National Cybersecurity Strategy Research Articles

POLITICAL VISIONS OF CYBER EDUCATION

This article is the first to analyze the political visions of the new US National Cybersecurity Strategy in terms of cyber education, which in the current security situation is becoming a kind of habitus of the global information space and launches a new long-term policy of the key Ukrainian international partnership in harmonizing security approaches. The identification of new priorities in both the global and national security environment focuses the attention of the US Strategy on a comprehensive and coordinated approach of public policy towards expanding access to cyber education to meet the needs for cybersecurity expertise in all sectors of the economy to continue to innovate in secure and sustainable next-generation technologies. It is determined that the need to actualize the problem of training modern cybersecurity specialists is due to the exponential global digitalization, which has increased the need for training cybersecurity specialists in various spheres of society. It is proved that the state strategic documents on cybersecurity pay attention to the reform of cyber education through the updating and approval of professional standards, which are the basis for improving educational programs and introducing new modern specializations. It has been found that the NATO DEEP program in Ukraine continues to adapt military education to NATO requirements, where cyber awareness of a military specialist in the new model of military education becomes a priority feature of his professionalism. The analysis of the implementation of the cyber literacy program showed that there is a huge demand for various cyber hygiene measures to protect young people from the destructive effects of disinformation and manipulative information in cyberspace, taking into account the emergence of new cyber threats and challenges.

A Matter of Checks and Balances

The sanitary survey program was created by the US Environmental Protection Agency (EPA) to support state primacy agencies in assessing utility progress with implementing water quality requirements in the Ground Water Rule and the Interim Enhanced Surface Water Treatment Rule. In the spring of 2021, EPA said it was planning to issue a direct file rule to integrate cybersecurity into the existing sanitary survey program. Multiple organizations representing water utilities and state primacy agencies communicated to EPA that using the sanitary survey program for cybersecurity was ill-advised. Even so, on March 3, 2023, EPA issued the “Cyber Rule” directing state primacy agencies to assess cybersecurity of public water systems (PWSs) as part of the sanitary survey program—effective immediately. The new Cyber Rule requires all PWSs (n = 151,606) to determine whether they use “operational technology,” meaning hardware and software that detect or cause a change through the direct monitoring or control of physical devices, processes, and events in the enterprise, per the Internet of Things Cybersecurity Improvement Act of 2020, 15 U.S.C. § 271(3)(6). EPA provided states with three compliance options: (1) self-assessment or third-party assessment by a state-approved entity; (2) state assessment during a sanitary survey; or (3) an alternative, equivalent, state-developed cybersecurity program. The draft guidance for the Cyber Rule includes a checklist of 33 controls that EPA determined are “technically feasible for most PWS[s] to address without significant capital expenditures.” Sixteen of these controls are classified by EPA as potential “significant deficiencies” if not implemented. There are numerous implementation challenges, including the ability of a state official to nonintrusively verify that a control has been implemented. The Cyber Rule interprets the use of operational technology as being part of the equipment or operations examined in the sanitary survey, components used for producing and distributing safe drinking water. This represents a significant expansion of the states’ existing sanitary survey inspection obligations. The details of the rule were never proposed or made available for public review and comment, which is the norm under the Administrative Procedures Act (APA). While EPA did have discussions with states in the summer of 2022, the Association of State Drinking Water Administrators has consistently advised the agency against using the sanitary survey for addressing cybersecurity. Bypassing APA and other regulatory obligations represents a troubling process issue that undermines the integrity of the rule of law. This includes EPA's determination that the regulatory oversight approach set out by Congress in §2013 of America's Water Infrastructure Act (AWIA) of 2018 was, in the administrator's judgment, insufficient. AWIA §2013 amended the Safe Drinking Water Act (SDWA) §1433 to require each community water system serving 3,300 or more people to conduct a risk and resilience assessment (RRA) at least every five years, which explicitly encompass cybersecurity threats to “electronic, computer, or other automated systems.” Further, §2013 requires systems to incorporate the findings of the RRA into emergency response plans, which must address the “strategies and resources to improve the resilience of the system, including the physical security and cybersecurity of the system.” Congress clearly defined a process by which a specific class of PWSs would address cybersecurity. Finally, Congress instructed EPA to directly implement, oversee, and enforce AWIA §2013. Unlike other SDWA requirements, AWIA does not authorize the EPA to delegate implementation to the states. Contrary to congressional direction, the Cyber Rule shifts the burden of oversight to the state. Many of these procedural concerns were shared with EPA in a January 2023 letter from the water community. Undeterred, EPA proceeded with issuing the Cyber Rule. Subsequently, on April 17, the states of Missouri, Arkansas, and Iowa filed a challenge to the Cyber Rule in the US Court of Appeals for the Eighth Circuit, State of Missouri, et al. v. EPA, et al., No. 23-1787 (8th Cir.). AWWA and the National Rural Water Association have filed to intervene on behalf of the states. The intent of the challenge is to hold EPA accountable for going around the checks and balances created to govern the promulgation of regulations. Perhaps watching the “Three Ring Government” episode from Schoolhouse Rock! is in order since it explains the balance of power between the three branches of government. The judiciary is a last resort for accountability; it is unfortunate that the public–private collaboration called for in the National Cybersecurity Strategy was not exercised. Kevin M. Morley is manager of federal relations at the AWWA Government Affairs Office in Washington, D.C. He can be reached at [email protected].

Origins of Cyberwarfare: How the Internet got Weaponized

Cyberspace was until last decade and half a perfect additional intelligence gathering tool. Within a phase of time during the spread of the world wide web, the cyberspace expanded outside the boundaries of intelligence gathering to a perfect weapon in the hands of both state and non-state actors for destabilizing or devastating the state of critical infrastructures of perceived enemy or competitors. In the heart of the storm, Social Scientists have either focused on extensive definitions and clarifications of cyberwar, others are fixated on explaining the various emerging dangers of cyber weapons on society, like the consequences of weaponizing the cyberspace against a nation’s power grid, nuclear command, and control systems, neutralizing a petrochemical plant, paralyzing a government’s health care or governance structure and possibilities of manipulating elections. But few, if any have considered the question which is central to this paper: How did the cyberspace evolve from an intelligence tool to a cyberweapon against critical infrastructures? The obvious answer is that the magnified global access and use of networked systems provided the perfect battle space for deploying cyberweapons. The preceding explanation is essentially correct, but it is entirely lacking in detail explaining how cyberspace became weaponized? Under what conditions was cyberspace purely an intelligence tool. Under what conditions is cyberspace weaponized? This research incorporates these and other questions into a framework through the means of a model designed to aid understanding of how the cyberspace evolve from an intelligence tool to a destructive weapon targeted at critical infrastructures. Primary sources include relatively untapped 107 Congress Laws on Cyber related legislations. From the 105th congress to the current 116th congress, 1, 177 legislations have been introduced on cyber or cyber related issues. Other primary sources include White House fact sheets, statements, press releases, President Trump’s 2018 National Cyber Security Strategies, President Obama’s 2016 Cyber Security National Action Plan, and cyber related executive orders, statements, and press releases from President Johnson of the last 5 US administrations.

What Senior U.S. Leaders Say We Should Know About Cyber

On April 6, 2023, the Atlantic Council’s Cyber Statecraft Initiative hosted a panel discussion on the new National Cybersecurity Strategy. The panel featured four senior officials from the Office of the National Cyber Director (ONCD), the Department of State (DoS), the Department of Justice (DoJ), and the Department of Homeland Security (DHS). The author attended and asked each official to identify the most important elements that policymakers and strategists must understand about cyber. This article highlights historical and recent struggles to express cyber policy, the responses from these officials, and the author’s ongoing research to improve national security cyber policy.

Preparing for future cyber crises: lessons from governance of the coronavirus pandemic

The SARS-CoV-2 pandemic has had an immense impact on public policy and the management of risks that threaten critical systems, such as national health services. Drawing on perspectives from multiple disciplines, this article considers lessons-learned with respect to mitigating the threats to critical systems and societal harms presented by the proliferation of malware. The article dovetails crisis management with cyber resilience, for the purpose of analyzing transferable good-practices and areas-for-improvement, drawing on preparedness and response strategies deployed in public policymaking in the United Kingdom during the pandemic. Reflecting on key national and local ransomware incidents that have impacted key services, the article offers a post-SARS-CoV-2 review of recent British strategic outputs with respect to cyber resilience; most notably the National Cyber Security Strategy and the Government Cyber Security Strategy. The article focuses on lessons that may be learned with respect to communications strategies. The article argues that although the recent British cyber-security strategies hold significant promise in terms of improving preparedness, response and recovery in relation to future cyber crisis, nuanced, dynamic and empathetic multi-stakeholder engagement will be required in order to meaningfully implement the measures outlined in the strategy documents.

Information Systems Strategy and Security Policy: A Conceptual Framework

As technology evolves, businesses face new threats and opportunities in the areas of information and information assets. These areas include information creation, refining, storage, and dissemination. Governments and other organizations around the world have begun prioritizing the protection of cyberspace as a pressing international issue, prompting a renewed emphasis on information security strategy development and implementation. While every nation’s information security strategy is crucial, there has not been much work conducted to define a method for gauging national cybersecurity attitudes that takes into account factors and indicators that are specific to that nation. In order to develop a framework that incorporates issues based on the current research in this area, this paper will examine the fundamentals of the information security strategy and the factors that affect its integration. This paper contributes by providing a model based on the ITU cybersecurity decisions, with the goal of developing a roadmap for the successful development and implementation of the National Cybersecurity Strategy in Greece, as well as identifying the factors at the national level that may be aligned with a country’s cybersecurity level.

Out with the old, in with the new: examining national cybersecurity strategy changes over time

ABSTRACT The development and implementation of a national cybersecurity strategy (NCS) is becoming increasingly common for countries around the world that seek to define an approach for addressing their cybersecurity risks. Although past research has sought to classify the individual characteristics contained within an NCS, it remains unclear how the core content within a strategy evolves over time in the face of new cyberthreats and fluctuating priorities. By better understanding such changes (and their underlying drivers), policymakers can be increasingly attuned to essential NCS updates and citizens can more readily evaluate the adequacy of their country’s plans. This study examines multiple NCS versions in Canada, the United Kingdom and Australia using a qualitative, content analysis approach. Our results point to four core themes that characterise NCS stability and change over time. Based on our observations, we articulate several theoretical propositions and outline a plan for future research.

ФОРМУВАННЯ СИСТЕМИ КІБЕРЗАХИСТУ ДЛЯ ІНТЕГРОВАНОЇ ГАЛУЗЕВОЇ ІНФОРМАЦІЙНОЇ СИСТЕМИ УКРАЇНИ СЕКТОРУ НАЦІОНАЛЬНОЇ КІБЕРБЕЗПЕКИ

This The article is devoted to the disclosure and elucidation of the envisaged composition, structure of measures and tools that will be part of a comprehensive system of protection of industry-integrated MIS in the national cybersecurity sector. The article also describes the specifics and strategic value of the involved resources, which will be operated by the established system of cybersecurity. It is noted that the industry-integrated cyber defense MIS envisages the use of a set of interconnected means and measures, the implementation of which is necessary and sufficient for the full protection of industry-integrated MIS to counter external unauthorized access, etc. Emphasis is placed on the compliance of the envisaged cybersecurity system with international criteria and standards of protection of such control systems for NATO countries, in particular, the US Department of Defense cybersecurity standard (TCSEC also known as "Orange Book"); with international criteria and standards for the protection of similar control systems for other leading countries, in particular, the international technical standard ISO/IEC 15408 "General criteria for assessing IT security", which has been ratified by most leading countries; with guidelines and recommendations of the International Organization NCSS (National Cyber Security Strategies) for NATO Partner countries, as set out in the National Cyber Security Strategy and developed by international national cybersecurity experts, scholars and European international cybersecurity advisers in the context of NATO's "Science for Peace and Security (SPS) Programme"; with national technical standards of Ukraine. The article also presents in detail the full range of mandatory resources and tools for the cybersecurity of designed industry-integrated MIS in the national cybersecurity sector, which include five levels of cybersecurity (organization, software, hardware, engineering, additional physical level).

National Cybersecurity Strategy 2023

In the modern world, a country’s cyberspace plays a decisive role in ensuring national security. The last US Cybersecurity Strategy was released in 2018, and on March 2, 2023, the Biden administration released the New US National Cybersecurity Strategy. This document represents the detailed planned goals and objectives of the United States in cyberspace until 2030.

The role of the Cybersecurity Strategy of the Republic of Poland in ensuring cybersecurity

Cybersecurity belongs to the area of activity of state and supra-state actors, giving direction to national and international systems of law as components of national and supranational systems of political, economic, military cooperation, etc. Still, the state has a monopoly on the causality of lawmaking, which forms the basis of cyberspace use security activities. The state responds to national security needs by actively participating in the formation of the collective security order of the supranational level. The aim of this paper is to demonstrate the significance of the national Cybersecurity Strategy of the Republic of Poland for ensuring the safe use of cyberspace. The Strategy, while referring to the national order, is at the same time an implementation of supranational arrangements within the scopes adopted by the state authorities, which means that the Strategy is subjected to logical evaluation depending on the impact of cyber conditions or binding arrangements of the international environment. The text is based on two research methods: the doctrinal legal research method to analyse the applicable legal regulations governing the issues related to the strategic aspects of cybersecurity and the law theory method aimed at evaluating the strategic solutions in respect of security in cyberspace.

Digitalization of Youth policy in Russia as a factor in the development of national cybersecurity strategy

Digitalization of Youth policy in Russia as a factor in the development of national cybersecurity strategy

The Cybersecurity Obligations of States Perceived as Platforms: Are Current European National Cybersecurity Strategies Enough?

Cybersecurity is a relatively recent addition to the list of preoccupations for modern states. The forceful emergence of the internet and computer networks and their subsequent ubiquitusness quickly brought it to the fore. The use of the internet in public and private administrations developed fast from a useful addition to an inherent, embedded element of all relevant policies and strategies. By now modern administrations, regardless whether public or private, are inconceivable outside the digital sphere. Nevertheless, with great opportunities came also great risk. Attacks against computer systems quickly evolved from marginalised incidents to state affairs, and concern. The exponential increase in the importance of cybersecurity over the past few years has led to a multi-level response. New policies, followed by relevant laws and regulations, have been introduced at national and international level. New academic interest has emerged, adding to the traditional studies on security. Perhaps most prominently, however, among these responses, modern states have been compelled to devise concrete cybersecurity strategies. The commonality, however, of computer network technologies and of the internet itself (including the digital means to cause harm) has led to considerable harmonisation among state responses. In other words, national cybersecurity strategies made available over the internet more or less resemble one another. Such uniform thinking could develop into a risk per se: challenges may appear unexpectedly, given also the dynamic nature of the internet and the multitude of actors and sources of risk, that could put common knowledge, if not wisdom, to the test at a stage with limited space for response. This paper builds upon the idea of national states being perceived as platforms within the contemporary digital and regulatory environment. In this context, it elaborates upon a concrete consequence of states-as-platforms within the cybersecurity field. To this end, Section 2 introduces the idea of states as platforms; Section 3 then particularizes this general discussion by specifically referring to the cybersecurity field, in an attempt to highlight specific consequences of states being perceived as platforms. The focus is then turned to the EU, and the NIS Directive’s obligation upon Member States to introduce and implement national cybersecurity strategies, which are therefore examined under the lens introduced in Section 2. Finally, specific points for improvement in these cybersecurity strategies are presented in Section 5.

The New Cold War: Cyber Frontline

Abstract The ongoing escalation of animosities between the United States, the Russian Federation and the People’s Republic of China is beginning to resemble the Cold War, which as a historical period might have ended in the twentieth century, but still endures as a state of hostilities between the countries, expressed in the form of an indirect conflict. These countries are actively growing their cyber capabilities that enable indirect and covert operations aimed at their opponents. In cyberspace, the states involved express the hostilities and the aims they try to achieve in the least detectable way. As a result, cyberspace has been securitized. It has been recognized by NATO as a domain of activities. In the United States, the National Cybersecurity Strategy has been published, recognizing cyberspace as an integral part of the economy and defence. A similar document called the Information Security Doctrine was issued in the Russian Federation, which manifests Russia’s aspirations in the field of information technology. The militarization of this area shows that cyberspace is becoming a battlefield in the new cold war. The Russian military invasion of Ukraine is complemented by the activities in the cyberspace. I analyse the new confrontation between the above-mentioned powers, looking for features of the Cold War in it. In particular, I examine the cyber capabilities of the United States, Russia and China. The article claims that the concept of cold war may be applicable to numerous historical eras, including the one that is still in effect now.

Indonesia’s Approach on Cyberattack Attribution through its Foreign Policy

<span lang="EN-US">It is clear that cybersecurity has now become a matter of increasing concern for Indonesian citizens, the private sector and the Indonesian government. Indonesia is ranked among the top countries from which cyberattacks are launched, while at the same time is itself very vulnerable to cyberattack. Indeed, Indonesia is currently in the early stages of developing a national cybersecurity strategy. The legal framework for cybersecurity in Indonesia is still weak that there is no clear classified security law or policy, and security practices are spread across different legislation while there are no specific cybersecurity provisions in place. Indonesia also lacks of national policy and strategy when it seeks to defend itself against cyberattack, particularly those hacking activities from foreign actors or state-sponsored groups. While majority of states in the world </span><span lang="EN-US">have two different approaches on cyberattack attribution from the context of sovereignty in international law, those applied sovereignty as a rule and as a principle, Indonesia has never </span><span lang="EN-US">stated clearly its position. Therefore, based on the analysis on how Indonesia’s approach on sovereignty through its foreign policy, from the perspectives of diplomacy practices and national policies, relevant sovereignty-violation cases, and its international framework and cooperation on cybersecurity, we may conclusively view that Indonesia appears to endorse the sovereignty-as-a-rule position, where it upholds the principle of respect for state sovereignty on cyberspace.</span>

Building cybersecurity capacity: a framework of analysis for national cybersecurity strategies

ABSTRACT States propose a range of policies to combat cyber threats. This article explores the approaches they take to build cybersecurity preparedness through a content analysis of the national cybersecurity strategies of 83 nation-states. We introduce a new typology for cybersecurity policies which conceptualises them according to their international versus domestic and collaborative versus non-collaborative focus. We describe trends in the content of these documents and discuss the policy implications of our findings.

The Effectiveness of Indonesian National Police Strategy in Cybercrime Eradication through ASEAN Ministerial Meeting on Transnational Crime (AMMTC)

Cybercrime has increased along with digital growth in Indonesia in the last decade. There has been a heightened urgency among Indonesian government agencies to eradicate cybercrime. These efforts include a national cybersecurity strategy and taking part in regional cooperation, such as AMMTC. This paper examines the effectiveness of the Indonesian National Police (INP)’s strategy in AMMTC to combat the nation’s cybercrime. By looking at the Global Cybersecurity Index (GCI), this article elaborates on whether the INP’s approach effectively counters cybercrime in Indonesia. This study utilizes transnational crime, cybercrime, cooperative security, and regional organization concepts. It conducts a qualitative research method with a case study approach as a derivative and an analysis descriptive research type. With primary data in the form of interviews with two sources and secondary data that took various related sources, the research conducts triangulation of data. This study shows that although Indonesia was slower in handling cybercrime cases, the effectiveness of INP’s approach on a national and regional scale is starting to look up

International Law Issues of Cyber Defense

International Law Issues of Cyber Defense

Regulatory Framework for Canada's Cybersecurity Policy

The article examines the issue of regulatory regulation of cybersecurity policy in Canada, and also considers an assessment of the main stages of cyber law formation. It describes policy documents that aim to improve Canada's cybersecurity and develop directives that have a positive impact on the development of the national security system. It emphasizes the adoption of two National Cyber Security Strategies and highlights the importance of other legislative initiatives to protect the integrity of government systems, national critical assets, methods and forms of combating cybercrime and protecting Canadians in their daily use of information space. The focus is on Canada's international integration in the field of cybersecurity and cooperation in the field of national space protection with partner countries in modern conditions. The author concludes that the Canadian legislature and executive are responding quickly to information challenges and creating flexible legal legislation aimed at preventing future threats. After all, Canada was one of the first to develop a regulatory framework for cybersecurity, constantly improving legislative initiatives and allocating financial resources. Characterizing the specifics of the legal framework of Canadian cyber law, it should be noted that the authorities are making great efforts to change the law, modernize the powers of law enforcement agencies and ensure an order that prevents evasion of legal control over criminal activities online. The Canadian criteria for computer systems security are the basic standards of information security and are highly recognized by the international community. Internationally, Canada's cybersecurity is developed through the Five Eyes Alliance and is closely linked to US, UK, Australian and New Zealand policy priorities, providing access to intelligence from around the world and providing a high level of protection against cyber security. attacks. Canada has one of the world's best institutional systems for information policy, including the creation of a single information space, the functioning of e-government, free access to information, government regulation of the media, and most importantly clear regulation of all information relations and processes The positive experience is that the Canadian state has a long history of cooperation between the public and private sectors in the field of economic and national security. This joint cooperation is ensured through the mutual exchange of accurate and timely information on cyber threats, protection methods and other best practices.

CYBER SECURITY

Cybersecurity encompasses a broad range of practices, tools and concepts related closely to those of information and operational technology (OT) security. Cybersecurity is distinctive in its inclusion of the offensive use of information technology to attack adversaries. Use of the term “cybersecurity” as a key challenge and a synonym for information security or IT security confuses customers and security practitioners, and obscures critical differences between these disciplines. Recommendation for security leaders is that they should use the term “cybersecurity” to designate only security practices related to the defensive actions involving or relying upon information technology and/or OT environments and systems. Within this paper, we are aiming to explain “cybersecurity” and describe the relationships among cybersecurity, information security, OT security, IT security, and other related disciplines and practices, e.g. cyber defence, related to their implementation aligned with the planned or existing cybersecurity strategy at the national level. In the case study given example of The National Cybersecurity Strategy of the Republic of Croatia and Action plan is presented and elaborated. The Strategy's primary objective is to recognize organizational problems in its implementation and broaden the understanding of the importance of this issue in the society.

A Comparative Analysis of Cyber Security Laws and Policies in Nigeria and South Africa

There is free flow of information in the cyberspace and as a result, nations are obviously wary of the integrity of its data as part of both public safety and national security concerns. There are ways that the associated risk could be mitigated and mostly has to do with a proper development and implementation of Cyber security policies and strategies. This research focuses on the cyber security policies, strategies and laws of both Nigeria and South Africa and also making a comparative analysis of the current National Cyber Security Policy and Strategy of both countries and the necessary recommendations going forward. In the case of Nigeria, analytical evidence shows that the national documents were found to have satisfied most of the requirements in terms of content, but failed to address other aspects of cyber security concerns in the country. On the other hand, South Africa as a country is lagging especially in governmental coordination, cybersecurity legislation, engagement with business and citizens, and skilled labour. The paper tends to explore these loopholes evident in the cyber security laws and policies of the aforesaid countries, and made the necessary recommendations on how to adopt best and sustainable practices in dealing with issues related to cyber security breaches including cybercrime in both countries.