Management Framework
for Organizing
National Cybersecurity/CIIP Efforts
Organization of American States
Inter-American Telecommunication Commission
Washington, DC
12-14 March 2008
Joseph P. Richardson
<joseph.richardson@ties.itu.int>
ICT Applications and Cybersecurity Division
Telecommunication Development Sector (ITU-D)
International Telecommunication Union
International
Telecommunication
Union
Management Framework is based on:
Work underway in ITU-D:
ƒ Framework for National
Cybersecurity/CIIP Efforts
ƒ Report on Best Practices for
Achieving Cybersecurity
ƒ ITU National Cybersecurity
Self-Assessment Toolkit
International
Telecommunication
Union
Management Framework Origins:
Include:
ƒ OAS General Assembly Resolution
1939 of 2003 that called for the
development of a draft cybersecurity
strategy for member states, in
coordination and collaboration with
CITEL, CICTE, REMJA, and other
bodies of the OAS
International
Telecommunication
Union
Why a Framework?
Why a National Strategy?
ƒ Cybersecurity/CIIP is a SHARED
responsibility
ƒ All “participants” must be involved
¾Appropriate to their roles
February 2008
international telecommunication union
Participants
ƒ “Participants” responsible for cybersecurity:
Government, business, other organizations,
and individual users who develop, own,
provide, manage, service and use
information systems and networks.
“UNGA Resolution 57/239 Creation of a global culture of
cybersecurity”
February 2008
international telecommunication union
–GovernmentIndustry
Advisory
Groups
–Lead/Lead Agency
–National & Economic
Security Committees
–Other Government Entities/Bodies
–Advisory Groups (AG)
–Trusted Information Sharing Network
–Interagency Cybersecurity and Critical Information
Infrastructure Coordinating Committee
–Gov’t−
Industr
y
Advisory
Group
–Gov’t−
Industr
y
Advisory
Group
–Gov’t−
Industr
y
Advisory
Group(s)
–Cybersecurity
– Other
Critical
Industry/
Sectors
–Gov’t−
Industr
y
Advisory
Group
–Mass
Gatherings
–Gov’t−
Industr
y
Advisory
Group
–ICT Sector
–Gov’t−
Industr
y
Advisory
Group
–Environmen
t
–Emergency
Services
–Gov’t−
Industr
y
Advisory
Group
–Expert Advisory Group
–Water
Services
–Gov’t−
–Gov’t−
Industr
Industr
y
y
Advisory
Advisory
February
2008
Group
Group
–Banking &
Finance
Sector
–Gov’t−
Industr
y
Advisory
Group
–Food
Sector
–Energy
Sector
–Gov’t−
Industr
y
Advisory
Group
–Health
Sector
–Transport
Sector
–Operational Group
–Gov’t−
Industr
y
Advisory
Group(s)
Framework for National Cybersecurity/CIIP
National
Strategy
Government
Industry
Collaboration
February 2008
Deterring
Cybercrime
Incident
Management
Capabilities
Culture of
Cybersecurity
international telecommunication union
Framework for National Cybersecurity/CIIP
National
Strategy
Government
Industry
Collaboration
Deterring
Cybercrime
Incident
Management
Capabilities
Culture of
Cybersecurity
For each of these five (5) elements, the Framework recommends:
ƒ POLICY to guide national efforts
ƒ GOALS to implement the policy
ƒ SPECIFIC STEPS to achieve goals
ITU support for Framework and National implementation efforts:
ƒ Best Practices for Achieving Cybersecurity
ƒ Reference Material & Training Resources
ƒ ITU National Cybersecurity/CIIP Self-Assessment Toolkit
February 2008
international telecommunication union
Policy
ƒ National Strategy:
ƒ
ƒ
¾ Protection of cyberspace is essential to national
security and economic well-being.
Government-Industry Collaboration:
¾ Protection of cyberspace is a shared responsibility
requiring collaboration between government and
the private sector.
Deterring Cybercrime:
¾ Protection of cyberspace requires updating
criminal laws, procedures and policy to address
and respond to cybercrime.
February 2008
international telecommunication union
Policy
ƒ Incident Management Capabilities:
¾ Protection of cyberspace requires a national focal
point with mission of watch, warning, response
and recovery; and collaboration with government
entities, the private sector; and the international
community.
ƒ Culture of Cybersecurity:
¾ Protection of cyberspace requires all participants
who develop, own, provide, manage, service and
use information networks to understand
cybersecurity and take action appropriate to their
roles.
February 2008
international telecommunication union
National Strategy
Policy: Protection of cyberspace is essential to
national security and economic well-being.
Goals:
¾1.1. Create awareness of need for
national action and international
cooperation.
¾1.2. Develop national strategy.
¾1.3. Participate in international efforts.
February 2008
international telecommunication union
National Strategy
Specific Steps:
¾ 1.1. Persuade leaders of need for action.
¾ 1.2. Identify lead person and institution.
¾ 1.3. Identify home for Computer Security Incident Response
Team with national responsibility (N-CSIRT).
¾ 1.4. Identify lead institutions for each element of the national
strategy.
¾ 1.5. Identify experts and policymakers and their roles.
¾ 1.6. Identify and formalize cooperative arrangements.
¾ 1.7. Establish mechanisms for government - private sector
cooperation.
¾ 1.8. Identify international counterparts; foster information
sharing and assistance.
¾ 1.9. Establish an integrated risk management process.
¾ 1.10. Establish assessment/reassessment program.
¾ 1.11. Identify training requirements.
February 2008
international telecommunication union
Government-Industry Collaboration
Policy:
¾ Protection of cyberspace is a shared responsibility requiring
collaboration between government and the private sector.
Goals:
¾ 2.1. Develop government-industry collaboration.
¾ 2.2. Use industry perspectives, equities and knowledge to
enhance cybersecurity.
Specific Steps:
¾ 2.1. Include industry.
¾ 2.2. Encourage private sector groups to address common
security interests and collaborate with government.
¾ 2.3. Bring private sector and government together in trusted
forums.
¾ 2.4. Encourage cooperation among groups from
interdependent industries.
¾ 2. 5. Establish government/ private sector arrangements for
incident management and cooperation.
February 2008
international telecommunication union
Deterring Cybercrime:
Policy:
¾ Protection of cyberspace requires updating criminal laws,
procedures and policy to address and respond to cybercrime.
Goals:
¾ 3.1. Enact and enforce a set of comprehensive laws relating to
cybersecurity and cybercrime consistent with the provisions of the
Convention on Cybercrime (2001).
Specific Steps:
¾ 3.1. Assess the current legal authorities for adequacy.
¾ 3.2. Draft and adopt substantive, procedural and mutual
assistance laws and policies.
¾ 3.3. Establish or identify national cybercrime units.
¾ 3.4. Develop cooperative relationships with national
cybersecurity infrastructure and private sector.
¾ 3.5. Develop an understanding among prosecutors, judges, and
legislators of cybercrime issues.
¾ 3.6. Participate in the 24/7 Cybercrime Point of Contact
Network.
February 2008
international telecommunication union
Incident Management
Capabilities
Policy:
¾ Protection of cyberspace requires a national focal point
with mission of watch, warning, response and
recovery; and collaboration with government entities,
the private sector; and the international community.
Goals:
¾ 4.1. Develop coordinated national cyberspace security
response system.
¾ 4.2. Establish focal point for managing cyber
incidents.
¾ 4.3. Participate in information sharing mechanisms.
¾ 4.4. Develop, test and exercise emergency response
plans.
February 2008
international telecommunication union
Incident Management Capabilities
Specific Steps:
¾ 4.1. Identify or establish a national Computer
Security Incident Response Team (N-CSIRT).
¾ 4.2. Establish mechanism for coordination among all
government agencies.
¾ 4.3. Establish collaborative relationships with
industry.
¾ 4.4. Establish points of contact to facilitate
information exchange with N-CSIRT.
¾ 4.5. Participate in international cooperative activities.
¾ 4.6. Develop tools and procedures for the protection
of the cyber resources.
¾ 4.7. Develop capability to respond to and recover
from cyber incidents.
¾ 4.8. Promote responsible disclosure practices.
February 2008
international telecommunication union
Culture of Cybersecurity
Policy:
¾ Protection of cyberspace requires all participants
who develop, own, provide, manage, service and
use information networks to understand
cybersecurity and take action appropriate to their
roles.
Goals:
¾ 5.1. Promote a national Culture of Cybersecurity.
February 2008
international telecommunication union
Culture of Cybersecurity
Specific Steps:
¾ 5.1. Implement a cybersecurity plan for government
systems.
¾ 5.2. Implement security awareness programs for
government users.
¾ 5.3. Encourage business to develop a Culture of
Cybersecurity.
¾ 5.4. Support outreach to civil society, children and
individual users.
¾ 5.5. Promote a comprehensive national awareness
program.
¾ 5.6. Enhance Science and Technology (S&T) and
Research and Development (R&D).
¾ 5.7. Review and update existing privacy regime.
¾ 5.8. Develop awareness of cyber risks and available
solutions.
February 2008
international telecommunication union
February 2008
international telecommunication union
February 2008
international telecommunication union
February 2008
international telecommunication union
Government Actions
ƒ Provide leadership, guidance and coordination
for national effort and international
cooperation
¾ Identify lead person and institution for
developing national strategy
¾ Identify lead persons and institutions for
operation of each element of national strategy
¾ Develop computer security incident response
team with national responsibility (N-CSIRT)
¾ Identify cooperative arrangements and
mechanisms for cooperation among all
participants
February 2008
international telecommunication union
Government Actions
ƒ Provide leadership, guidance and coordination
for national effort and international
cooperation (continued)
¾ Identify international counterparts and
relationships
¾ Identify experts
¾ Establish integrated risk management process
¾ Assess and periodically reassess cybersecurity
¾ Identify training requirements
February 2008
international telecommunication union
Getting Started on a
National Strategy
ITU National Cybersecurity/CIIP
Self–Assessment Toolkit
February 2008
international telecommunication union
Self – Assessment Toolkit
ƒ Based on Best Practices document
ƒ Focus: national management and policy level
ƒ Intended to assist national governments:
¾Understand existing national approach
¾Develop “baseline” re Best Practices
¾Identify areas for attention
¾Prioritize national efforts
February 2008
international telecommunication union
Considerations
ƒ
ƒ
ƒ
ƒ
No nation starting at ZERO
No “right” answer or approach
Continual review and revision needed
All “participants” must be involved
¾appropriate to their roles
February 2008
international telecommunication union
The Self-Assessment Toolkit
ƒ Examines each element of Framework at
management and policy level:
¾National Strategy
¾Government - Industry Collaboration
¾Deterring Cybercrime
¾National Incident Management Capabilities
¾Culture of Cybersecurity
February 2008
international telecommunication union
The Self-Assessment Toolkit
ƒ Looks at organizational issues for each
element of Framework:
¾The people
¾The institutions
¾The relationships
¾The policies
¾The procedures
¾The budget and resources
February 2008
international telecommunication union
The Self-Assessment Toolkit
ƒ Identifies issues and poses questions:
¾What
¾What
¾What
¾What
February 2008
Actions have been taken?
Actions are planned?
Actions are to be considered?
is the Status of these actions?
international telecommunication union
The Self-Assessment Toolkit
ƒ Objective: assist nations organize and
manage national efforts to
¾Prevent
¾Prepare for
¾Protect against
¾Respond to, and
¾Recover from cybersecurity incidents.
February 2008
international telecommunication union
National Pilot Tests
ƒ ITU-D pilot tests of self-assessment tool
¾Vietnam (August 2007)
¾Argentina (October 2007)
¾ITU Regional Workshop, Doha (Feb
2008)
¾2008 – others to be determined
ƒ For information on ITU-D pilot test program
¾ contact cybmail@itu.int
February 2008
international telecommunication union
ITU National Cybersecurity/CIIP
Self-Assessment Toolkit
ƒ Additional and updated information at
http://www.itu.int/ITU-D/cyb/cybersecurity/project
s/readiness.html
February 2008
international telecommunication union
International
Telecommunication
Union
Helping the World Communicate
February 2008
international telecommunication union