ow Foong Pheng. 11th The East Asia Summit (EAS) Senior Officials Meeting is held in Bandar Seri Begawan, Brunei, and officials from 18 countries, including the 10 ASEAN countries, Australia, China, India, Japan, the Republic of Korea, New Zealand, Russia and the United States, attend the meeting. Chinese Vice Foreign Minister Liu Zhenmin leads a delegation to attend the meeting. The senior officials exchange views mainly on the preparation work for the Eighth EAS in October and have reached broad consensus. All parties agree that as a strategic forum “led by the leaders”, the EAS has carried out very productive dialogue and cooperation in major regional and international issues of common concern, enhanced mutual understanding and trust, and promoted the process of regional cooperation in East Asia, since its establishment. The ASEAN-China, Japan, Republic of Korea (10+3) Senior Officials’ Meeting is held on the same day in Bandar Seri Begawan, Brunei. The parties agree to take the ASEAN plus three Leaders’ Meeting as an opportunity to fully review the cooperation in various fields and to plan for the future development, promoting the ASEAN plus three cooperation to a new level. 11th–12th The ASEAN Regional Forum (ARF) Workshop on Measures to Enhance Cyber Security—Legal and Cultural Aspects, which is jointly hosted by China and Malaysia, is held in Beijing. This is the first time that China hosts a workshop on cyber security under the ARF framework. Government officials, experts and scholars from ASEAN countries, Japan, the Republic of Korea, Russia, the US, Canada, Australia and the European Union, as well as officials from the ASEAN secretariat, the United Nations Office on Drugs and Crime (UNODC) and other representatives attend the workshop. In-depth discussions revolve around the latest development in cyber security and regional practice, cyber security capacity...