第3/2号课题：保障信息和通信网络的安全：培育网络安全文化的最佳做法

最后报告

前言

国际电联电信发展部门（ITU-D）研究组提供一种文稿驱动工作的中立平台，政府、行业和学术界的专家在此聚集，制定实用的工具和导则并开发资源来解决发展问题。ITU-D成员通过ITU-D研究组的工作，研究和分析以任务为导向的具体电信/ICT课题，从而加快各国发展优先工作的进展。

研究组为所有ITU-D成员提供机会来交流经验、提出想法、交换意见，并就研究处理电信/ICT优先工作的适当战略达成共识。ITU-D研究组负责根据成员提交的输入意见或文稿来制定报告、导则和建议书。国际电联通过调查、文稿和案例研究收集的信息利用内容管理和网络发布工具公开提供，以方便成员的轻松访问。研究组的工作与ITU-D不同计划和举措相关联，以发挥协同作用，使成员在资源和专业知识上受益。与在相关议题领域开展工作的其他群体和组织进行协作至关重要。

ITU-D研究组的研究课题由四年一届的世界电信发展大会（WTDC）决定，每届WTDC为界定下一个四年的电信/ICT发展问题和优先工作制定工作计划和导则。

ITU-D第1研究组的工作范围是研究“发展电信/ICT的有利环境”，ITU-D第2研究组则是研究“ICT应用、网络安全、应急通信和适应气候变化”。

在2014-2017年研究期，由以下人员指导ITU-D第2研究组的工作：主席Ahmad Reza Sharafat（伊朗伊斯兰共和国）和代表六个区域的副主席：Aminata Kaba-Camara（几内亚共和国）、Christopher Kemei（肯尼亚共和国）、Celina Delgado（尼加拉瓜）、Nasser Al Marzouqi（阿拉伯联合酋长国）、Nadir Ahmed Gaylani（苏丹共和国）、王柯（中华人民共和国）、Ananda Raj Khanal（尼泊尔共和国）、Evgeny Bondarenko（俄罗斯联邦）、Henadz Asipovich（白俄罗斯共和国）和Petko Kantchev（保加利亚共和国）。

最后报告

针对第3/2号课题：“保障信息和通信网络的安全：培育网络安全文化的最佳做法”的最后报告在两位共同报告人Rozalin Basheer Faqeer Al-Balushi（阿曼电信管理局）和Eliot Lear（美利坚合众国）的领导下制定，参与工作的还有7位副报告人：Damnam Kanlanfei Bagolibe（多哥）、Christopher Ganizani Banda（马拉维）、Albert Kamga（喀麦隆）、Miho Naganuma（日本）、Jean-David Rodney（海地）、Jabin S. Vahora（美利坚合众国）和Jaesuk Yun（大韩民国）。ITU-D联系人和ITU-D研究组秘书处也协助他们开展工作。

ISBN

978-92-61-22995-5 (Paper version)

978-92-61-23005-0 (Electronic version)

978-92-61-23015-9 (EPUB version)

978-92-61-23025-8 (Mobi version)

本报告由来自不同主管部门和组织的众多志愿人员编写。文中提到的具体公司或产品，并不意味着它们得到了国际电联的认可或推崇。

打印本报告之前，请考虑到环境影响

© ITU 2017

保留所有权利。未经国际电联事先书面许可，
不得以任何手段对本出版物的任何部分进行复制。

目录

前言

最后报告

内容提要

i. 内容提要

ii. 引言

1 第1章 − 网络安全认识调查问卷

1.1 信息采集方法

1.2 宣教活动数据分析

2 第2章 – 垃圾信息和恶意软件的现状、缓解技术和监管措施

2.1 垃圾信息的来源

2.2 垃圾信息对网络的影响

2.3 鱼叉式网络钓鱼的风险和缓解措施

2.4 政策对垃圾信息的影响

3 第3章 − 加强国家网络安全姿态：提高认识并增强人力资源

3.1 推广活动

3.1.1 宣传计划的最佳做法

3.1.2 宣传计划范本

3.1.3 宣传活动策略

3.1.4 计划成功实施的衡量标准

3.2 其他能力建设措施

3.2.1 在日本开展的活动

3.2.2 在韩国开展的活动

3.2.3 独联体区域开展的活动

3.2.4 挪威开展的活动

3.3 私营-公共伙伴关系

4 第4章 − 保护上网儿童（COP）

4.1 保护上网儿童调查结果

4.2 保护上网儿童策略和技术解决方案

4.2.1 提高对保护上网儿童的认识和相关举措

4.2.2 保护上网儿童战略

5 第5章 − 网络安全讲习班的结果

5.1 首届网络安全讲习班（2015年9月8日）

5.2 第二届网络安全讲习班（2016年4月19-20日）

5.3 第三届网络安全讲习班（2017年1月26日）

6 第6章 – 网络安全机遇和挑战

6.1 网瘾

6.2 电子交易的安全性

6.3 网络安全中的合作关系

7 第7章 − 具有通用安全标准框架的国家经验

8 第8章 − 有关下一研究期的结论和建议

Abbreviations and acronyms 41

Annexes 44

Annex 1: The Global Cybersecurity Index 2017

Annex 2: Compendium on cybersecurity country case studies

Annex 3: Cybersecurity activities being conducted by organizations, private sector, and civil society

Annex 4: Contributions mapping

Annex 5: Survey questions

Annex 6: Information on ACTIVE

图表目录

表目录

表1：预防教育参与者数量

表2：咨询服务类型的数量

Table 1A: Most committed countries, GCI (normalized score)

Table 2A: Number of participants of preventive education

Table 3A: Number of counselling service by type

Table 4A: Different types of services options to be provided to Government and commercial entities

Table 5A: Different types of services options to be provided to individuals

Table 6A: Customized template for national cybersecurity measures

图目录

图1：各区域对网络安全认识调查的答复情况

图2：提高网络安全认识的重要性

图3：网络安全公众宣教活动

图4：网络安全认识对组织/民间团体的重要性

图5：需要向其宣传网络安全认识的年龄段

图6：网络安全宣教活动的目标群体

图7：最需要进行网络安全宣教活动的群体

图8：宣教活动针对的网络安全问题

图9：宣教活动针对的各类网络安全问题的重要性

图10：公众对软/硬件或基于业务的解决方案优势的了解程度

图11：可供公众使用的软/硬件或基于业务的解决方案

图12：垃圾信息和网络安全间的恶性循环

图13：打破恶性循环

图14：ACTIVE活动概览

图15：是否设置了负责保护上网儿童的机构/实体？

图16：是否设立了保护上网儿童问题汇报公共机制？

图17：部署了哪些有助保护上网儿童的技术机制和能力？

图18：政府或NGO是否开展了任何活动，为利益攸关方（家长、社区领导、教师等）提供有关如何保护上网儿童的支持和知识？

图19：网络安全公共宣教活动的开展及实施（与负责保护上网儿童的机构/实体相比而言）

图20：针对儿童的保护上网儿童公共宣教活动

图21：关于保护上网儿童的公共宣教活动

图22：有关儿童和成年人的保护上网儿童公共宣传活动对比

内容提要

i. 内容提要

本报告阐述与第3/2号课题（“保障信息和通信网络的安全：培育网络安全文化的最佳做法”）的职责范围有关的许多方面内容，此课题的研究期历时三年，于2017年4月结束。我们首先对国际电联电信发展局（BDT）开展的网络安全认识调查进行了分析。调查表明，尽管一些国家必须提高网络安全认识，但有些国家却没有身体力行，而那些经常开展此类宣教活动的国家并未针对社会关键群体。受访国家大多将保护上网儿童作为优先事项给予了高度关注。本报告揭示了垃圾信息、其产生原因和解决垃圾信息的方法。尽管电子邮件消耗的带宽量通常较低，却使通信的价值大打折扣，因此其相关影响仍需引起关注。在此之后，本报告提供了政府为改善网络安全整体社会态势而采取的推广活动的样本。

尽管前一研究期（2010-2014年）以通过电信发展局提供的各类课程作业为重心，但本研究期（2014-2017年）更侧重于讲习班这种形式，以为发展中国家带来范围广泛的行为体及丰富的内容。本报告包含了此类讲习班的摘要及相应内容。

本报告的附件介绍了国际电联电信发展局（BDT）已进行多年的全球网络安全指数（GCI）的情况。

最后，我们提出了一些想法和建议，供进一步研究。

ii. 引言

ITU-D第3/2号课题提供有关网络安全各个方面问题的最佳做法报告。这是ITU-D第2研究组第3/2号课题提供的、关于该课题在2014-2017这四年研究周期中各项活动的最后报告。2014年，在阿拉伯联合酋长国迪拜召开世界电信发展大会（WTDC）期间，确定了第3/2号课题的工作计划。在过去三年，第3/2号课题已经解决了工作计划中所列的大部分问题。

第3/2号课题最后报告由多份关于网络安全不同方面的最佳实践报告组成。

第1章 回顾网络安全认识调查问卷

第2章 探讨了恶意软件（垃圾信息）的现状、缓解措施和规范手段。

第3章 探讨了国家网络安全宣教活动、战略制定和测量网络安全的步骤。

第4章 探讨了所实施的保护上网儿童调查和利益攸关问题。

第5章 探讨了研究组研究期间所开展的网络安全讲习班的研讨结果。

第6章 囊括各个组织提交研究组的工作概要。

第7章 探讨了国家实施通用标准情况下的工作情况。

最后，第8章把未来需要研究考量的领域纳入本报告。

在本报告开始处，请注意本研究组审查并评论了在2017年全球网络安全指数背景下编制的全部文件。2017年指数是在对193个成员国发来的逾134份回复进行评估的基础上编制的（应国际电联要求而确定的成员国GCI联系人完成了在线调查）。该研究组课题的网络意识调查和保护上网儿童调查合并到GCI调查进行处理，因而回复越多，内容余越详实（从上个研究期的51个到本研究期的129个）。

本GCI 2017问卷调查表[1]和其他有关文件（包括参考模型）已经审议并纳入本附件。附件1收录了GCI 2017研究结果总结。

本研究课题涵盖了参考范围内的方方面面，但以下内容除外：

f) 与其他相关课题协调，研究残疾人的具体需求。

尽管此领域很重要，但因研究期过短且收集信息不足而受到影响。请注意，参加网络安全认识调查问卷的成员国中有69%未将残疾人纳入其目标群体，这表明在此方面需要开展更多工作（详见第1.2节）。

[1] https://www.itu.int/en/ITU-D/Cybersecurity/Pages/GCI-2017.aspx。

1 第1章 − 网络安全认识调查问卷

本章涉及第3/2号课题的（d）项职责范围，即，尤其要求：

d) 继续分析上一研究期的网络安全认识的调查结果，并开展最新调查，以衡量这段时间取得的进展。

除非人们大力关注提高公众和用户的网络安全认识，否则网络安全机制将不会得到充分发展。若不将安全意识作为关键要素之一，旨在实现网络安全的框架就无法推行。这可从以下方面得到确定：关心或介入网络安全事物的人员均了解，如下关键要素始终是实现网络安全的基石：(i) 制定必要法律保护网络安全；(ii) 有关各方需要展开协调合作（包括私营部门和公共部门）；(iii) 有实现安全的技术工具；(iv) 国际协调合作；(v) 定期对效率进行测量及(vi) 传播并提高意识。

考虑到提高意识对实现网络安全的重要意义，本调查问卷旨在衡量人们对于传播网络安全认识的殷切程度，界定目标群体（不论是政府机构或包括私人企业、机构，及残疾人士、儿童等类人士在内的相关方），以及识别出各国所面临的最高级别的网络风险。

1.1 信息采集方法

在2015年的第二次会议上，ITU-D第2研究组第3/2号课题同意将网络安全认识及保护上网儿童（COP）调查问卷和全球网络安全指数[1]调查问卷相结合，以期有效地实现类似目标，避免重复工作及确保成员国能够广泛地参与到调查问卷的填写活动中来。

2015年12月11日，该调查问卷发送至193个国际电联成员国，供其填写后回复。其中，129个成员国（约占成员国总数的63%）回答了与提高网络安全认识有关的问题，而131个成员国（约占成员国总数的68%）回答了有关保护上网儿童的问题。负责整理全球网络安全指数调查问卷的团队将该数据汇报给第3/2号课题，该课题随后审查并分析了相关数据，并将最终结果纳入了最后报告。

图1：各区域对网络安全认识调查的答复情况

1.2 宣教活动数据分析

此类有关网络风险的问题旨在明确：提高网络风险意识具有重要意义，可以此实现网络空间安全。

95.42%的问卷受调查者称网络安全认识“非常重要”，而4.58%的受调查者认为网络安全认识“很重要”。相比之下，上个研究期（2010-2014）进行的类似问卷调查的调查结果如下：在2010-2014研究期，确认网络安全认识“非常重要”的受调查者占比为79%。

图2：提高网络安全认识的重要性

在131个受调查国家中，有82个国家已经制定并实行针对网络风险的网络安全宣教活动。这表明，这些成员国已经认识到了在本国设计、制定及实施针对网络风险的网络安全宣教活动的重要意义。

图3：网络安全公众宣教活动

问卷的调查结果显示，就应实施网络安全宣教活动的部门而言，71个成员国认为应针对政府部门开展此类网络安全宣教活动，72个国家认为应针对民事部门开展此类活动。这证明，在成员国看来，提高政府部门和高民事部门的网络安全认识同等重要。

图4：网络安全认识对组织/民间团体的重要性

就需要提高网络安全认识的年龄段而言，该调查问卷分出了三大类：成人（18岁及以上）、青年（12-17岁）和儿童（12岁以下）。

图5显示，就是否需要向三个年龄段宣传网络安全认识而言，成员国给出了近似结果。根据该调查结果，人们始终认为最需要向青年群体宣传网络安全认识，而儿童群体则位居最后。其原因可能在于：成员国考虑到青年对电信服务的使用情况，以及考虑到青年是互联网的主要访问者，因此将青年视为最容易受到网络安全风险攻击的群体。

图5：需要向其宣传网络安全认识的年龄段

我们需要强调的是，网络安全宣教活动并不局限于上述提到的群体，网络安全宣教活动还针对老年人和残障人士等其他群体，由于老年人所面临的的风险与儿童面临的风险不尽相同，因此应为这类群体安排符合其需要和条件的特殊计划。

问卷清楚表明，成员国将注意力大多放在政府机构和青年群体身上。学生群体和青年群体同样获得较大关注（分别有99个和102个国家在回复时选择了这两个群体）。相比之下，只有38个国家认为应对老年人宣传网络安全认识，也就是说，在组织网络安全宣教活动时，70%参与问卷调查的成员国未将老年群体视为网络安全认识的宣传目标。还应注意，69%参与问卷调查的国家未将残障人士列为网络安全认识的宣传目标。最新问卷调查结果同样显示，人们认为老年人和残疾人最不需要接受网络安全认识宣传。

图6：网络安全宣教活动的目标群体

经过分析有关上述回答的信息：更侧重对哪个群体宣传网络安全认识呢？绝大部分受调查者支持对政府部门进行宣传，儿童群体位居第二，青年和学生群体分别位居第三和第四。在另一方面，老年人和残疾人再度成为最不需要网络安全宣教活动的群体（与2010-2014研究期所得出的调查结果一致）。当前研究期与先前研究期的研究结果之间唯一一个显著的变化是，政府部门从前一研究期的第二位上升至当前的第一位，成为了最需要实施网络安全宣教活动的群体。儿童群体则由第一位下降至第二位，而青年和学生的名次和上个调查问卷所得的结果一致。

图7：最需要进行网络安全宣教活动的群体

网络安全宣教活动旨在提高对各种网络风险的意识，识别出宣传活动所强调的各种问题，这一点十分重要。最重要的问题是互联网安全、隐私、诈骗、网络钓鱼、恶意软件和保护上网儿童。互联网安全是最为重要的网络安全问题，名列其后的分别是保护上网儿童、诈骗和网络钓鱼。大体上，网络安全宣教活动的调查结果与之相近，上个研究期的调查问卷也同样得出了近似结果，互联网安全位居第一，其次是保护上网儿童，而隐私、诈骗和网络钓鱼的百分比相同，共同名列第三。保护上网儿童在网络安全宣教活动中具有最大比重，在129个受访国家中，43个国家将保护上网儿童选作最为重要的问题。考虑到保护上网儿童的重要意义（社会需要更多的宣教活动来应对这一问题，特别是目标儿童群体要和家长与教师共同面对这些风险），因此这是说得过去的。此外，保护上网儿童的重要性排名与在上个研究期调差问卷的所得结果一致，这进一步凸显了保护上网儿童的重要性。

图8：宣教活动针对的网络安全问题

互联网安全通常是第二重要的问题，紧随其后的是诈骗和隐私，而恶意软件和网络钓鱼问题名列最后，如图9所示：

图9：宣教活动针对的各类网络安全问题的重要性

图10：公众对软/硬件或基于业务的解决方案优势的了解程度

在探讨增强网络安全认识这一问题时，很重要的一点是要增强对技术的熟练使用程度以及提供可用的技术工具，以确保抵御各种网络风险。在不具备实践或技术知识的情况下，仅增加理论意识是不够的。这里的实践知识是指，让公众了解知有用的、可用于实现网络安全的软件、硬件或基于业务的解决方案，而此类软件程序对网络安全和抵御网络风险起着关键作用。在131个受访国中，有70个国家推崇此类软件程序，并强调其对目标群体的适用性。其余61个国家尚未让公众熟练使用该软件程序及其他应对网络风险所需的技术解决方案。虽然这两个结果十分接近，但是应注意技术解决方案和软件程序的传播在网络安全宣教活动中占有很大比重。

该调查问卷同样显示，45个国家已向公众推广了此类软件程序或基于业务的解决方案，而大部分受调查国家（86个国家，占总数的65.65%）回答称其尚未这样做。

图11：可供公众使用的软/硬件或基于业务的解决方案

欲知有关保护上网儿童调查问卷的分析部分，请参阅第4章。

2 第2章 – 垃圾信息和恶意软件的现状、缓解技术和监管措施

本章除其他事项外涉及第3/2号课题职责范围的（a）和（b）项：

a) 探讨评估网内垃圾信息所产生影响的方法和最佳做法，在考虑到现有标准和可用工具的前提下，提出可供发展中国家使用的必要措施，尤其是缓解技术；

b) 提供有关当前网络安全挑战，即服务提供商、监管机构和其他相关方所面临的挑战的信息。

垃圾信息主要是通过经攻击者破坏（例如拥有）的系统产生的。之后攻击者可通过其服务提供商生成垃圾信息。应对该攻击形式的典型方式是维护和查阅发件人信誉数据库。这些信誉以发件人的IP地址为准。不同的信誉系统会得出各自不同的结论。一个通用的方法是利用“蜜罐”邮件地址，其唯一目的是攻击垃圾信息发送者。当一封邮件进入这些信箱时，发送方的IP地址信誉会被调低。

信誉系统通常要考虑到垃圾信息的巨大数量。但是，这在进来变得极具挑战性。“雪鞋”垃圾信息试图利用庞大且地域分布广的僵尸网络（受恶意软件破坏的计算机网络），这样，虽然没有一台计算机会发送大量信息，但总体而言则产生了巨大的通信量。

即便针对上述攻击方式，反垃圾信息系统通常能够为接收方拦截超过90%的垃圾信息，并且在许多情况下可拦截超过99%的垃圾信息。反垃圾信息过滤器是确保维持电子邮件通信有效性的关键组件。该过滤器也是预防有关设备遭到破坏的关键手段。

图12：垃圾信息和网络安全间的恶性循环

通常，接收垃圾信息本身不会感染或破坏设备。事实上，有许多方式可以打破这一恶性循环。如上文所述，反垃圾信息系统可以拦截大部分垃圾信息。在大多数情况下，甚至在发送信息后，用户开启附件这类步骤仍不可或缺。因此，用户意识是防止垃圾信息持续传播的关键所在。用户确实打开附件后，最新的抗病毒软件和操作系统软件可以进一步预防感染。就其中每类组件而言，发展中国家的用户和服务提供商可以获取诸多免费或低价抗病毒工具。

我们已知的另一种是在路由系统中攻击大量IP地址。这会在攻击者窥视粗心大意的服务提供商交换路由信息时发生。最近，人们研制出了一种新型保护手段—带有路由公钥基础设施（RPKI）的边界网关协议安全（BGPSEC）[2]，以期预防这些攻击形式，该保护手段目前仍在开发和部署过程中。但是，该新型路由系统保护在获得广泛使用前，仍需要大量时间以及诸多测试。同时，上述全部方式仍继续有效地应对垃圾信息。

最近开发的另一种缓解技术被称为“基于域的信息验证和合规性（DMARC）”[3] 。DMARC依赖于两类主要验证技术 – 域密钥识别邮件（DKIM）和发件人策略框架（SPF）来确定每条信息的真实性。当某条信息未经验证时，可根据发送域所有者的偏好采取行动。该行动可包括拒绝接收信息。少数大型邮件提供商及诸多产生大量事务性邮件的服务（如订单确认和购买确认）会一并使用这些技术。

在使用DKIM时，DMARC也会防止对IP地址前缀的攻击。但是，这并不是说其自身没有问题。在和非事务性邮件发送（如个人间的邮件发送）一并使用时，DMARC会遭受某些互操作性问题[4]。这是互联网工程任务组（IETF）目前的工作焦点。此外，DMARC不能检测受攻击系统的使用情况，而这些系统仍可通过其正常的服务提供商传送文件。一开始就应让末端系统免予遭到感染，这是终止垃圾信息的关键所在。

图13：打破恶性循环

2.1 垃圾信息的来源

僵尸网络由诸多用户设备（在某些情况下还包括受入侵的数据中心服务器）一并组成，图12和图13所示的恶性循环很大程度上是因使用该僵尸网络而导致的。此前，至少有一项因素提高了人们对于移动设备垃圾信息产生风险的关注程度。不同移动设备的操作方式不同，因此以不同的方式应对风险。以苹果的iPhone手机为例，由于其应用需要数字签名和验证，以及其对于应用运行平台和应用有着严密的监控，因此iPhone彰显了其高度耐攻击性。

其他平台则面临更多挑战。在全社会，信息通信技术（ICT）的使用范围不断扩大，物联网（IoT）在持续增长，互联网领域不断有新的平台出现。如果这些平台内含CPU且与网络相连接，则它们很可能存在漏洞。就在本报告发布之前不久，“迈阿密蠕虫”（Mirai Worm）便攻击了DNS基础设施，并使一个大型社交网站陷于瘫痪。与垃圾信息更直接相关的是，网络安全公司Proofpoint于2013年发现的一个漏洞可能导致冰箱、恒温器和防盗报警器产生垃圾信息[5]。该发现进一步说明了设备制造商提供软件自动更新机制的必要性，唯有如此方可降低设备遭遇侵袭的风险。

2.2 垃圾信息对网络的影响

从国际网络连接到通过射频进入手机的信息，有很多要点可以衡量垃圾信息对网络的影响。在最近数年，人们提出了如下问题：垃圾信息在网络上消耗了多少带宽？电子邮件信息本身通常是十分小的，平均为75000比特[6]左右。但是，许多信息会更小，而且通常都被附件压缩（附件起初或许并未予以下载）。如果适当的反垃圾信息规定得以落实，最少可以过滤掉90%的垃圾信息。以每天2590亿条垃圾信这一最高估计为例，若使用效率最低的反垃圾信息解决方案，考虑使用网络的人数为250亿，每人每天可看到的垃圾信息应该只有100余条。即便就这一数量而言，相比于音频、视频和网页浏览，垃圾信息对网络的消耗仍是极小的。总体而言，测量表明，在受测量[7]的经济体中，其全部电子邮件（包括垃圾信息）通常仅占带宽使用的很小一部分，小到可忽略不计。垃圾信息并非对网络中所使用的带宽造成威胁，而是可能感染设备，从而实施诈骗或其他非法行为。在缺少有效过滤器的情况下，垃圾信息还会降低用户电子邮件的价值。

2.3 鱼叉式网络钓鱼的风险和缓解措施

鱼叉式网络钓鱼是一种攻击形式，其攻击方式是，向目标用户发送看似有合法来源、同样包含充分个人信息的诈骗邮件，以欺骗该用户，让其认为信息的来源是真实的。相关例子包括使用真实账号、提及攻击目标熟人的名字以及使用攻击目标熟悉的图像等。诈骗方会诱使攻击目标目标点击网络链接或开启附件，让该人士的机器受到感染。由于需要研究了解目标的信息，因此攻击者要以比实施无目标攻击高得多的代价来实施鱼叉式网络钓鱼。此类研究可能采取如下形式：入侵零售企业或政府部门数据库，以获得攻击目标的信息。防止鱼叉式网络钓鱼的最有效方式是增强对用户的教育。

2.4 政策对垃圾信息的影响

规定对缓解垃圾信息可能既有积极作用也有消极作用。使用电脑发送诈骗信息系诈骗行为。这不是一项新的犯罪行为，它只不过是以一种新形式进行一种非常古老的犯罪行为。法律应具有足够的灵活度以能够起诉实施此类诈骗的人员。在美国，2003年通过的《反垃圾信息法》明确指出邮件诈骗为犯罪行为。但是，寻找实际攻击者仍旧困难重重。服务提供商和执法机构间开展公司合作可逐渐进一步完善寻找攻击者的能力。当诈骗活动涉及实际金钱时，此类交易可以通过金容网络进行追查。

在另一方面，要想避免收到垃圾信息，需要中间人经常能够访问邮件内容以便该邮件内容对终端系统而言是否安全。正确的立法架构必须考虑到对网络和网络用户的保护。

国际电联继续与互联网协会展开合作，积极应对垃圾信息带来的挑战。本研究期内，在2016年信息社会世界峰会论坛举办期间召开了题为“垃圾信息：了解并解决新兴互联网经济面临的挑战”的会议[8]，该会议取得了丰硕成果。来自马来西亚网络安全组织、巴哈马公用事业和竞争局、国际互联网协会、国际电联第2研究组课题3报告人组和国际反垃圾信息组织的代表均在会上发言。该会议提出的拟解决问题如下：

– 如果垃圾信息属于集体性问题，影响到每个人，则是否需要增强与成员国一系列高效行动计划的密切合作；

– 连接（宽带）的费用降低，预防（网络攻击）的成本提高；

– 是否需要进行立法，规定可接受及不可接受的事项，同时针对违法者制定可执行的制裁机制，同时在处罚诸如试图创建营销活动的中小企业（SME）等行为方时不至太过严格；

– Spamhaus黑洞列表和声誉服务的最佳做法和解决方案将通过国际电联与所有成员国进行分享。

3 第3章 − 加强国家网络安全姿态：提高认识并增强人力资源

本章除其他事项外涉及第3/2号课题职责范围的（c）项：

c) 继续从成员国收集网络安全方面的经验，并在这些经验中确定并寻找其共同主题。

我们所生活的世界正日益变得互连互通，虽然这为全世界的创新活动以及社会经济发展带来了史无前例的良机，但网络空间内仍旧存在诸多安全挑战和威胁。此外，随着这些安全挑战不断演变并开始影响不同行业，各国愈发难以找到处理这些问题的解决方案。

为了应对这些挑战，许多国家开始组织网络安全宣教活动，该活动旨在对政府、私营企业、教育者和公民个体开展教育，使其能够发现潜在问题，并了解其在安全网络空间创建活动中的作用和责任。在本研究组研究期内，许多实体就该主题提交了文稿。欲获得其他信息，请参考附件2《网络安全国别案例研究汇编》。

3.1 推广活动

推广活动的案例之一名为“停止、思考、连接™”活动，此活动旨在增强人们对网络威胁的认识，并让美国公众获得更加安全有保障的上网体验。该活动致力于将网络安全概念宣传为一个“共同责任”，其中每个人只需采取简单几步实现安全上网，就可让人人获得更加安全的互联网使用体验。该运动的关键信息包括：

– 停止：您在使用互联网前，要花些时间了解网络风险以及发现潜在问题的方法。

– 思考：花些时间确定前路无阻。注意警告信号并思考您的上网活动对您或您家人安全的影响程度。

– 连接：既然你已经采取了正确的方式确保自身及计算机的安全，那么就放心大胆地享受网络乐趣吧。

– 停止、思考、连接：实现自我保护，让网络成为一个为全民服务的更加安全的所在。

本章有四个组成部分，概述了启动网络安全宣教活动的建议方法和最佳做法。

3.1.1 宣传计划的最佳做法

虽然每个国家就网络安全威胁和保护有着独特的要求，面临着不同的挑战，但以下最佳做法可帮助开展网络安全宣教活动。

– 制定包括充分确定的目的和目标、确定主要目标受众的宣传计划。开展网络安全宣教活动的第一步是确定该活动的具体目的和目标以及主要目标受众。开发有针对性的通信策略和资源，以便触及具体受众。每个人有着不同的网络安全需要。例如，学生需要了解“网络捕食者”，而IT专家需要对黑客有所了解。可对不同的材料进行开发，以符合每名受众的需要、知识和能力水平。

– 内情报告针对具体受众群体量身定做，旨在解决特殊的需要和威胁。诸如Stop.Think.Connect.™工具包等综合教育材料凸显了人们在网络安全领域的共同责任，帮助确保了社会的各个部分都能获得资源。招贴画、护腕等物件上面简简单单的提醒标语，可帮助人们始终把网络安全最佳做法视为重中之重。

– 使用社交媒体。在许多情况下，人们是在上网时提高网络安全认识的。使用社交媒体，即通过人们已经开始使用的或在某些情况下偏好使用的渠道，帮助人们了解网络安全认识的宣传信息。在Facebook、Twitter和YouTube等社交网络站点张贴信息提供了一种参与、分享信息以及同时获得真知灼见的方式。
使用传统媒体：广播与电视广播、报纸和杂志。

– 与目标受众中的盟友建立及保持合作关系。不论是政府机构、企业法人或非政府组织，没有组织能够单独进行网络安全认识宣传。因此，公共和私人部门之间的合作至关重要。可与以下组织建立并执行合作伙伴关系。

a. 政府机构。政府机构使藉自身权威进行宣传活动，并且可以广泛地向个人和各个社区推广。

可以使用中央计划对地方和地区政府进行培训，这样他们可以转而教育其雇员和选民，使其能够发现并制止网络危险。政府各级重要伙伴包括：计算机网络安全应急小组（CSIRTs）、首席信息安全官（CISOs）办事处和首席信息官（CIOs）办事处。

b. 非营利组织。非营利组织提供了传播网络安全认识信息所需的各种资源，同时保证了宣传的灵活性。

盈利伙伴包括战略计划识别的全部受众群体。涉及全部合伙组织的常规呼吁帮助在每个公共和私人组织间创建网络。

c. 学术机构。学术机构贡献了关键的、最新的研究，可帮助确保这项活动始终与时俱进，不断跟进最新信息。学术机构同时解决了国家未来的劳动力问题。与高中和小学开展合作同样十分重要，其原因在于，鼓励对青少年学生的网络安全认识教育可帮助他们在此后的人生中始终保持安全上网。与大学或研究中心开展合作，可以让受训劳动力和其未来雇主之间建立联系。

d. 私营部门组织。信息、零售、金融和教育服务等行业的领军企业可以对其雇员、客户和其他受众就会对其造成影响的各项威胁开展教育，同时吸纳关于加强网络安全实践的意见和建议。私营部门组织开发的创新型网络安全解决方案可以促进在公共部门和私营部门落实最佳做法。

– 通过基层工作实现受众人人参与。个人意识是高效实施网络安全认识宣传计划的基石。

例如，该“Stop.Think.Connect.™”活动欢迎用户进行注册以每月获取涵盖最新网络贴士、新闻和其他有关信息的电子简讯，让用户成为“该活动的朋友”。该活动还开展了为每位受众定制的推广活动，邀请演讲人员探讨受众最常遭遇的网络安全问题，以此服务于广大群众。

– 衡量该做法是否真正提高了目标受众的意识。为了衡量活动的有效性，从焦点组、各项调查或其他类似方法中收集反馈是十分重要的。此外，还要追踪哪些是受众最常浏览的网页、哪些是受众最多下载的资料，以及哪些是受众认为能助其实现成功及进步的最有效的做法。合作组织的反馈信息能够对未来人们就围绕有效性和开创性开展的各项规划提供帮助。

3.1.2 宣传计划范本

宣传计划为组织提供了一张路线图，为其目的目标完成方案的制定提供了指南，因此，宣传计划是活动欲取得成功的关键一环。虽然务必对宣传计划进行定制以使其符合特定组织的要求，但大部分计划包括以下几个部分：

目的和背景

目的和背景部分需明确组织创建宣传计划的背景理由，以及其计划达成的目的。

总体宣传目的

总体宣传目的系网络安全认识宣传计划的高层次目的。此类目的在战略层面牵涉广泛，例如：

为了推动公共网络安全认识，可提高人们对网络威胁和简单缓解手段的认知水平，以及让公众做足更充分的准备再上网：

– 提高网络安全认识，密切网络安全与国家安全和人身安全的关系；

– 动员公共和私营部门以及地方政府，以提高网络安全；

– 以公民一道创建并交流方法和策略，让公民自身、其家人和社区获得更加安全的上网体验。

宣传目标

宣传目标描述了该活动达成目标的方式，此类目标应可测量。

例如，上述目标可被阐述为以下目标：

– 就网络安全做法对公众开展教育，以便对其自身实施保护并确保相关组织注意到可用资源；

– 提高利益相关群体的参与数量，加强和地区政府、企业、非营利组织、学校系统和教育者之间的现有关系；

– 通过促进科学、技术、工程和数学（STEM）教育，提高并加强网络工作者的工作能力。

关键目标受众

明确关键受众帮助确保信息能够专门发送至最易于接受此类信息，或需要此类信息的群体。明确关键受众后，通过维持就受众称谓的含义所达成的共识，可让信息始终以特定群体为目标进行发送。

宣传渠道

宣传渠道是将消息向目标受众发送时所使用的各类手段。仔细考量当前使用的全部宣传方式以及可能可予使用的其他方式。宣传计划应明确规定此类渠道的有关信息及其使用方式。

例如：

– 活动：举办有目标受众群体参与的活动；

– 传统媒体：积极联系国家/地区/地方媒体（如广播、出版社、网站）；

– 社交媒体：积极使用社交媒体平台（官方博客、Facebook、Twitter）；

– 时事通讯：每月发送时事通讯以及信息工具包；

– 网站：定期对网站新闻、小贴士和关键信息进行更新；

– 合作方：鼓励合作组织开展推广活动。

3.1.3 宣传活动策略

活动策略考虑了如下两点：传播信息的实用方法；用以增强活动势头、促进活动发展的方法。每个大策略包含许多小步骤，此类小步骤和策略应具有充分的灵活度，从而能够适应不断变化的环境。例如，以下策略已经被用来实现某计划的宣传目的：

– 借助活动和媒体（包括社交媒体和传统媒体）传播活动消息

– 通过联合非政府组织和基层组织创建宣传骨干团体

– 就活动组织和消息发送实现跨政府机构合作

消息传送

所传送的头条消息应该专注于该活动旨在传播的基本、核心消息。每个国家和每项运动 – 及每名受众和活动 – 有着对量身定做信息发送的具体要求。头条消息是每项定制化宣传活动的基础。

例如，Stop.Think.Connect的头条消息包括：

– 停止：您在使用互联网前，要花些时间了解网络风险以及发现潜在问题的方法。

– 思考：花些时间确定前路无阻。注意警告信号并思考您的上网活动对您或您家人安全的影响程度。

– 连接：既然你已经采取了正确的方式确保自身及计算机的安全，那么就放心大胆地享受网络乐趣吧。

– Stop. Think. Connect.实现自我保护，让网络成为一个为全民服务的更加安全的所在。

其他普遍适用的消息包括：使用强密码、不断更新操作系统和安全软件、仅和您信任的人士建立联系，以及避免访问那些听起来好到让人难以置信的网站。

角色和职责

明确角色和职责可让各个团队高效配合，同时避免重复工作，让工作井然有序。在多个组织支持某项活动时，组织间就会出现角色和职责的划分，同时某个组织内的成员之间也进行角色和职责划分。

资源

通过列举活动可用资源，可明确特定时期内宣传活动的范围和局限。在此节中，作者可选择详述在特定时期内该组织可用的、为特定目标受众服务的专职人员及资源的数量。

宣传挑战

确定预期的宣传挑战可以帮助克服分歧和障碍。如：

– 受众难以从技术层面理解及思考网络威胁何以与其存在联系；

– 公众没必要将网络威胁视为真实或与日常生活有关的威胁。

3.1.4 计划成功实施的衡量标准

任何宣传计划都需要一种收集反馈和测量有效性的方法。鉴于网络安全宣教活动的性质，此类衡量方法通常重视向外活动而非收取信息，但及时收取反馈十分关键。

相关例子包括：

– 某区域内单场活动或一系列活动的参加人数；

– 所分发的画册与宣传品的数量；

– 媒体覆盖；

– 相关方的参与数量（如亲友、网络意识联盟成员、全国网络成员等）；

– 网站的访问量；

– 来自参与者及合作组织的反馈和评论精选；

– 来自立法机构、州和地方领袖/官员的反馈。

衡量标准

衡量标准分为几个大类。这些衡量分类用来区分网络安全认识计划，区分方式取决于计划的具体目标和资源。相关方参与可以促成与政府机构和非盈利组织之间的正式合作。传统媒体推广和数字和网络推广皆可通过建立宣传渠道来传播书面和多媒体产品。活动、论坛和资源每项都涵盖个人现场交流。欲理解并衡量某项活动的方方面面，则需要实现各类衡量标准的相互结合。

3.2 其他能力建设措施

3.2.1 在日本开展的活动

日本总务省（MIC）已经建立了公司合作项目：ACTIVE（高级网络威胁响应举措） ，以便协助互联网用户预防恶意软件感染以及减轻恶意软件感染发生后引起的损害。合作方包括MIC、互联网服务提供商（ISPs）和安全供应商。此类举措已减少了恶意软件的感染数量。

主要活动包括：

– 防止恶性软件感染；与互联网服务提供商开展合作；

– 防止恶性软件感染造成的损坏；与互联网服务提供商开展合作；

– 移除恶性软件；与互联网服务提供商开展合作。

图14：ACTIVE活动概览

ACTIVE的有效性

根据2016年5月23日的静态数据，自从ACTIVE开始运作以来，已向用户发送了286条恶性软件感染警告、拦截了320267个C&C服务器以防止损坏，并且向用户发送了1878条警告以便促其移除恶性软件。

除了基本运行以外，在各国执法机构组织的打击活动中，ACTIVE一直发挥着主要作用。ACTIVE从各国执法机构获取列明Game over Zeus、VAWTRAK等恶性软件感染的列表，并将此类列表交予参与活动的互联网服务供应商，以便其加快移除恶意软件。

3.2.2 在韩国开展的活动

韩国已经开发了一个由4部分组成的国家计划。第一部分包括通过发展基于性能的市场，为信息安全服务实施正确的公平付款系统，从而完善信息安全产业的结构。这包括信息安全持续性服务公平价格评估系统，这确保了有关产品的正确安全性能。

此外，政府可利用安全投资刺激措施，如侧重参与政府和公共采购及研发，从而吸引公司自愿对安全进行投资并采取积极措施。另一种方法是通过提供支持（如共享安全漏洞、试验台和国际认证支持）识别并培养信息安全创业公司，让优秀的安全创意造就成功的创业公司。

3.2.3 独联体区域开展的活动

俄罗斯联邦提交了一份文稿[9]，其中概述了独联体在信息安全领域的人员能力建设区域举措项目的成果。该项目确认：为加强使用ICT的信心和安全而开展人员能力建设是一项紧迫任务，为此，须将商业伙伴作为客户，教育系统作为承包商，并将国家作为整个过程的监管者。

俄罗斯联邦的文稿指出：独联体区域举措项目制定了标准的专业能力，在信息安全专家的培训和再培训方面，这种专业能力对教育方案的开发至关重要，具体包括以下内容：

1) 一般专业能力包括以下能力：

• 通过采用安全保障方法和手段来负责信息通信系统（ICS）的运行；

• 管理ICS中信息的软件和硬件保护；

• 开展ICS安全性评估工作；

• 构建分布式受保护ICS。

2) 使用软件方法和工具确保ICS运行的安全性，其中包括以下能力：

• 使用软件和硬件在ICS中提供信息安全（IS）；

• 使用技术手段在ICS中提供信息安全（IS）；

• 在ICS中提供具有复杂应用软件、硬件和技术资源的信息安全（IS）。

3) ICS中的信息管理软件和硬件保护能力，其中包括提供以下能力：

• 配置软件和硬件ICS保护；

• 执行维护规定，并对信息保护软件和硬件工具进行实时修复；

• 对ICS用户所允许的违规行为进行分析，并防止其复发。

4) 在ICS安全评估领域的能力：

• 监测硬件-软件信息保护手段的效率和效果；

• 在保护系统控制分析下应用ICS安全评估方法和技术；

• 在考虑到确保ICS保护要求的情况下进行实验和研究工作；

• 利用仪器对ICS保护进行监测；

• 在调查安全事件方面的专业知识。

5) 在分布式受保护ICS设计方面的能力：

• 在考虑到现行法规和指导文件的情况下，制定分布式安全ICS的要求及其补救措施；

• 分布式受保护ICS的设计；

• 可保护信息资源的分布式ICS的调试和维护，以及相关的信息安全组织和技术措施。

3.2.4 挪威开展的活动

挪威介绍了与研究制定有效的网络安全做法和提高国家网络恢复能力有关的国家经验[10]。为在挪威网络安全文化中注入新见解，挪威网络安全中心（NorSIS）进行了一项研究。该研究旨在为有效的网络安全做法制定依据，并提高国家的网络恢复能力。该研究包括网络安全文化指标的方法开发以及范围广泛的国家调查。NorSIS最近发布了“挪威网络安全文化”报告，其中包括了对该方法的全面介绍以及上述国家研究的主要结论。

3.3 私营-公共伙伴关系

在研究周期内，本课题收到了成员国提出的有关政府和行业合作和私营-公共伙伴关系的重要性的一些意见。成员国指出，管理关键基础设施的网络风险是一项非常复杂但极为重要的任务，克服网络安全挑战往往超出了政府或私营部门的独立管理的能力。

大不列颠及北爱尔兰联合王国提交了一份有关政府与行业网络安全问题的文稿[11]，该文稿提出了一种被称为“网络必备方案”的方法。在制定该方法之前，该国对一些网络攻击进行了分析，分析表明，在许多情况下，少数预防措施将减轻攻击的影响，或使对手的行动变得更加棘手。“网络必备方案”由英国政府和行业共同开发，旨在履行两项职能。该方案阐明了各类机构均应采取的基本控制措施，以在政府的网络安全十大步骤范围内减少基于常见互联网威胁的风险。通过保证框架，它还提供了相关机制，以令有关机构得以向客户、投资者、保险公司和其他各方展示其已采取此类必备预防措施。尽管该方案的开发重点针对的是英国的情况，但大部分工作同样适用于任何国家，且方案的细节可供所有人使用。“网络必备方案”在英国已取得成功，尽管该方案相对较新，但已有几百家机构获得了认证。

此外，美利坚合众国提交了有关与私营部门合作来管理网络风险的文稿[12]。在此文稿中，美国指出，公私伙伴关系是有效保护关键基础设施、提高网络恢复能力和实现整体网络风险管理的基本要素。同时，美国亦概述了与私营部门合作管理网络风险的重要性；阐述了美国的全社区网络风险管理方法，重点介绍了支持这种方法的关键工具；并给出了实现有效公私伙伴关系的具体实例。

日本的文稿[13]亦强调了必须在政府与私营部门之间开展合作这一共同主题，并介绍了日本在发展网络安全文化方面的知识、信息和最佳做法。日本的文稿概述了“网络” 、“个人”、“技术”以及“国际伙伴关系和协作”四大重点领域，其目的是确保信息和通信网络的可靠性。从“网络”角度来看，日本鼓励在电信运营商之间进行信息交流。例如，日本的19家主要互联网服务提供商和电信运营商在2002年自发成立了日本电信-信息交流和分析中心（ISAC）[14]，以在成员之间收集、分析和交流漏洞、事故、对策和最佳做法等安全信息。 从“个人”角度来看，日本通过网站和研讨会等手段提高了互联网用户的意识。从“技术”角度来看，日本推动了诸如PRACTICE项目等先进的研发项目。通过关注上述问题，日本为建设可靠的ICT网络和促进国际合作做出了贡献。

4 第4章 − 保护上网儿童（COP）

本章除其他事项外涉及第3/2号课题职责范围的（h）项：

h) 继续与其他相关活动合作，收集保护上网儿童方面的国家经验和需求。

一份文稿[15]同时处理第3/2号课题的职责范围（g）项：

g) 审查协助发展中国家的方式方法，重点关注LDC面临的网络安全挑战。

在当今的网络时代，上网安全是一个十分重要的问题，其中尤以儿童安全且有保障的上网体验为甚。与成年人相比，儿童在上网安全方面有着特殊需要和弱势，人们需要对这一差异予以重视。

儿童正在花越来越多的时间进行网上工作和娱乐。其中大部分时间被社交网络占据。有时，父母并未意识到孩子会在使用社交网络时分享个人信息，这让这些孩子成为“网络猎手”的攻击目标。

为了应对这些挑战，许多国家组织了网络宣教活动，旨在对政府机构、私人企业、教育者和公民个体（父母和儿童）开展教育，使其能够发现潜在问题，了解其在为儿童构建安全网络空间的活动中所发挥的作用和承担的责任。

4.1 保护上网儿童调查结果

关于保护上网儿童（COP）的调查问卷是通过收录成员国（特别是澳大利亚、英国和瓦努阿图）提供的问题而制定的。该调查问卷针对的是CIP立法和战略问题、事故报告方法和技术保护等具有相关性的关键问题。共有131个国家参与填写了该保护上网儿童调查问卷。调查问卷的结果显示，在这131个国家中，有37个国家确认实施了针对保护上网儿童的国家战略。同时，我们经观察发现，其中有101个国家拥有保护上网儿童措施，只有78个国家对保护上网儿童进行立法，而其他国家则缺少这类法规，但他们拥有COP技术保护等其他措施。

此外，在这131个回复调查问卷的国家中，有69个国家设置了专门负责保护上网儿童的政府机构。但是，已经建立COP实体或机构的国家数量和缺少这类机构的国家数量有着相同且显著的数量差。设置了儿童保护实体的国家数量明显更高。尽管其中有69个国家拥有这类实体，但只有63个国家拥有稳定的COP案例汇报系统。

图15：是否设置了负责保护上网儿童的机构/实体？

图16：是否设立了保护上网儿童问题汇报公共机制？

其中有50个国家拥有协助实施COP的技术能力，这可能会产生涉及COP机构、COP机构的负责领域及指定任务的诸多问题，或者说，由于这些机构刚刚成立不久，因此它们缺少报告系统或协助实施COP的技术能力。其原因在于，这些机构负责处理儿童的各项事务，而非专门处理保护上网儿童这一问题。由于这些机构的注意力会转向儿童遭遇的其他常见风险，因此这降低了他们对儿童上网风险的关注度。

图17：部署了哪些有助保护上网儿童的技术机制和能力？

政府和非政府组织就COP实施方法向利益攸关方提供知识和支持，就此类组织为实现这一目的而开展的活动而言，调查问卷的结果显示，实施此类活动的国家达62个，未实施的达68个，数字相对接近。

图18：政府或NGO是否开展了任何活动，为利益攸关方（家长、社区领导、教师等）提供有关如何保护上网儿童的支持和知识？

在利益攸关方之间传播该类保护文化能够起到教育作用，如果对该教育作用不予重视，则COP问题就不能得到解决，而且第2节（该节将提高网络安全认识视为关键问题及网络安全不可分割的一部分）已对COP进行了探讨，因此本章将更为详细地探讨教育对实现COP以及提高家长、教师的意识所起到的作用，以期帮助识别已经引起人们重视的各种缺陷。

关于教育对保护上网儿童所发挥的作用，一个常见问题是成员国是否已经设计了教育计划来保护上网儿童。调查结果显示，在131个受调查国家中，有54个国家已经设计了此类计划。

图19：网络安全公共宣教活动的开展及实施（与负责保护上网儿童的机构/实体相比而言）

值得注意的是，虽然在有些国家存在负责处理COP的实体，但这并不意味着此类实体能够很好地发挥教育职能。此外，虽然有些国家没有专门负责处理COP的实体，但这并不意味着这些国家不能很好地发挥教育职能。有实例为证：拥有这些COP实体的国家达69个，但并非所有国家都能够采用旨在保护上网儿童的教育计划，并且，尽管不具备这些COP实体的国家达62个，但其中某些国家已经设计并实施了旨在提高人们保护意识的有关计划。

对这些教育计划和其目标群体进行进一步审查后，审查结果显示，儿童系此类计划最主要的目标群体，其中有52个国家证实，儿童是其教育计划最主要的目标群体，而78个国家则无专门针对儿童的教育计划。

调查问卷结果表明，在这131个国家中，有50个国家为父母设计了教育计划，但是针对教师实施教育计划的国家数量最少（在受调查的131个国家中，只有47个国家实施了针对教师的教育计划）。

就宣教活动而言，在131个受调查国家中，84个国家（占64.12%）有专门为COP设计的宣教活动。在受调查成员国实施宣教活动的过程中，COP排在互联网安全之后，成为第二重要的网络安全问题时、以及当COP成为最重要的网络安全问题时，各成员国的工作重点有待界定，呼吁界定此类工作重点的国家占比与设计COP宣教活动的国家占比一致。

图20：针对儿童的保护上网儿童公共宣教活动

图21：关于保护上网儿童的公共宣教活动

77个国家专门为儿童制定了宣教计划，而仅有54个国家未专门针对儿童实施该类计划。调查问卷清楚标明，面向成人的保护上网儿童宣教活动或教育计划的占比与前者相同，74个国家证实拥有这类针对成年人的计划，57个国家标明其没有这类计划。基于这一点，我们注意到，需要以成人和儿童为宣教目标，这一点很重要。社会的各个阶层与COP问题存在着各种直接或间接联系，因此只有向各个社会阶层实施宣教活动，才能够充分提高人们的网络安全认识。在没有提高成人对潜在上网风险的警觉性，及缺少为确保保护上网儿童而需要采取的措施的情况下，儿童对此类风险的警觉性将难以得到充分提高。

4.2 保护上网儿童策略和技术解决方案

第2研究组第3/2号课题在研究期内收到的文件确认了某些可用策略和技术解决方案。如不同文件所示，不同利益攸关方、意识提升活动、企业参与和立法工作之间的合作，可切实地帮助明确旨在实现儿童安全上网的各项策略和政策。首先，将策略转变为行动是一项始于采集相关信息的长期过程。ITU-D第2研究组于2014年9月召开的会议收到了英国、澳大利亚和瓦努阿图提交的文稿[16]，提议采取行动就保护上网儿童（COP）向各成员国提供帮助。基于该建议，这些国家共同提出了诸多关于成员国的问题以待回答，以期更加全面地了解成员国应如何在全国范围内实施COP。其次，对解决方案的开发是一种需要不断反思和调整的动态过程，绝非静止过程。例如，经2015年第3/2号课题报告人组会议讨论，澳大利亚、巴布亚新几内亚、萨摩亚独立国、英国和瓦努阿图共和国[17]提出了一些关于保护上网儿童的问题修正案。建议将这些问题提交至研究组全体会议传阅，以供成员国对其予以完善（由成员国自身对其进行完善或通过更加详细的调查问卷进行完善）。这些问题关注国家层面上的保护上网儿童活动，包括立法、报告机制、各种能力以及向利益攸关方提供支持等。此外，为支持世界电信发展大会第67号决议（2014年，迪拜，修订版）[18]，英国、澳大利亚和瓦努阿图共和国联合提交了名为“支持父母提供保护上网儿童的最佳做法”的技术报告，并建议将所有利益攸关方纳入考虑（包括但不限于政府、父母、学校、儿童保护组织、警署和紧急服务、运营商和互联网服务提供商）。该报告强调对各方作用和责任进行界定、收集最佳做法并强调实施实证方法的重要性。

最后，需要注意到，在编制该报告的同时，应提交汇集了存在于不同环境下事项之信息的调查问卷，报告初稿应提交给利益攸关方供其参考和评价。

国家战略需要辅以技术解决方案：敖德萨波波夫国立通讯科学院（乌克兰）指出[19] ，为了实施独联体区域COP区域举措，科学院收集了保护上网儿童（内容过滤信息）的现存技术解决方案的数据（http://www.contentfiltering.info）。在这方面，研究组的专家制定了一个技术解决方案列表，这些解决方案以不同的特征为基础，这些特征例如实施类型（软件、硬件、云）；操作系统兼容性（单一平台、跨平台、平台独立）；操作系统类型（Windows、Unix、Marcos、安卓、iOS）；支持类型（完全支持系统、部分支持系统、不支持系统）；控制（远程控制、当地控制、无控制）；以及内部安全类型（受保护或不受保护的系统）。

列表中的每个技术解决方案都被安装在电脑或移动设备上（对于付费产品来说，要从开发者那里获取测试许可），每种功能都要经过详尽的测试。测试报告收集了每个解决方案，并进入了内容过滤信息的服务数据库。一旦进入了数据库，系统开发者会定期对每个产品的数据进行检查，如有必要，会对数据进行更新和增补。除此之外，内容过滤信息软件是在建议的基础上开发的（建议是为一个指定的用户/组织选择最好的内容过滤系统）。它由两个模块组成：

a) 用户模块（自由存取），用途是定义用户的技巧水平，阐述要求和选择内容过滤系统；

b) 专家模块（只供授权的专家使用），用来输入保护上网儿童的技术解决方案的数据。

敖德萨波波夫国立通讯科学院（乌克兰）[20] 还提供了有关安全使用互联网资源的多媒体远程学习课程信息（https://onlinesafety.info），作为国际电联有关独联体区域保护上网儿童举措的组成部分。

图22表明，尽管一些国家开展了有关保护上网儿童的宣教活动，但亦有相当数量的国家并未开展此类活动。

图22：有关儿童和成年人的保护上网儿童公共宣传活动对比

4.2.1 提高对保护上网儿童的认识和相关举措

韩国的文稿[21]强调了各国在国家层面上就与保护上网儿童有关的法律框架、社会活动和在线教育方面开展的不同工作。该文稿指出，由于儿童接触网络的平均年龄呈低幼化趋势，让儿童安全上网在很多国家已成为重要问题。特别注意的是，韩国文稿中强调了需要用自我调节的自愿措施对法律措施和强制措施进行补充。但是，这些措施在迅速产生可见结果的同时，也有一定的危险，即它们可能约束力过大，导致个体自由或服务用户的自主性受到侵犯。例如，韩国的法律措施（组织青少年在午夜后接触网络游戏）就触发了一场热烈的讨论，人们争论这个措施是否有价值、是否奏效。因此，在这个方面，应该通过对不同的利益相关者进行教育和宣传，来对法律措施和强制措施进行补充。

韩国发起的另一个话题是，很难在服务提供商和用户之间划清界限。家长可能会认为，服务提供商在提供服务时，应在儿童的网络安全方面付出更多的努力。然而，一些服务提供商可能会辩称：教育和觉悟是家长、教育者和监护人的责任。社会活动和计划可以帮助提供措施，这些措施会允许所有的利益相关者之间展开更多的合作，并鼓励他们积极投身到由政府支持的网络安全活动中。

在最不发达国家的环境下，[22]冈比亚共和国的文稿强调了急需将儿童网上保护整体作为国家网络安全框架的一部分。最不发达国家只是刚开始在不同的平台上从快速网络可用性中获利，这些平台比传统的台式机和笔记本电脑便宜。强调国际合作的重要性，不仅是共享所关注的话题，而且是针对国际政策的连贯性以及为进一步加强国际合作而推广活动。此文稿呼吁，将儿童网上保护纳入国家网络安全框架，并将其作为法律、技术、组织和程序问题的焦点，还要将其作为能力建设和国际合作的重点。

最后，来自ITU-T JCA-COP的联络声明[23]强调了在成员之间分享信息的重要性，其目的是引起第3/2号课题的关注。此外，它还分享了其关于韩国、冈比亚以及非政府组织（例如Defz Kidz）的国家活动的认知。

4.2.2 保护上网儿童战略

根据所收到的文稿，归纳出以下战略供成员国采纳：

– 不同利益攸关方之间的合作；

– 宣教运动；

– 行业参与；

– 立法工作；

– 制定适当的报告机制；

– 提高利益攸关方的能力；

– 向所有利益攸关方提供支持和知识；

– 建立涉及所有利益攸关方（包括但不限于：政府、家长、学校、儿童保护组织、警察和紧急服务机构、运营商和互联网服务提供商）的机制；

– 就利益攸关方的作用和责任做出明确规定—谁在什么时间做什么以及如何做；

– 收集关于保护上网儿童的现有技术解决方案的最佳做法数据；

– 在利益攸关方之间传播相关信息；

– 实施基于证据的方法。

5 第5章 − 网络安全讲习班的结果

本章除其他职责涉及第3/2号课题职责范围的（i）项：

i) 举办专门会议、研讨会和讲习班分享有关采取有效、高效和有用的措施和活动、强化网络安全的知识、信息和最佳做法，以便尽可能利用与第1研究组会议或报告人组会议同时同地举办的会议的成果。

ITU-D第2研究组、BDT、其他部门、产业以及学术界之间合作的形式之一包括研究期内的一系列讲习班。附件2中包括了很多文稿。现对上述合作总结如下：

5.1 首届网络安全讲习班（2015年9月8日）

关于“全球网络安全挑战 – 开展合作，以在发展中国家有效加强网络安全”[24]的首届网络安全讲习班于2015年9月8日下午与ITU-D第2研究组和ITU-T第17研究组（安全）的会议并行召开，在此之前，召开了ITU-D第2研究组3/2号课题会议。

讲习班的目的

网络安全讲习班的目的是就与加强网络安全能力建设的国际、区域和国家层面方法有关的最佳做法进行交流，并就发展中国家在网络安全能力建设方面的关切进行交流，以努力找到可由国际组织、主管部门和私营部门合作解决此类关切的创新和务实方法。

议程

Y.塔瑞格先生（BDT电信发展局副主任）和R.肖勒先生（电信标准化局副主任）致开场白后，议程包括两个会期，包含报告和小组讨论：

– 第一节会议：发展中国家中有效的网络安全提升的多层次战略方法的最佳实践（3个报告和小组讨论）

– 第二节会议：发展中国家面临的挑战；促进网络安全举措的国际合作（3个报告和小组讨论）

讨论与讲习班的结论

在讲习班上，对于发展中国家中有效的网络安全提升的多层次战略方法的最佳实践、促进网络安全举措的国际合作方面的问题，有一些很有价值的、令人增长见闻的报告、小组讨论和问答。通过两节会议，网络安全的以下几个方面的重要性得以强调，并在讲习班与会者之间得以共享：

– 让所有利益相关者意识到网络安全的重要性；

– 让所有相关方参与国家网络安全战略的实施；

– 在网络安全战略中明确网络安全原则，例如信息自由流通、法规、自我管理、开放性与多方利益相关者；

– 在国家战略中明确角色身份与责任；

– 在国家战略中明确一系列目标；

– 风险管理方法；

– 网络安全的国家法律法规；

– 技术规章，包括标准和程序；

– 同国际、区域倡导合作。

人们表示期待还有举办此类讲习班的机会，并且期待讨论内容更新。重要的是，让信息和观点有机会在与会者之间得以分享，并让A.萨拉法特先生（ITU-D第2研究组主席）和A.克雷默先生（ITU-T第17研究组主席）重申在ITU-T第17研究组（安全）和ITU-D第2研究组（特别是第3/2号课题）之间展开更多的合作。讲习班的结果随后将向ITU-D第2研究组第3号课题和ITU-T第17研究组报告。

5.2 第二届网络安全讲习班（2016年4月19-20日）

题为“通过良好做法制定国家网络演习和国家网络安全战略”[25]的第二届网络安全讲习班于2016年4月18日下午和2016年4月19日上午与ITU-D第2研究组第3/2号课题“保障信息和通信网络的安全：培育网络安全文化的最佳做法”报告人组会议一起召开。本届讲习班是BDT的网络安全团队在ITU-D研究组的支持下举办的。多名演讲者在讲习班上发言。

讲习班的目的

网络安全讲习班的目的是，在提升网络安全能力建设方面分享最佳的国际、区域、国家层面的方法。讲习班致力于：

– 与发展中国家分享国家网络演练经验，以更好地了解他们的需要，特别是因为当前国际电联正在规划一项新的国家网络演练服务来提供给成员国；

– 在准备和实施国家网络安全策略（NCS）方面分享学到的知识和专家建议，国际电联与成员国分享多方利益相关者方法（方法用于新国家网络安全策略（NCS）toolkit）方面的工作进展。

议程

Yushi Torigoe先生（BDT董事副董事长）和的开场主持过后，讲习班开始，议程包括三个会期，包含报告和小组讨论：

– 4月18日的会议：通过分享经验，促进国家网络演练。

– 4月19日的会议：准备全面的国家网络安全战略的关键要素。

– 4月19日的会议：国家网络安全战略的有效实施。

讨论与讲习班的结论

讲习班提供了一些很有价值的、令人增长见闻的报告、小组讨论和问答。经过会期，网络安全的以下几个方面的重要性得以强调并在讲习班与会者之间得以共享：

– 国家网络演练情景应当现实一些（不要像电影一样），用于获取顶层管理购买和预算；

– 国家网络演练需要通过积极的信息分享，在规划阶段涉及所有相关方（包括政府和私营部门）；

– 国家网络演练的目标必须有明确定义，且必须有价值；

– 以风险管理方法为基础，选择国家网络演练情景 – 回答“最大的威胁或冲击力是什么？”这个问题并在这个问题基础上选择；

– 一些国家网络演练是用来检验国家应急计划的；

– 国家网络安全战略是否应被公开？这个阶段没有确切回答，但对于公民来说至少部分战略应被公开；

– NCS发展的风险管理方法是识别和实现正确目标的一个关键因素；

– 关键基础设施（CIP）是网络安全的关键，且它通常是一个公私伙伴关系问题，因此NCS要求有私营部门参与；

– 成立一个团队并任命领导，了解他人在做什么，由专业团队来开展工作。同时利用NCS工具包；

– NCS是网络安全的圣经。目标和措施必须准确。将NCS与CIP和你的社会经济状况联系起来。实施的时候对其进行适当监控；

– 私营部门实体和政府没有相同的目标，且目标需要校准，通过规章和立法将NCS和CIPs的PPP制度化；

– 对于以前还没有做过网络安全战略的国家来说，实施网络安全战略要花时间购买以及将第一次迁出清空。当与国家的信息社会发展战略联系起来时，可促进资金和验收；

– 网络安全战略实施要求详细的带预算的行动计划。

– 影响分析的重要性已经被列为NCS发展/实施循环的一部分；

– 实施计划应当包含电子政务厅下的安全数据转移。

– 指数（GCI等）在衡量和实施方面，以及作为NCS的清单，变得越来越重要；

– 爱沙尼亚共和国的国家网络安全指数（方法在2016年5月发布）。当时强调国际电联全球网络安全指数可作为补充；

– 英国国家网络安全战略将于2016年发布；

– NCS评价很耗费时间，这可能很令人尴尬，但对资金安全有利；

– 当为了寻求一个共同理解，以及所有利益相关者要建立的愿景而详尽阐述NCS时，网络安全战略普遍定义很重要。一个共同的理解比一个普遍定义更重要。

在讲习班圆满结束时，Luc Dandurand先生强调了在与会者和专家之间分享信息/观点的重要性，并强调了需要继续与ITU-D第2研究组第3/2号课题进行合作。Ahmad Sharafat先生（ITU-D第2研究组主席）在闭幕词中提到，对ITU-D第2研究组第3/2号课题而言，组织网络安全讲习班正在成为一个传统，希望这个传统得以延续。来自学术界，他发现在这次交流中受益匪浅。讲习班的结果报告给ITU-D第2研究组第3/2号课题。

5.3 第三届网络安全讲习班（2017年1月26日）

2017年1月26日下午，与ITU-D第2研究组报告人会议并行举办了题为“实践中的网络安全和风险评估”[26]的网络安全讲习班，并于此后召开了ITU-D第2研究组关于第3/2号课题 的会议。

讲习班的目的

讲习班的目的是汇集来自全球各地的专家，他们将在国家层面上就超大型机构和关键基础设施部门内的网络风险实际评估知识和经验进行交流。讲习班还将讨论供应链风险以及机构内网络风险管理标准的作用。

议程

电信发展局官员首先致开幕词，随后讲习班正式开始工作，其议程包括了五个演讲和小组讨论，即：

– 2017年及以后的首要网络安全威胁；

– 私营部门用于评估大型机构内的网络风险的方法和工具；

– 关键基础设施部门内的网络风险评估；

– 供应链风险；

– 标准和ISO/IEC 27000系列更新的作用。

讨论和讲习班的结论

第三届讲习班提供了内容翔实和颇有裨益的演讲、小组讨论和问答。在整个会议期间，强调了网络安全的以下方面的重要性，并在讲习班参与者中进行了相关交流：

– 在阐述首要网络安全威胁问题时，讲习班介绍了网络物理融合、工作生活融合、内部威胁、资金动机攻击的兴起、基于物联网的DDos攻击和“简单”违规的兴起，并向各机构提出了相关建议。

– 提出了私营部门的风险评估挑战，如多重标准、外部审计、部门监管要求、兼并和收购/多样化/国际拓展以及网络控制的成本效益，并提出了有关这些挑战的方法实例，其中包括治理和风险软件、安全操作方法、战术风险检测工具和漏洞管理。

– 介绍了关于保护关键基础设施免收网络风险侵袭的国家战略，并重点介绍了CIPP的网络风险评估问题（航空案例中的方法、出发点和程序漏洞）。

– 阐述了ICT供应链安全及其挑战和要求，并讨论了以下关键问题：(1) 解决全面风险管理方案中的风险问题；(2) 了解共同需求；(3) 使用国际标准；(4) 利用购买力；(5) 与伙伴合作。

– 介绍了风险管理国际标准的作用以及ISO/IEC JTC1 SC27中ISO/IEC 27000系列文件的最新更新情况。

在讲习班讨论期间和闭幕发言中，还强调了在与会者和专家之间进行意见交流的重要性，以及继续与ITU-D第2研究组第3/2号课题开展合作的必要性。

6 第6章 – 网络安全机遇和挑战

ITU-D第3/2号课题花了一些时间对其他领域开展了研究，其中的许多领域与其他机构正常开展的工作有关，但第3/2号课题目前的职责范围并未包括这些工作领域。在不同机构之间进行了很多正式与非正式的对话。在此对与职责范围b)有关的文稿做进一步的分析。

b) 提供有关当前网络安全挑战，即服务提供商、监管机构和其他相关方所面临的挑战的信息。

6.1 网瘾

随着国家步入一个信息与网络广泛传播、使用的时代，“网瘾”已经出现，并成为该时代的负面效应。虽然“网瘾”的概念已有明确的医学和心理学术语定义，“网瘾”通常指人们的身体功能、心理功能和社会功能所遭受的难以恢复的损害，这些损害由过度使用IT网络服务导致。大多数网瘾者都有戒断症状和耐受性症状（例如极度焦虑或神经失常），这些症状成为了他们日常生活中的严重阻碍。深陷网络世界，过度使用网络的人以多种形式（游戏成瘾、聊天成瘾、色情成瘾等）显现出症状。近几年来，迅速涌现的智能媒体使用、融合与趋同方面的ICT演进，使人们的生活方式与交流方式发生了飞速变化，智能媒体成瘾也随之出现。

韩国在预防与减少网瘾和智能手机成瘾现象方面开展的工作

在韩国，据2013年网瘾现状调查显示，5至54岁的互联网使用者中，大约7%为网瘾高危人群。在韩国，网瘾高危人群占互联网使用者总数的比例在2011年为7.7%，到2012年降至7.2%，到2013年降至7.0%。但青少年网瘾高危人群的比例在2011年为10.4%，到2012年升至10.7%，到2013年升至11.7%。[27]

同时，人们发现，对智能手机成瘾的现象比对网络成瘾的现象增加得更明显。在韩国，在10至54岁的智能手机使用者中，大约11.8 %为过度使用智能手机的高危人群，这个比例比2011年（智能手机成瘾调查开始的时候）的8.4%增加了3.4%。青少年智能手机使用者最容易对智能手机成瘾：大约25.5%的韩国青少年（10至19岁）是过度使用智能手机的高危人群，在韩国成年人中，这个比例为8.9%。韩国网瘾中心由韩国政府成立于2002年，目前已经实施了综合项目，即咨询、内容开发与分配、专业心理咨询师培训、以及面向全国开展的预防教育，以系统地应对网络和智能设备的过度使用。自2004年起，韩国网瘾中心每年对民众进行网瘾现状调查（并自2011年起进行智能手机成瘾调查），产生的全国性统计结果作为政府政策发展的参考指数。

2013年6月，政府的八个部门联合成立了一个“预防与减少网瘾和智能手机成瘾第二综合计划”。项目确定了全面的预防方面的、咨询方面的、精神方面的以及后续的援助，这些援助适用于幼儿、学生及成年人等所有年龄组的人。

政府实行了部门共通政策委员会，以系统地应对网络成瘾。2014年3月，该委员会成立了“预防与减少网瘾执行计划”。该计划在政府的八个部门政策委员会的管理下有效、系统地开展实施。

预防教育

人们在日常生活中极易接触到网络和智能媒体，因此教育应当在人们出现成瘾症状（如戒断症状和耐受性症状）之前就注重预防。韩国教育计划被设置为有效的预防，目标是提升公众意识（这种意识是关于成瘾的潜在危险和实际危险）、帮助人们更好地预防成瘾。例如，该教育计划提供预防教育，使其课程适应幼儿、学生和成年人等不同年龄阶段的人的需要。还派专业的心理咨询师到学校为学生上一节特别的课（一个小时） 。

在韩国，自2013年起，强化（两个小时）教育计划已可适用于小学、中学和高校学生；每门课程都是根据不同学龄设置的，强调让学生积极参与课堂活动并在课堂活动中进行讨论。在课程中，每名学生将自己的“作业本”作为自我诊断工具，自行监视自己使用网络和智能媒体的情况并进行记录，有时当他们发现自己用网过度时，会下决心减少用网。

表1：预防教育参与者数量

教育对象

2010年

2011年

2012年

2013年

2014年6月

总人数

学龄前儿童

-

31,279

18,200

47,890

26,050

123,419

青少年

645,981

954,425

621,621

970,696

407,512

3,600,235

成年人

33,753

90,363

93,001

105,363

25,803

348,283

总人数

679,734

1,076,067

732,822

1,123,949

459,365

4,071,937

（单位：人）

自2014年起，为寓教于乐，已开始为学龄前儿童和低年级小学生带来了“防沉迷话剧计划”。在这个过程中，孩子们会看一个话剧或木偶戏。话剧或木偶戏讲述孩子最喜欢的小动物在生活中沉迷网络的故事，或讲述日常生活中的网瘾故事。看过话剧之后，老师告诉孩子们网瘾的危害以及如何预防网瘾。这个计划的有效性在于，能够使孩子容易地理解成瘾的概念而从中不带一丝抵触情绪。

该计划还为23所被指定为“智能媒体环境优美校园”的学校提供了援助。该项计划通过与家长、教师、专家进行合作，来支持学校活动/竞赛，以便为学生营造一个良好的智能媒体使用环境，并帮助孩子预防网瘾。

咨询服务与基础设施建设

为有效解决网瘾和智能手机成瘾，韩国的科技部、ICT和未来规划（MSIP）实施了预防教育，提供了专业的咨询服务。为提供区域特定服务，MSIP经营着14家网络成瘾防治中心（IAPCs），这些中心于2014年6月在全国的13个城市或省成立。

MSIP通过多种渠道（例如家访或在线服务）提供专业的咨询服务。人们对咨询服务与日俱增，这些专业的咨询服务可以满足人们的需求，且这类服务容易获得[28]。在线咨询服务以及全国热线服务中心均可使用。为提供区域特定服务，以应对全国范围内出现的网瘾，中心与其他48家相关中心（例如健康家庭支持中心、青年支持中心等）共同提供咨询服务。

家访咨询服务通过走访人们的家庭为人们提供咨询服务，值得特别关注。任何遭受网瘾的家庭均可申请该项服务。该服务项目对于需要帮助的网瘾者（尤其是来自单亲家庭、低收入家庭或与祖父母一起生活的人）来说非常有效。此外，任何需要帮助的网瘾者（无论是儿童、青少年、失业人士或双职工家庭）均可申请该项服务。中心也经营着一个培训项目，培养专业的有关网瘾方面的心理咨询师。该培训项目适用于现任的心理咨询师和在职教师，他们也可以通过培训实践成为有关网瘾方面的专业心理咨询师。到2014年6月，该项目已经培养了13000多位专业心理咨询师。

表2：咨询服务类型的数量

咨询类别

2010年

2011年

2012年

2013年

2014年6月

面对面咨询

（家访）

15,037

10,522

（6,089）

20,701

（10,595）

24,623

（19,519）

7,484

（4,919）

在线咨询

1,916

569

866

489

148

电话咨询

9,569

7,915

16,138

11,512

4,779

合计

26,522

19,006

37,705

36,624

12,411

（单位：服务次数）

进行调查研究与发展/分发内容

MSIP定期开展研究，以保证各种各样的网瘾与智能媒体成瘾执行计划的运作效率得以提升、科学准确性得以增强。各种各样的教育材料例如预防指导读本、动画、录像、标准教材或咨询项目已经可以在网页使用。开发这些材料是为有效地实施预防教育，并帮助人们更好地认识到使用网络或智能媒体的潜在危险。

2013年，MSIP开发并分发了有关强化预防成瘾的标准教材。课程有四个版本，适用于不同的年龄阶段的人（即小学生、中学生、高等院校学生以及成年人）。此外，MSIP开发了正确使用智能媒体的指导原则，并印发了四个版本，供四个年龄段的读者（学龄前的儿童的家长、小学生、中学生、高等院校学生）使用。指导原则已被分发至全国20000多所学校。2014年，MSIP开发了五种自学形式的关于预防成瘾的教育内容（适用于学龄前儿童、小学生、中学生、大学生和成年人），这能够帮助学校和公共机构更好地为提供预防成瘾教育课程做准备，这已成为韩国经修订的国家信息基本法（2013年5月）第30项第8条（使教育涉及预防网瘾）中规定的强制性内容。

MSIP通过与私营部门合作，用宣传的方式预防智能媒体成瘾。因此可以帮助青少年和家长防止过度使用智能媒体，使他们养成在校和在家正确使用智能媒体的习惯。

韩国政策特色

在韩国，大多数活动由政府发起，因此韩国政府能够为民间组织开展预防网瘾活动提供经济和技术支持。政府委员会的强大也体现在，不允许16岁以下的孩子在午夜至早晨6点之间接触网络游戏，家长也可以向服务提供商发出请求，监督和阻止孩子（18岁以下的孩子）接触网络游戏；且从幼儿园到大学的所有学生以及公共部门的所有职员应当接受法律规定的预防网瘾教育培训。与此同时，政府在全国有14家网瘾防治中心。韩国政府在预防网瘾中面临的最大的挑战是，如何让相关人群参与其中，特别是家长、社区以及私立机构。

总结

成瘾是一个基本的健康问题。针对这个问题，ITU-D第3/2号课题与世界卫生组织（WHO）展开了讨论，以使其关注此问题。在此方面，在2014-2017年研究期内，已向WHO以及UNICEF、UNESCO和国际电联理事会保护上网儿童工作组（ITU CWG-COP）发出有关互联网上瘾问题联络声明，以便更好地了解迄今为止开展的活动。这些讨论尚无结论，仍在进行。

6.2 电子交易的安全性

包括在线采购和支付、执行股票市场订单、在线行政税收申请（VAT、所得税、电子医疗保健表）、电子邮件和电子文件交换在内的电子商务和电子交易的发展；尤其是DNSSEC、RPKI（资源公共密钥基础设施）等基于公共密钥基础设施的新网络安全协议的落实及其持续的大规模部署，以及物联网安全，都是激励发展中国家为建立国家和区域负责其公共密钥基础设施管理的机构的要素。在妥善监督下，这些机构的建设有助于强化总体的电子通信安全，尤其是电子交易的安全。它们还可以促使发展中国家数字经济的发展壮大。[29]

发展中国家的电子商务和交易正在迅速发展。但这些交易通常使用不安全的信道。向它们提供的安全保护，是以自己签署的证书或利用从通常驻发展中国家的认证机构购买的证书为基础。然而在某些情况下，这些证书不一定符合发展中国家的立法。

发展中国家对部署DNSSEC和RPKI等安全协议缺乏热情和拖沓的情况，是出于对落实的协议或标准的误解，或由于参与部署的训练有素的人力资源不足，或由于缺乏对价值链的掌控。

针对这个问题，第3/2号课题请很多机构发表了评论。该组从ISOC处获得的关于此问题的看法很有价值，我们在此呈现出来。

公钥基础设施（PKI）系统作为一个经济与社会发展的安全平台，对提升信任具有重要的作用。这些系统在支持技术和实施行动方面已经历经数次演进，使自身更加坚固和安全。重要的是，国家应当在此经验上改进网络基础设施，部署最先进的技术，运用最佳惯例。

互联网协会人员在建立与部署公钥基础设施方面有丰富的经验。我们有信任和身份主动性，可以支持在网上进行安全、真实可靠的交流。互联网协会还运行“部署360”程序，可以促进基础设施安全技术（包括传输层安全（TLS）、DNS安全扩展（DNSSEC）、资源PKI（RPKI）的广泛部署。

互联网协会维护与这些话题相关的信息资源及额外参考资料。这些参考资料解释如何建立根证书颁发机构、使用TLS、DNSSEC和RPKI的案例，以及如何部署这些技术，并对进一步功能建立提供援助。起点是我们的互联网技术问题和部署360网页。

本文件讨论三个不同的PKI系统（WebPKI、RPKI和DNSSEC），这些PKI系统影响网络整体信任度和安全性。它突出了一个重要的事实，即这些PKI系统是不同的，且服务目的也不同。他们有不同的层次，在分别的管理网域运行。本文件还介绍了一种新兴技术，基于DNS的命名实体认证（DANE），DANE确保增强网络信任度。

不太可能将国家认证中心作为安全问题（一国可能面临的安全问题）的解决方法。努力应对安全问题的各国应将目光转向可在全球协作中采用的新兴技术和最佳现行做法。

WebPKI

本文件中讨论的第一个PKI系统是WebPKI。公众信任的由认证中心（CAs）发布的X.509基础上的证书是技术供应商（如苹果、微软和Mozilla）认证的，这些技术供应商在他们的运行系统和浏览器中分发根证书。WebPKI通常使用这些证书保障网页浏览会话、电子邮件传递和即时通信的安全。这些证书还可用于证明访问系统使用者的真实性，也可用于在电子协议和软件上签名。国家立法越来越倾向于用电子签名替代传统的身份验证。

使根证书进入从全球网络PKI根服务器分销处，这个过程复杂、花费高、耗时长。此过程包括三个基本组成部分：

1) 为认证中心建立要求，使其允许发布和管理证书；

2) 对认证中心进行审核，确保其遵循过程和要求；

3) 将认证中心加入到一系列的人们信任的认证中心，在生产过程中完成。认证中心/浏览器论坛（见“基本要求”）为证书的发行和管理建立指导原则。

随后，一系列的审核程序会对这些要求进行检测。这些审核程序由认证机构AICPA/CICA网络信任程序来管理。在产品默认的情况下，技术供应商使用这些审核结果来决定添加何种认证中心。使用者和企业有时也可以对他们的装置添加额外的认证中心，但在这个进程中要考虑很多重要的操作性问题。

然而，应当注意的是，在全球根认证分销商中添加新的根认证，这并不会使整体的WebPKI变得更加安全。相反，它会增加风险，因为一个认证中心的脆弱性就会使整个系统都脆弱。出于上述原因，在可行的情况下，还是将根证书的数量控制得越少越好。如果需要政府建立他们自己的认证中心，一个常用的方法是，在已有的根认证中心下建立子认证中心。

关于WebPKI系统的脆弱性，人们有很多担心的问题。互联网架构委员会（IAB）最近在https://datatracker.ietf.org/doc/draft-iab-web-pki-problems/中的隐私与安全计划上做出努力，解释这些问题并对行动提出建议，帮助改进基础设施。对于一些想要寻找方式使PKI系统提升自身的安全性的机构，可以从这个计划中获利。

RPKI

本文件提到的第二个PKI系统是RPKI。RPKI是一个专门的PKI，针对提升网络路由系统的安全性，具体来说就是边界网关协议（BGP）。为证实这些资源的授权任务，RPKI通过X.509基础上的资源证书发布给持有者的IP地址和AS号码来提升网络路由系统的安全性。这些证书由五个区域互联网注册机构（RIRs）中的一个机构发布给当地的互联网注册机构（LIRs）。这五个区域互联网注册机构（RIRs）分别是AfriNIC、APNIC、ARIN、LACNIC和RIPE NCC，他们的负责在他们的服务区域对这些资源进行安排和分配。

虽然每个RIR的根证书没有被包含在任何公共根证书分销商，但对于那些在它们的服务区域分配的资源来说，每个RIR都扮演着根认证中心和信任锚的角色。因此有必要从RIR网页下载和安装RIR。

值得注意的是，除了APNIC区域的七个传统的国家互联网注册机构（NIRS）外，不在国家基础上对号码资源进行安排和分配。然而，国家政府可以鼓励ISPs和其他的LIRs使用RPKI设施。

DNSSEC

本文件中讨论的最后一个PKI系统是DNSSEC。域名系统（DNS）的用途是，将人们能够读懂的主机名（例如www.isoc.org）翻译成机器能够读懂的IP地址（例如212.110.167.157）。DNS已经成为了定位互联网服务的主要方法。然而，由于很多不同的组织都管理DNS，且由于它的分布式特征，这意味着变化信息不会立即通过互联网传送，很难保证信息的返回的来源地可靠性。也就是说，名服务程序可能会将错误信息提供给直接用户，再到主机（主机作为其他网站来监视直接用户的交易或共享上网）。

DNSSEC是由IETF设计的，用于通过DNS记录的电子签名证实DNS信息的真实性。这个只能在一种情况下保证，即域名持有人能进行改变，并且记录从信任链到根带一直都有效。这意味着，进行查询的客户能够证明返回的问题是来自一个授权实体，这个授权实体提供问题解答。

人们可以认为带有DNSSEC支持的DNS是PKI的一个专门类型。然而，即使TLDs已被越来越多的人签署，DNSSEC的部署仍然很有限。国家域管理员通过在他们的国家DNS层面签署他们的国家代码顶级域名区和促进DNSSEC部署的方式，在保障这个重要的基础设施方面扮演重要角色。此外，部署DNSSEC将允许应用DANE技术（下面讨论的DANE技术）来改进WebPKI。

DANE

WebPKI的一个固有弱点就是，第三方认证中心能够对域或组织发布证书，不管请求实体是否拥有证书，否则它会控制那个域。随着认证中心数量的增加，认证中心发布错误证书的风险也随之增加。PKI系统的可信度很低。这也是公共根证书分销商一直加强认证中心的准入要求的原因（在上述的WebPKI部分有所提及）。

即使随着几个备受关注的事件（认证中心发布错误证书），证书发布程序有了切实收紧，但系统还是依赖第三方信任。这种依赖最近已经促进了基于DNS的命名实体认证（DANE）协议的发展。使用DANE，一个域管理员可以通过把公共密钥储存在DNS中来证实他们的公共密钥。这种方法需要使用DNSSEC和大多数的浏览器（浏览器近期要求安装附加物）。此外，DANE可能要求更严格的域名持有人确认，且这种努力最终可能落到TLD注册处而不是认证中心。

国家认证中心

以上描述的所有PKI系统都是用来通过证明互联网资源（例如地址、域名和服务器基础设施）地真实性来提供全球信托。这些系统独立于内容（内容是通过互联网在认证机构之间传递的）。信任是通过全球共识下的操作程序来建立的。这些程序最终是被终端实体控制的，这些实体选择信任他们的系统中配置的认证中心。例如，运用认证中心来规范内容可能会导致违背信任而且使认证中心作为信任的一方被撤回。让国家认证中心来解决国家面临的安全问题，是不太可能的。

其他方面也强化了这个观点。ICANN的反应是，他们具体指出了添加额外的认证中心一定程度上会扩大系统的受攻击面。系统的安全程度仅相当于整套系统中安全系数最低的或信赖度最低的认证中心，嵌入依赖方软件中的任何带有根证书的认证中心都意味着可能有潜在问题。结果就是，任何一个认证中心的妥协或不当之处都会摧毁整个系统的安全性和可信度。他们指出，他们察觉到了未来的情况，就是使用基于域的安全（DNSSEC）和基于DNS的命名实体认证，以及认证透明度方法来帮助限制风险。他们建议利益相关成员与IETF和认证中心浏览器论坛展开合作。

RIPE NCC是区域互联网注册管理机构，覆盖欧洲的大部分及其他地方，对讨论RPKI做出回应。RIPE提供多种形式的在线培训，并建议发展中国家（尤其是他们的公共管理）应该能够充分利用RPKI系统（RPKI系统由RIRs管理），方式是作出榜样并鼓励他们自己国家的私人运营商从他们持有的互联网数据资源中获取认证证书。全球如果有更多的网络运营商使用RPKI系统，就会允许更多运营商在RPKI证书验证方面有更多的基础的路由决策，为人们呈现更安全的网络路由系统。[30]

6.3 网络安全中的合作关系

之前在报告中的第四部分提到的一个共同主题是网络安全中的合作关系的重要性（这个主题在不同部分中均有概述）。应对这些挑战不能单靠政府、私人企业或国际组织，而是要求以合作方式应对挑战。美国与荷兰在他们共同做出贡献的全球网络技术论坛（GFCE）[31]（文件2/332）中强调了这个问题。他们的贡献是，提供了GFCE的背景与纲要。GFCE是一个关键的多方利益相关者，其自愿主动地促进国际团结，并针对网络安全问题，为加强所有的利益相关者之间的国际合作提供政治、技术、经济支持。GFCE促使网络能够容纳安全利益、经济利益和人权。GFCE的作用是扩大网络容量、加强专业知识，以使现有的国际合作更加有效。

其他领域

一些文稿研究了与网络安全有关的其他问题，其中包括：网络安全与银行业的关系 [32] ；采取技术中立方法的必要性；个人数据泄露的风险；实现灵活智能城市的必要性 [33] 。在研究期内尚未对这些领域进行深入探讨。

7 第7章 − 具有通用安全标准框架的国家经验

第3/2号课题的职责范围要求我们对具有通用安全标准框架的国家经验着手开展研究。作为此类研究的一部分，第3/2号课题收到了来自大不列颠及北爱尔兰联合王国的文稿[34]，其中概述了该国的经验，指出通用标准是有信誉、开放和国际化的方案，有助于IT系统的设计和实施人员选择具有适当安全保证级别的IT产品。尽管在保证系统安全方面并无单一的工具或方法，但通用标准已成为公认的成熟方案，可帮助采购者选择具有较高安全保证要求的产品。通用标准认可协议（CCRA）自2000年以来即已存在。其功能是提高经可靠评估的IT安全产品的可用性，并消除重复评估的负担。安全测试则根据商定的标准在独立实验室中进行。实验室须先获得证明自身胜任和独立的许可。最近（2014年）已对CCRA进行了更新，以支持更详细的规范方法，并汇集行业和学术界的专家来确定各技术领域的基本要求，随后则由各方对此类基本要求加以明确评估。

第3/2号课题还收到了伊朗伊斯兰共和国的两份文稿，着手研究替代方法。一个观点是，国家层面上的网络安全评估要求对网络安全指标进行连续测量。要计划和落实国家网络安全管理系统（NCMS），当务之急是发展一个合理的国家网络安全测试程序（NCMP）。NCMP促进了决策，并在国家层面完善绩效和责任制。[35]

第二份文稿中提到，需要用最佳实践框架（这种最佳实践框架用来识别和使用一系列措施和衡量方法）来评估国家层面上的信息安全管理系统的有效性。同NCSec框架 [36]（NCSec框架是受了ISO/IEC 27001[37]（组织层面上的ISMS）[38]的启发）类似，在ISO/IEC 27004[39]和NIST-800-55-R1[40]（两个框架都是用来评估组织层面上的网络安全）的启发下提出了“国家网络安全衡量框架”。此外，与受ISO/IEC 27001启发的案例一样，在国家层面需要“定义如何衡量所选择的控件或一组控件的有效性，以及明确怎样使用这些措施来评估控件，以产生可比较的和可再生的结果”。由于文稿似已超出了国家经验的范围，因此第3/2号课题与ISO/IEC JTC 1/SC 27进行了工作联系，后者称其期待在此领域中开展额外活动。

有关成功使用安全标准[41]的技术报告的目的是帮助用户，特别是发展中国家的用户，更好地了解在各种不同环境中（如工业、商业、政府和企业）使用ITU-T安全相关建议书的价值。

ITU-T X.1054 X.Suppl.27 – 关于实施涉及信息安全管理的ITU-T X.1054建议书| ISO /IEC 27014最佳做法的增补 – 布基纳法索案例。[42]

8 第8章 − 有关下一研究期的结论和建议

对本研究期的时间进行了压缩，第3/2号课题在此期间讨论了与网络安全有关的许多问题，研究了若干国家案例，并举办了一些讲习班，上述努力为制定网络安全战略的诸多环节工作提供了指导。该组还针对全球网络安全指数进行了研究，并向电信发展局提出了相关输入意见。

ITU-D第3/2号课题建议继续在当前职责范围内开展活动。该组建议：应研究除垃圾信息和恶意软件之外的演变和新兴（技术）威胁。应解决许多发展中国家提出的SIM-盒欺诈问题应得到进一步解决。应强调在区域和地方环境中更多地利用讲习班和培训材料等进行额外的能力建设。亦应强调与FIRST、GFCE和ISOC等相关机构不断开展合作，并继续通过收集国家经验来开展合作。应继续进行网络安全认识调查，并假定在世界电信发展大会（WTDC）之前可找到适当的资源。在确定和发展与网络安全有关的措施（如全球网络安全基础设施）方面，该课题应继续与电信发展局密切合作。该课题尤其应继续确定有关指标、数据收集和分析的改进措施。有关保护上网儿童的工作亦应继续进行。

之前的几个研究期已对ITU-D研究组的工作方法做了拓展。第3/2号课题对世界电信发展大会鼓励继续进行此类拓展表示赞赏。尤应指出，大会应考虑允许根据年度期间安排工作，以便集中具体问题开展活动。

本报告亦将以此做结：此研究课题（第22/1号课题“保障信息通信网络安全：培育网络安全文化的最佳做法”）的首次实例化就提高关键网络基础设施安全性的国家战略提出了建议。鉴于通过该战略需要时间，故应对相关工作进行审查。

Abbreviations and acronyms

Various abbreviations and acronyms are used through the document, they are provided here.

Abbreviation/acronym

Description

ACTIVE

Advanced Cyber Threats response Initiative

AICPA

American Institute of Certified Public Accountants

ANTIC

National Information and Communication Technologies Agency

APT

Advanced Persistent Threats

BDT

Telecommunication Development Bureau

BGP

Border Gateway Protocol

BGPSEC

Border Gateway Protocol Security

C&C

Command and Control

CCRA

Common Criteria Recognition Agreement

CIIs

Critical Information Infrastructures

CIOs

Chief Information Officer

CISO

Chief Information Security Officer

CISOs

Chief Information Security Officer

COP

Child Online Protection

CRR

Cyber Resilience Review

CSRIC

Communications Security, Reliability and Interoperability Council

CSRIC

Communications Security, Reliability and Interoperability Council

DANE

DNS-based Authentication of Named Entities

DHS

U.S. Department of Homeland Security

DKIM

Domain Keys Identified Mail

DMARC

Domain-based Message Authentication and Conformance

DNSSEC

DNS Security Extensions

DOE

U.S. Department of Energy

FCC

U.S. Federal Communications Commission

GCA

Global Cybersecurity Agenda

GCI

Global Cybersecurity Index

GCSCC

Global Cyber Security Capacity Centre

GFCE

Global Forum on Cyber Expertise

GFCE

Global Forum on Cyber Expertise

IAB

Internet Architecture Board

IAPCs

Internet Addiction Prevention Center

ICS

Incommunication systems

ICS-CERT

Industrial Control Systems Computer Emergency Response Team

ICT

Information and Communications Technology

IEEE

Institute of Electrical and Electronic Engineers

IETF

Internet Engineering Task Force

IMPACT

International Multilateral Partnership against Cyber Threats

IoT

Internet of Things

IoT

Internet of Things

IP

Internet Protocol

IS

Information Security

ISACA

Information Systems Audit and Control Association

ISACs

Information Sharing and Analysis Centers

ISPs

Internet service providers

ITU

International Telecommunication Union

ITU-D

ITU Telecommunication Development Sector

KISA

Korea Internet & Security Agency

LDCs

Least Developed Countries

MIC

Japan's Ministry of Internal Affairs and Communications

MSIP

Korea’s Ministry of Science, ICT and Future Planning

NCCIC

National Cybersecurity and Communications Integration Center

NCMP

National Cybersecurity Measurement Program

NCMP

National Cybersecurity Measurement Program

NCMS

National Cybersecurity Management System

NCS

National Cybersecurity Strategies

NCSA

National Cyber Security Alliance

NIRs

National Internet Registries

NIST

National Institute of Standards and Technology

NorSIS

Norwegian Centre for Cybersecurity

PKI

Public Key Infrastructure

PPP

Public-private partnerships

RIRs

Regional Internet Registries

RPKI

Routing Public Key Infrastructure

RRNs

Resident Registration Numbers

SMEs

Small and Medium sized Enterprises

SoC

Security System-on-Chip

TLS

Transport Layer Security

UK

United Kingdom

UNODC

United Nations Office on Drugs and Crime

US-CERT

United States Computer Emergency Readiness Team

WSIS

World Summit on the Information Society

WTDC

World Telecommunication Development Conference

Annexes

Annex 1: The Global Cybersecurity Index 2017

The Global Cybersecurity Index (GCI) is a survey that measures the commitment of Member States to cybersecurity in order to raise awareness.

The GCI revolves around the ITU Global Cybersecurity Agenda (GCA) and its five pillars (legal, technical, organizational, capacity building and cooperation). For each of these pillars, questions were developed to assess commitment. Through consultation with a group of experts, these questions were weighted in order to arrive at an overall GCI score. The survey was administered through an online platform through which supporting evidence was collected.

One-hundred and thirty-four Member States responded to the survey throughout 2016. Member States who did not respond were invited to validate responses determined from open-source research. As such, the GCI results cover all 193 ITU Member States.

Key findings and results

There is a huge range in cybersecurity commitments around the world as the heat map below illustrates. Out of the 193 Member States covered, scores range from less than one to over 90.

Level of commitment: from dark green (highest) to red (lowest).

Figure 1A: GCI heat map

The GCI 2017 continues to show the commitment of countries around the world to cybersecurity. The overall picture shows improvement and strengthening of all five elements of the cybersecurity agenda in various countries in all regions. The level of development of the different pillars varies from country to country in the regions. In addition to the score, this index provides a set of illustrative practices that give useful insights into the achievements of certain countries.

The six ITU regions were presented in the report (Africa, Americas, Arab States, Asia and the Pacific, Commonwealth of Independent States and Europe). For a global view, all of the six regions are represented in the top ten commitment level in the GCI. This suggests that being a leading performer is not strictly tied to geographic location.

Table 1A: Most committed countries, GCI (normalized score)

Country

GCI score

Legal

Technical

Organizational

Capacity building

Cooperation

Singapore

0.92

0.95

0.96

0.88

0.97

0.87

United States

0.91

1

0.96

0.92

1

0.73

Oman

0.87

0.98

0.82

0.85

0.95

0.75

Estonia

0.84

0.99

0.82

0.85

0.94

0.64

Mauritius

0.82

0.85

0.96

0.74

0.91

0.70

Georgia

0.81

0.91

0.77

0.82

0.90

0.70

The full GCI 2017 report with global and regional scores can be found at http://www.itu.int/en/ITU-D/Cybersecurity/Pages/GCI-2017.aspx.

As the GCI shows, there is a wide gulf in cyber preparedness around the globe. This gap exists between and within regions. The research revealed that while increased Internet access and more mature technological development is correlated with improvement in cybersecurity at the global level, it has the opposite effect among countries with developing economies and lower levels of technological development. The data collection shows that there is need for the developed world to help and more cooperation could be initiated between developed and developing countries to assist them in cybersecurity development. For the GCI to have an impact on raising awareness on this crucial emerging concern over time, continuity of GCI efforts is essential; ITU welcomes all Member States and industry stakeholders to actively participate in the future research and development, to enhance the current reference model.

The success of the future data collection exercise largely depends on the response rate and quality to the questionnaire and ITU calls on all Member States to take part in the next GCI exercise.

GCI reference model

The Global Cybersecurity Index (GCI) is a composite index combining 24 indicators into one benchmark measure to monitor and compare the level of Member States' cybersecurity commitment with regard to the five pillars identified by the High-Level Experts Group and endorsed by the Global Cybersecurity Agenda (GCA). These pillars form the five sub-indices of GCI. First developed by ITU in partnership with ABI Research in 2013, and with results presented in November 2014, the GCI is included under Resolution 130 (Rev. Busan, 2014). It is being enhanced in response to ITU Member States' request to develop a cybersecurity index and publish updates regularly.

The main objectives of the GCI are to measure:

– The type, level and evolution over time of cybersecurity commitment in countries and relative to other countries;

– Progress in cybersecurity commitment of all countries from a global perspective;

– Progress in cybersecurity commitment from a regional perspective;

– The cybersecurity commitment divide, i.e. the difference between countries in terms of their level of engagement in cybersecurity initiatives.

The objective of the GCI as an initiative is to help countries identify areas for improvement in the field of cybersecurity, as well as to motivate them to take action to improve their ranking, thus helping raise the overall level of cybersecurity worldwide. Through the information collected, the GCI aims to illustrate the practices of other countries so that Member States can implement selected aspects suitable to their national environment, with the added benefit of helping harmonize practices and foster a global culture of cybersecurity.

Background

The GCI is included under Resolution 130 (Rev. Busan, 2014) on strengthening the role of ITU in building confidence and security in the use of information and communication technologies. Specifically, Member States are invited “to support ITU initiatives on cybersecurity, including the Global Cybersecurity Index (GCI), in order to promote government strategies and the sharing of information on efforts across industries and sectors”.

A first iteration of the GCI was conducted in 2013/2014 in partnership with ABI Research, and the final results have been published. A total of 105 countries had responded out of 193 ITU Member States. Secondary data was used to build the index for non-respondents and was sent to them for verification/endorsement.

Following feedback received from various communities, a second iteration of the GCI was undertaken and the Report[43] was presented during WSIS-17. This new version is formulated around an extended participation from Member States (134 countries responded to the online survey while 59 countries did not provide primary data), experts and industry stakeholders as contributing partners. An enhanced reference model has thereby been devised. Throughout the steps of this new version, Member States were consulted using various vehicles including ITU-D Study Group 2 Question 3/2.

Conceptual framework

The GCA is the ITU framework for international multi-stakeholder cooperation in cybersecurity aimed at building synergies with current and future initiatives. It focuses on the following five pillars: legal, technical, organizational, capacity building and cooperation.

Figure 2A: GCA

Figure 2A is an illustration of the linkages between the main index, the five sub-indices (different colours) and the GCA. This is in keeping with the cybersecurity development tree map elaborated in the methodology section and its maturity increases as indicated by the deeper tones of colour. The tree has been expanded for a sub-part of the legal pillar only for the sake of clarity and given the space constraint in presenting the complete picture.

Figure 3A: GCA linkages

Legal sub-index: Legal measures empower a nation state to establish basic response mechanisms through investigation and prosecution of crimes and the imposition of sanctions for non-compliance or breach of law. A legislative framework sets the minimum standards of behaviour across the board on which further cybersecurity capabilities can be built. Ultimately, the goal is to enable all nation states to have adequate legislation in place in order to harmonize practices at the regional/international level, and facilitate international combat against cybercrime. The legal environment is evaluated based on the number of legal institutions and frameworks dealing with cybersecurity and cybercrime.

Technical sub-index: Technology is the first line of defence against cyber threats. Without adequate technical capabilities to detect and respond to cyberattacks, nation states remain vulnerable. Effective ICT development and use can only truly prosper in a climate of trust and security. Nation states therefore need to establish accepted minimum security criteria and accreditation schemes for software applications and systems. These efforts need to be accompanied by the creation of a national entity focused on dealing with cyber incidents, a responsible government agency and a national framework for watch, warning and incident response. The technical component is evaluated based on the number of frameworks dealing with cybersecurity by the nation state.

Organizational sub-index: Organizational measures are necessary for the proper implementation of any national initiative. A broad strategic objective needs to be set by the nation state, along with a comprehensive plan in implementation, delivery and measurement. National agencies need to be present to implement the strategy and evaluate the results. Without a national strategy, governance model and supervisory body, efforts in different sectors become disparate, thwarting efforts to attain national harmonization in cybersecurity capability development. The organizational structures are evaluated based on the existence of institutions and strategies concerning cybersecurity development at the national level.

Capacity-building sub-index: Capacity building is intrinsic to the first three measures (legal, technical and organizational). Cybersecurity is most often tackled from a technological perspective even though there are numerous socio-economic and political implications. Human and institutional capacity building is necessary to enhance knowledge and know-how across sectors, to formulate appropriate solutions, and promote the development of competent professionals. Capacity building is evaluated based on the number of research and development, education and training programmes and certified professionals and public sector agencies.

Cooperation sub-index: Cybercrime is a global problem and is blind to national borders or sectoral distinctions. As such, tackling cybercrime requires a multi-stakeholder approach with inputs from all sectors and disciplines. Greater cooperation can enable the development of much stronger cybersecurity capabilities, helping to deter repeated and persistent online threats and enable better investigation, apprehension and prosecution of malicious agents. National and international cooperation is evaluated based on the number of partnerships, cooperative frameworks and information sharing networks.

Methodology

The GCI 2017 includes 25 indicators (157 questions). The indicators used to calculate the GCI were selected on the basis of the following criteria:

– Relevance to the five GCA pillars and in contributing towards the main GCI objectives and conceptual framework;

– Data availability and quality;

– Possibility of cross verification through secondary data.

The whole concept of a new iteration of the GCI is based on a cybersecurity development tree map and binary answer possibilities. The tree map concept, which is illustrated below, is an answer to different possible paths that might be taken by countries in order to enhance their cybersecurity commitment. Each of the five pillars are associated with a specific colour (the same code as that used in the Cyberwellness country profiles). The deeper the path taken, indicating a more developed level of commitment, the deeper the colour depicting it becomes.

The various levels of cybersecurity development among countries, as well as the different cybersecurity needs reflected by a country's overall ICT development status, were taken into consideration. The concept is based on an assumption that the more developed cybersecurity is, the more complex the solutions observed will be. Therefore, the further a country goes along the tree map by confirming the presence of pre-identified cyber solutions, the more complex and sophisticated the cybersecurity development is within that country, allowing it to obtain a higher score with the GCI.

The rationale behind using binary answer possibilities is the elimination of opinion-based evaluation and of any possible bias towards certain types of answers. Moreover, the simple binary concept will allow quicker and more complex evaluation as it will not require lengthy answers from countries. This, in turn, is assumed to accelerate and streamline the process of providing answers and further evaluation. The idea is that the respondent will only confirm the presence or lack of certain pre-identified cybersecurity solutions. An online survey mechanism, which will be used for gathering answers and uploading all relevant materials, will enable the extraction of good practices, information for Cyberwellness profiles and a set of thematic qualitative evaluations by a panel of experts.

The key difference in methodology between GCI Version 1 and GCI Version 2 is the use of a binary system instead of a three-level system. The binary system evaluates the existence or absence of a specific activity, department or measure. Unlike GCI Version 1, it does not take ‘partial’ measures into consideration. The facility for respondents to upload supporting documents and URLs, is a way of providing more information to substantiate the binary response. Furthermore, a number of new questions have been added in each of the five pillars in order to refine the depth of research.

The detailed computation of the sub-indices and of the main index are provided in the report. Apart from building the index, open-ended questions have been included in the questionnaire to cater for additional requirements from ITU-D Study Group 2 Question 3/2 which do not fit within the GCI computation.

Figure 4A: Global cybersecurity agenda

Figure 5A: GCI approach

1.1 Definition of indicators

– Legal measures

Legislation is a critical measure for providing a harmonized framework for entities to align themselves to a common regulatory basis, whether on the matter of prohibition of specified criminal conduct or on minimum regulatory requirements. Legal measures also allow a nation state to set down the basic response mechanisms to breaches: through investigation and prosecution of crimes and the imposition of sanctions for non-compliance or breach of law. A legislative framework sets the minimum standards of behaviour across the board, applicable to all, and on which further cybersecurity capabilities can be built. Ultimately, the goal is to enable all nation states to have adequate legislation in place in order to harmonize practices supranationally and offer a setting for interoperable measures, facilitating international combat against cybercrime.

The legal environment can be measured based on the existence and number of legal institutions and frameworks dealing with cybersecurity and cybercrime. The sub-group is composed of the following indicators:

– Cybercriminal legislation

Cybercrime legislation designates laws on the unauthorized (without right) access, interference, interception of computers, systems and data. This also includes procedural law, and any existing articles on the expedited preservation of stored computer data, production orders, real-time collection of computer data, extradition, mutual assistance, confidentiality and limitation on use; as well as any case law on cybercrime or computer misuse.

– Cybersecurity regulation

Cybersecurity regulation designates laws dealing with data protection, breach notification, cybersecurity certification/standardization requirements, implementation of cybersecurity measures, cybersecurity audit requirements, privacy protection, child online protection, digital signatures and e-transactions, and the liability of Internet service providers.

– Cybersecurity training

Cybersecurity training for law enforcement officers, judicial and other legal actors designates professional and technical training that can be recurring for police officers, enforcement agents, judges, solicitors, barristers, attorneys, lawyers, paralegals and other persons of the legal and law enforcement profession.

1.2 Technical measures

Technology is the first line of defence against cyber threats and malicious online agents. Without adequate technical measures and the capabilities to detect and respond to cyberattacks, nation states and their respective entities remain vulnerable to cyber threats. The emergence and success of ICTs can only truly prosper in a climate of trust and security. Nation states therefore need to be capable of developing strategies for the establishment of accepted minimum security criteria and accreditation schemes for software applications and systems. These efforts need to be accompanied by the creation of a national entity focused on dealing with cyber incidents at a national level, at the very least with a responsible government agency and with an accompanying national framework for watch, warning and incident response.

Technical measures can be measured based on the existence and number of technical institutions and frameworks dealing with cybersecurity endorsed or created by the nation state. The sub-group is composed of the following indicators:

1.2.1 National CERT/CIRT/CSIRT

The establishment of a CIRT/CERT/CSIRT[44] with national responsibility provides the capabilities to identify, defend, respond and manage cyber threats and enhance cyberspace security in the nation state. This ability needs to be coupled with the gathering of the nation's own intelligence instead of relying on secondary reporting of security incidents whether from the CIRT's constituencies or from other sources.

1.2.2 Government CERT/CIRT/CSIRT

A government CERT/CIRT/CSIRT is an entity that responds to computer security or cybersecurity incidents which affect solely governmental institutions. Apart from reactive services, it may also engage in proactive services such as vulnerability analysis and security audits. Unlike the national CERT which services both the private and public sectors, the government CERT provides its services to constituents from the public sector only.

1.2.3 Sectoral CERT/CIRT/CSRIT

A sectoral CERT/CIRT/CSIRT is an entity that responds to computer security or cybersecurity incidents which affect a specific sector. Sectoral CERTs are usually established for critical sectors such as healthcare, public utilities, emergency services and the financial sector. Unlike the government CERT, which services the public sector, the sectoral CERT provides its services to constituents from a single sector only.

1.2.4 Cybersecurity standards implementation framework for organizations

This indicator measures the existence of a government-approved (or endorsed) framework (or frameworks) for the implementation of internationally recognized cybersecurity standards within the public sector (government agencies) and within the critical infrastructure (even if operated by the private sector). These standards include, but are not limited to those developed by the following agencies: ISO, ITU, IETF, IEEE, ATIS, OASIS, 3GPP, 3GPP2, IAB, ISOC, ISG, ISI, ETSI, ISF, RFC, ISA, IEC, NERC, NIST, FIPS, PCI DSS, etc.

1.2.5 Cybersecurity standards and certification for professionals

This indicator measures the existence of a government-approved (or endorsed) framework (or frameworks) for the certification and accreditation of professionals by internationally recognized cybersecurity standards. These certifications, accreditations and standards include, but are not limited to, the following: Cloud Security knowledge (Cloud Security Alliance), CISSP, SSCP, CSSLP CBK, Cybersecurity Forensic Analyst (ISC²), GIAC, GIAC GSSP (SANS), CISM, CISA, CRISC (ISACA), CompTIA, C|CISO, CEH, ECSA, CHFI (EC Council), OSSTMM (ISECOM), PCIP/CCISP (Critical Infrastructure Institute), (No Suggestions) Certification, Q/ISP, Software Security Engineering Certification (Security University), CPP, PSP, PCI (ASIS), LPQ, LPC (Loss Prevention Institute), CFE (Association of Certified Fraud Examiners), CERT-Certified Computer Security Incident Handler (SEI), CITRMS (Institute of Consumer Financial Education), CSFA (Cybersecurity Institute), CIPP (IAPP), ABCP, CBCP, MBCP (DRI), BCCP, BCCS, BCCE, DRCS, DRCE (BCM), CIA, CCSA (Institute of Internal Auditors), (Professional Risk Managers International Association), PMP (Project Management Institute), etc.

1.2.6 Child Online Protection

This indicator measures the existence of a national agency dedicated to child online protection, the availability of a national telephone number to report issues associated with children on line, any technical mechanisms and capabilities deployed to help protect children on line, and any activity by government or non-government institutions to provide knowledge and support to stakeholders on how to protect children online.

1.3 Organizational measures

Organization and procedural measures are necessary for the proper implementation of any type of national initiative. A broad strategic objective needs to be set by the nation state, with a comprehensive plan in implementation, delivery and measurement. Structures such as national agencies need to be established in order to put the strategy into effect and evaluate the success or failure of the plan. Without a national strategy, governance model and supervisory body, efforts in different sectors and industries become disparate and unconnected, thwarting efforts to reach national harmonization in terms of cybersecurity capability development.

The organizational structures can be measured based on the existence and number of institutions and strategies organizing cybersecurity development at the national level. The creation of effective organizational structures is necessary for promoting cybersecurity, combating cybercrime and promoting the role of watch, warning and incident response to ensure intra-agency, cross-sector and cross-border coordination between new and existing initiatives. The sub-group is composed of the following indicators:

1.3.1 Strategy

The development of policy to promote cybersecurity is recognized as a top priority. A national strategy for cybersecurity should maintain resilient and reliable information infrastructure and aim to ensure the safety of citizens; protect the material and intellectual assets of citizens, organizations and the State; prevent cyber-attacks against critical infrastructures; and minimize damage and recovery times from cyber-attacks. Policies on national cybersecurity strategies or national plans for the protection of information infrastructures are those officially defined and endorsed by a nation state, and can include the following commitments: establishing clear responsibility for cybersecurity at all levels of government (local, regional and federal or national), with clearly defined roles and responsibilities; making a clear commitment to cybersecurity, which is public and transparent; encouraging private sector involvement and partnership in government-led initiatives to promote cybersecurity; a roadmap for governance that identifies key stakeholders.

1.3.2 Responsible agency

A responsible agency for implementing a national cybersecurity strategy/policy can include permanent committees, official working groups, advisory councils or cross-disciplinary centres. Most national agencies will be directly responsible for watch and warning systems and incident response, and for the development of the organizational structures needed for coordinating responses to cyberattacks.

1.3.3 Cybersecurity metrics

This indicator measures the existence of any officially recognized national or sector-specific benchmarking exercises or referential used to measure cybersecurity development, risk-assessment strategies, cybersecurity audits, and other tools and activities for rating or evaluating resulting performance for future improvements. For example, based on ISO/IEC 27002-2005, a national cybersecurity standard (NCSec Referential) can help nation states respond to specify cybersecurity requirements. This referential is split into five domains: NCSec Strategy and Policies; NCSec Organizational Structures; NCSec Implementation; National Coordination; Cybersecurity Awareness Activities.

1.4 Capacity building

Capacity building is intrinsic to the first three measures (legal, technical and organizational). Understanding the technology, the risk and the implications can help to develop better legislation, better policies and strategies, and better organization as to the various roles and responsibilities. Cybersecurity is a relatively new area, not much older than the Internet itself. This area of study is most often tackled from a technological perspective; yet there are numerous socio-economic and political implications that have applicability in this area. Human and institutional capacity building is necessary to enhance knowledge and know-how across sectors, to apply the most appropriate solutions, and promote the development of the most competent professionals.

A capacity-building framework for promoting cybersecurity should include awareness-raising and the availability of resources. Capacity building can be measured based on the existence and number of research and development, education and training programmes, and certified professionals and public sector agencies. Some data is collected through reliable secondary sources which actually provide certified training worldwide. The sub-group is composed of the following indicators:

1.4.1 Standardization bodies

Standardization is a good indicator of the level of maturity of a technology, and the emergence of new standards in key areas underlines the vital importance of standards. Although cybersecurity has always been an issue for national security and treated differently in different countries, common approaches are supported by commonly recognized standards. These standards include, but are not limited to those developed by the following agencies: ISO, ITU, IETF, IEEE, ATIS, OASIS, 3GPP, 3GPP2, IAB, ISOC, ISG, ISI, ETSI, ISF, RFC, ISA, IEC, NERC, NIST, FIPS, PCI DSS, etc. This indicator measures the existence of a national cybersecurity standardization body and activities in the development and implementation of cybersecurity standards.

1.4.2 Cybersecurity best practices

This indicator measures the research and publication of best practices and guidelines on cybersecurity technology and its use, management, and application to various scenarios. Best practices are methods or procedures which have a proven track record of success. Adopting best practices will not only reduce the probability of failure but also increase efficiency.

1.4.3 Cybersecurity research and development programmes

This indicator measures the investment into national cybersecurity research and development programmes at institutions which could be private, public, academic, non-governmental or international. It also considers the presence of a nationally recognized institutional body overseeing the programme. Cybersecurity research programmes include, but are not limited to, malware analysis, cryptography research and research into system vulnerabilities and security models and concepts. Cybersecurity development programmes refer to the development of hardware or software solutions that include but are not limited to firewalls, intrusion prevention systems, honey-pots and hardware security modules. The presence of an overarching national body will increase coordination among the various institutions and sharing of resources.

1.4.4 Public awareness campaigns

Public awareness includes efforts to promote widespread publicity campaigns to reach as many people as possible as well as making use of NGOs, institutions, organizations, ISPs, libraries, local trade organizations, community centres, computer stores, community colleges and adult education programmes, schools and parent-teacher organizations to get the message across about safe cyber-behaviour on line. This includes actions such as setting up portals and websites to promote awareness, disseminating support material and establishing cybersecurity adoption.

1.4.5 Cybersecurity professional training courses

This indicator measures the existence of national or sector-specific educational and professional training programmes for raising awareness with the general public (i.e. national cybersecurity awareness day, week, or month), promoting cybersecurity courses in the workforce (technical, social sciences, etc.) and promoting certification of professionals in either the public or the private sector.

1.4.6 National education programmes and academic curricula

This indicator looks at the existence and the promotion of national education courses and programmes to train the younger generation in cybersecurity-related skills and professions in schools, colleges, universities and other learning institutes. Cybersecurity-related skills include, but are not limited to, setting strong passwords and not revealing personal information on line. Cybersecurity-related professions include, but are not limited to, cryptanalysts, digital forensics experts, incident responders, security architects and penetration testers.

1.4.7 Incentive mechanisms

This indicator looks at any incentive efforts by government to encourage capacity building in the field of cybersecurity, whether through tax breaks, grants, funding, loans, disposal of facilities, and other economic and financial motivators, including dedicated and nationally recognized institutional body overseeing cybersecurity capacity-building activities. Incentives increase the demand for cybersecurity-related services and products, which improves defences against cyberthreats.

1.5 Home-grown cybersecurity industry

A favourable economic, political and social environment supporting cybersecurity development will incentivize the growth of a private sector around cybersecurity. The existence of public awareness campaigns, manpower development, capacity building and government incentives will drive a market for cybersecurity products and services. The existence of a home-grown cybersecurity industry is testament to such a favourable environment and will drive the growth of cybersecurity start-ups and associated cyber-insurance markets.

1.6 Cooperation

Cybersecurity requires input from all sectors and disciplines, and for this reason needs to be tackled from a multi-stakeholder approach. Cooperation enhances dialogue and coordination, enabling the creation of a more comprehensive cybersecurity field of application. Information sharing is difficult at best between different disciplines, and within private sector operators. It becomes increasingly so at the international level. However, the cybercrime problem is one of a global nature and is blind to national borders or sectoral distinctions. Cooperation enables sharing of threat information, attack scenarios and best practices in response and defence. Greater cooperative initiatives can enable the development of much stronger cybersecurity capabilities, helping to deter repeated and persistent online threats, and enable better investigation, apprehension and prosecution of malicious agents. National and international cooperation can be measured based on the existence and number of partnerships, cooperative frameworks and information sharing networks. The sub-group is composed of the following indicators:

1.6.1 Bilateral agreements

Bilateral agreements (one-to-one agreements) refer to any officially recognized national or sector-specific partnerships for sharing cybersecurity information or assets across borders by the government with one other foreign government, regional entity or an international organization (i.e. the cooperation or exchange of information, expertise, technology and other resources). The indicator also measures whether the agreement is legally binding or pending ratification. Information-sharing refers to the sharing of threat intelligence while assets designate the sharing of professionals (secondments, placements or other temporary assignments of employees), facilities, equipment and other tools and services.

1.6.2 Multilateral agreements

Multilateral agreements (one to multiparty agreements) refers to any officially recognized national or sector-specific programmes for sharing cybersecurity information or assets across borders by the government with multiple foreign governments or international organizations (i.e. the cooperation or exchange of information, expertise, technology and other resources). The indicator also measures whether the agreement is legally binding or pending ratification. Information sharing refers to the sharing of threat intelligence while assets designate the sharing of professionals (secondments, placements or other temporary assignments of employees), facilities, equipment and other tools and services.

1.6.3 Public-private partnerships

Public-Private Partnerships (PPP) refer to ventures between the public and private sector. This performance indicator can be measured by the number of officially recognized national or sector-specific PPPs for sharing cybersecurity information (threat intelligence) and assets (people, processes, tools) between the public and private sector (i.e. official partnerships for the cooperation or exchange of information, expertise, technology and/or resources), whether nationally or internationally.

1.6.4 Interagency partnerships

This performance indicator refers to any official partnerships between the various government agencies within the nation state (does not refer to international partnerships). This can designate partnerships for information – or asset-sharing between ministries, departments, programmes and other public sector institutions.

Annex 2: Compendium on cybersecurity country case studies

This annex presents the Question 3/2 compendium of relevant cybersecurity activities being conducted by Member States, (including Member States’ national experiences), organisations, the private sector and civil society at the national, regional and international levels. The compendium is based on contributions submitted during the 2014-2017 study cycle.

Member States’ National Experiences Relating to Cybersecurity

Country: Korea (Republic of)

Document: 2/65

Title: Personal information breaches and countermeasures of the Government of Republic of Korea

Summary: Republic of Korea discusses their experiences with personal information breaches and countermeasures. This document discussed the loss of at least of 20 million bank and credit card users in Korea in January of 2014, as an example. The government of Korea developed four measures to respond to the breaches, which included creation of an atmosphere for activating private investment on information security, expansion of the information security budget in the public sector, government support for the information security industry as a new economic growth engine, expansion of training of information security experts, and reinforcement of response measures to cyber threats.

Background

As new information communication technologies and services such as cloud computing, SNS and big data develop, so do new threats, and at times they can outpace even the new regulatory requirements for information security. Recently, there has been increasing attention on these emerging technologies, services and the risks, challenges they present to those providing and utilizing them to assess their risks as well as the benefits.

Setting aside the benefits of these technologies and services, the cost of those challenges is enormous. According to recent study, the annual cost to the global economy from cybercrime is more than $400 billion.[45] A conservative estimate would be $375 billion in losses, while the maximum could be as much as $575 billion. Cyber threats, data breaches and high-risk vulnerabilities continued to grow, and the severity of these attacks have intensified, especially against financial and banking institutions as well as retail outlets. Nevertheless, governments and companies underestimate how much risk they face from cybercrime and how quickly this risk can grow.

Most of enterprises and public organizations have regarded the investment on information security as a mere burden so the level of investment ratio on information security remain still very low. Since the growth of electronically collected, transmitted, distributed and stored information has resulted in more and larger damages and data breaches present a costly and significant threat to companies in all lines of business, it is imperative to foster the capability of information security in both private and public sector.

The wide spectrum of cyber threats can have a disastrous impact globally, and it is desired that information on current cybersecurity challenges and national experiences from Member States in this regard are collected and shared.

Cases of personal data breach in the Republic of Korea

For the past few years, Korea has been experiencing massive data breaches in online game industry, e-commerce, financial industry, and so on. However, unprecedented credit card data breaches panicked the whole nation. The personal data of at least 20 million bank and credit card users in Korea has been leaked January 2014, one of the country’s biggest ever breaches.

Many major firms in Korea have seen customers’ data leaked in recent years, either by hacking attacks or by their own employees. In the latest case, an employee who had been dispatched to upgrade the security systems of client card companies from personal credit ratings firm, Korea Credit Bureau(KCB), has been arrested and accused of stealing the data from customers of three credit card firms while working for them as a temporary consultant. Korean financial regulator, the Financial Supervisory Service (FSS) confirmed the total number of affected users as at least 20 million, in a country of 50 million populations.

The stolen data includes the customers’ names, resident registration numbers (RRNs), phone numbers, credit card numbers and expiration dates. The employee later sold the data to phone marketing companies. And the case was much worse than initially thought. As the inspection of the authority went on, the scope of personal data leaked from the three major local credit card companies, snowballed to an unexpected scale. Many of the country’s major financial institutions were affected by the leaks, too.

Personal data breach not only causes damages on brand reputation, but also make negative impact on confidence in online environment as a whole. For better and safer activities online, it is very important to make a concerted and comprehensive effort to prevent the incident beforehand and take appropriate measures for recovery.

Response and way forward

After thorough investigation and survey on current status of information security both in private and public sector, Korean government announced “Comprehensive Personal Data Protection Plan” in July and suggested investment stimulation as one of main objectives to prevent personal information breach and make safer online environment.

With the recognition that nationwide investment on information security is necessary to minimize the damages from data breaches and information spill, Korean government declared its intention to promote information security industry and train cybersecurity experts actively while fostering conditions for the voluntary investment on information security in private sector.

Among major schemes, Korean government has unveiled the plan which involves 5 main measures to expand the information security market size to double by 2017. The measures and detailed plans are as follows:

– The first measure involves the creation of atmosphere for activating private investment on information security. For this purpose, various incentives would be provided such as deduction of tax payment for SMEs that invest on information security facilities and products, advantages for enterprises which abide by government guidelines on information security when they apply for the government projects, and incentives for SMEs which hire information security experts.

– The second measure involves the expansion of information security budget in public sector. For this purpose Korean government plans to develop the information security budget appropriation guideline and raise the ratio of information security budget compared with informatization budget to 10 per cent until 2017. Also government plans to develop the guideline for calculating cost of information security services and standard form for information security service contracts in public sector.

– The third measure involves the government support for information security industry as a new economic growth engine. Korean government plans to develop the information security roadmap for Internet of Things (IoT) in 2014 and establish test bed, secure imbedded OS, and so on. In addition, government plans to develop 10 advanced information security technologies and products including cyber black box, anti-APT tools. Furthermore, government plans to develop technologies that can guarantee the certain level of security of personal information such as light encryption technologies that can be utilized in various devices while preventing the falling off in quality of the performance of encrypting personal information and detection technology of information extraction by newly raging malwares.

– The fourth measure involves the expansion of information security experts training. Korean government plans to proceed the education and management system of core information security experts. First of all, government plan to foster approximately 5,000 most elite experts on information security by 2017. Government also plans to establish curriculum of special education for the gifted and create the cyber security specialized corps, units, and reserve forces so that information security experts should be able to continue their career in this area seamlessly.

– The last involves the reinforcement of cyber threats response measures. Development of cyber trap system (honeypot) which can collect and analyse the malicious codes automatically by 2015 and verification and treat system for the smishing (SMS phishing) by the end of this year. In addition, cyber threat information sharing with relevant organization will be proceeded. The reinforcement of 24 hours and 7 days monitoring system on various channels abused as malware distribution is one of major steps for the countermeasures as well.

With above plans, Korean government also introduced a new alternative for RRNs for those who do not feel comfortable giving out their precious and unchangeable security number for routine transactions. RRNs, which is the basic Korean ID numbers, are needed for signing up for cell phone contracts, registering for employment, and making a bank account. However, in Korea, this 13-digit ID number, which contains a lot of unchangeable information such as sex, date of birth and place, are used for even more daily routine activities such as purchasing movie tickets via smartphone, buying a train ticket, or buying really anything online at all. However after scandals and data leaks in the past few years that led to security breaches that exposed personal information of millions from financial institutions, the government has decided to issue alternative numbers named “My PIN” that can be used instead of RRNs. The Korean government is confident that the new numbers are safer since they can be changed if they are lost or stolen whereas RRNs are permanent.

It is true that regulatory measures never take up the speed of technological advance, but with more concerted effort for the information security with cooperation among relevant stakeholders, cyber space could be preserved more safe and secure. For this purpose, it is imperative that cyber space is protected through the active investment on the information security and it is necessary to foster virtuous circle in information security industry. In addition, it is important to make an effort to realize secure cyber society as we proceed with informatization.

Country: Korea (Republic of)

Document: SG2RGQ/64

Title: Korea’s Internet of Things security roadmap

Summary: This contribution discusses a cross-sector approach released by the Korean government in September of 2014 for addressing security concerns relating to the Internet of Things that will include response mechanisms, anti-hacking mechanisms, and a new project “Secure Dome”.

Background

It is expected that threats on current cyberspace will be transferred to and expanded into the real world in the Internet of Things (IoT) environment in which all humans, devices and data are interconnected.

Governments are placing big bets on the IoT era, in which physical objects, infrastructure and system are widely connected to the Internet. This new era is expected to increase productivity and efficiency across all industry sectors.

Korea, which has played a leading role in ICT since 1990s with its advanced internet infrastructure and semiconductor technology, aim to take the leadership in this emerging trend. The Internet of Things as a huge transformative development – a way of boosting productivity, keeping people healthier, making transport more efficient, reducing energy needs, and tackling climate change, will lead a new industry revolution.

In May 2014, The Korean Ministry of Science, ICT and Future Planning (MSIP) announced IoT master plan to boost the ecosystem in this sector by encouraging the development of both software and hardware and removing the unnecessary regulations for the growth of the IoT. It is expected that more than dozens of small and medium enterprises in the IoT sector will be supported based on the government’s employment road map.

Despite promising outlooks and commitments from the public and private sectors, however, security threats increase as well amid the rising tide of IoT. This could result in more serious damage than in the personal computer era. For example, hackers can figure out when people go to bed and wake up, what kind of food they eat and what time they go to work by analysing the things, such as home appliances, automobiles and electricity they use. Connected automobiles can also be infiltrated by hackers, allowing them to control the engines, brakes and doors. And people of all ages use smart devices, such as smartphone, tablet, and other wearable devices nowadays, which play pervasive role in the IoT, anytime and anywhere. Since those smart devices store a lot of personal data, the impact could be devastating once those devices are hacked and infiltrated. Since many of those smart devices users are not familiar with how to cope with these vulnerability, they are exposed to exploitation all year round.

Internet of things security roadmap of Korean government

Since utilization of IoT will be directly intertwined into our daily lives by using consumer electronics, medical devices and so on, threats on IoT will be devastating as much as life threatening and also it will be very difficult to amend its security vulnerabilities or cost after full implementation. So it is high time for us to make a comprehensive plan for this urgent issue.

Korean government released in late October 2014, a policy roadmap on information security for the Internet of Things, and outlined that the development of the IoT has caused a paradigm shift in the threat to information security which places a focus on security by design.

The principle of protecting the information and function will be embedded in the development of related product and service from early stage of designing process across seven core sectors of IoT, which include home appliance, medical treatment, transportation, disaster, manufacturing, construction and energy. The government decided to propose three main security principles for structural design of the products as well as for the development of core elements and across the stages of supply chain. There will also be development of and assistance for security considerations for each sector. An information sharing and analysis system or IoT-ISAC will be established to study the weakness of respective product and service. For that purpose, the government plans to prepare a comprehensive response system stage by stage, so that it could respond promptly on the infiltration attempt. A national computer emergency response team will be developed, separate from the existing system of handling cyber threats to the Internet, with the exclusive aim of providing anti-hacking solutions based on information sharing and analysis of vulnerabilities specific to Internet of Things products and services. Also data security standards will be developed for the risk management throughout the entire supply chain from product and service design to deployment and maintenance, while security certification schemes will be introduced to help consumers and businesses make informed decisions on smart devices and services.

Also a project called ‘Secure Dome’ will be launched to further the development of next generation IoT security technology. The Secure Dome Project will pursue development of nine major core technologies related to security that includes light-weight low-voltage encryption technology, security System-on-Chip (SoC), security operation system, security gateway, infiltration detection technology, security control system, smart certification, privacy protection technology and adaptive IoT security solution.

An audition program for IoT research and development also will be introduced. The government will provide R&D budget by way of competition or through the evaluation of the results of the prior research and development.

There will also be a full launch of demonstration project for the IoT security applied to seven major areas of IoT services that include smart home, smart car, smart factory, etc. A basic training for information protection and certification system for security will be introduced to engineering colleges. A project titled ‘IoT Security Brain’ which aims to foster talents in the combined field of security-convergence will also take off.

Conclusion and way forward

The IoT is emerging as the next technology mega-trend. By connecting to the Internet billions of everyday devices – ranging from fitness bracelets to industrial equipment – IoT merges the physical and online worlds, opening up a host of new opportunities and challenges for companies, governments and consumers.

Korean security roadmap for IoT will implement essential infrastructure and technology components by 2018 to provide a safe environment for the use of Internet of Thing. It will serve as a platform for developing data security and privacy protection policy programs in each target area between 2015 and 2018.

Country: Korea (People’s Republic)

Document: SG2RGQ/142 + Annex

Title: Safe use of the Internet for children and youth in Korea

Annex title: Online ethics

Summary: In this contribution the Government of Korea shared its national experience in implementing strong measures to ensure online safety of children and adolescents, including the legal measures it adopted, as well as the challenges and implications of this experience.

Background

Most of the people using the Internet enjoy conveniences and efficiencies provided by a variety of good online services and activities. However, as a concomitant to the benefits of online activities, harmful consequences such as illegal and inappropriate content, dangerous and seductive contacts, improper treatment of privacy and personal information, online bullying, etc. are also occurring. As the average age of children having access to and using the Internet goes down, the safe use of the Internet among children is becoming a hot issue in most countries. In this regard, Korea is very active in taking measures to ensure the online safety of children and such measures range from legal and compulsory ones to online safety education.

Legal measures for the online safety of adolescents

Various social measures are initiated in Korea for children’s safe use of the Internet. Concerning legal measures, all minors under the age of 16 are not allowed to have access to online games from 24:00 AM to 6 AM under the Juvenile Protection Act.

The Act on the Promotion of the Use of Information Network and Protection of Privacy obliges adult content providers to indicate a clear and visible notification of “not allowed for minors less than the age of 19” via signs ∙ symbols∙ numbers ∙ sounds, etc., block improper keyword searches of adolescents, and inform the service users (site visitors) of the legal enforcement (penalty) for the violation of adolescents protection. More stringent rules are imposed to adult content providers and major service providers (whose annual turnover is more than 1 Million USD or the number of visitors to their website is more than 100,000 per day), such as the appointment of adolescent protection officers and public release of the information of adolescent protection officers (name, position, phone number, e-mail etc.) in the front page of their website. The roles of adolescent protection officers include making an annual plan to protect adolescents online, blocking adolescents’ access to adult content, providing training of staffs about measures to protect adolescents, and receiving and handling users’ complaints or damages caused by improper services of adult content.

The Telecommunications Business Act orders telecommunications service providers, when making a service contract with minors under age 19, to inform the minors and their guardians (parents) of filtering tools to block illegal and harmful content, and must let minors or their guardians install a filtering tool to the minors’ telecommunications device. If the filtering tool is removed from the device or set to be inactive for more than 15 days, the service provider must inform the guardian immediately.

Online safety education

Online safety education has been provided from 2002 by National Information Society Agency with the financial support of the Ministry of Science, ICT & Future Planning and the Korea Communications Commission. Such education programs have been offered to more than 500,000 persons including children, teachers and parents every year since 2002.

Education for pre-schoolers are carried out by specially designed tools and Puppet shows throughout 1,200 kindergartens. Pupils in elementary schools participate in cyber ethics and safety education programs consisting of off-campus activity-based learning programs and club activities such as the Korea Internet Dream Star Program. 650 elementary schools per year participate in these cyber ethics and safety education programs.

Students in middle and high schools attend cyber ethics and safety classes, which are taught by specially trained lecturers. Some schools run an intensive program composed of group discussions, poster or essay competitions for cyber ethics and safety, and street campaigns to promote the importance of cyber ethics and safety. Annually, around 1,000 middle and high schools participate in these cyber ethics and safety education programs.

Physically disadvantaged young people should not be excluded from these cyber ethics and safety education programs. In Korea, 50 special schools have been given opportunities to participate in cyber ethics and safety education programs with the assistance of customized training materials and monetary support for the operation of cyber ethics and safety education programs.

The role of educators and parents is very critical in raising children’s and youth’s awareness about cyber ethics and safety. For this reason, the Korean Government offers specially designed training programs to improve the knowledge and understanding of teachers and parents on the issues of cyber ethics and safety. Every year, more than 4,000 teachers and 150,000 parents and adults participate in online and offline classes for cyber ethics and safety training.

More details of Korea’s cyber ethics and safety education programs are provided in the attached document.

Challenges and implications of Korea’s experience

Online safety for children requires not only legal and compulsory measures but also self-regulating voluntary measures. Legal and compulsory measures may lead to visible and prompt effects, however, it may infringe individual freedom or the autonomy of service users. For instance, the introduction of the rule blocking minors’ access to online games from midnight triggered a hot debate about the validity and effectiveness of this measure and the legal rights of minors. The opponents of this measure assert that minors can avoid this rule by using another person’s ID, and this rule infringes on minor’s rights to control their own use of online games, as well as on parental rights to guide their children’s use of online content. In this sense, the Korean government has been providing online safety education for children, parents and teachers in addition to legal and compulsory measures.

Another issue of online safety for children is the division of roles/responsibilities between service providers and service users. Parents may assert that service providers have to pay more efforts to the online safety of children in delivering their services, however, service providers may insist that parental guidance and awareness or education of adolescents is a more effective measure to ensure the online safety of children. Therefore, it is required for the government to keep the balance between the roles/responsibilities of service providers and users in the efforts for the online safety of children.

Challenges Korea is currently faced with is to motivate all related stakeholders to participate in efforts for children’s safe use of the Internet. Despite the active initiatives taken by the government, the participation of private sectors, such as civil society and service providers, has been relatively low. The safe use of the Internet requires the close cooperation among families, schools, communities, work places, and online content providers, and thus the online safety of children cannot be achieved by the efforts of the government alone. Therefore, from now on, the Korean government’s role in supporting and coordinating relevant stakeholders to encourage their active participation in nationwide online safety efforts is all the more important.

In concluding, it is hoped that the information this contribution provides will serve as a useful resource for countries preparing to initiate online safety programs for children and adolescents. Furthermore, it is suggested that Member States and organizations also share their experiences on the promotion of cyber ethics and safety for children and adolescents.

Country: Cameroon (Republic of)

Document: SG2RGQ/30

Title: Main cybersecurity activities in Cameroon

Summary: This contribution provided an overview of Cameroon’s Internet deployment, and discusses an audit of cybersecurity in accordance with ISO-27002. The contribution also provides an explanation Cameroon’s CSIRT, CIRT-ANTIC, which was set up with the assistance of IMPACT in 2012.

Introduction

Cameroon is a country on the Gulf of Guinea, with a surface area of around 475 442 km2, which shares borders with Nigeria to the west, Chad to the north, the Central African Republic to the east, and Congo, Gabon and Equatorial Guinea to the south. Its population was estimated at 22.25 million in 2013, with a gross national income per inhabitant of USD 1 290. With over 200 ethnic/linguistic groups, two official languages (French and English) and great cultural and climatic diversity, Cameroon has aptly been named “Africa in miniature”.

Cameroon has four major telecommunication operators: Camtel, the historical operator, which remains public despite several unsuccessful attempts to privatize it; Orange and MTN, which have been present on the Cameroon market for over 15 years (1999 and 2000); and Viettel, which has been operational since 18 September 2014. The telephone penetration rate stood at around 70 per cent in December 2014, having been less than 1 per cent in 2000. There are an estimated 1 486 815 Internet users, corresponding to a penetration rate of 6.4 per cent (2 per cent in 2006). With MTN and Orange having been allocated 3G licences when their operating licences were renewed, the number of Internet users is sure to rise significantly over the coming years.

Within this context, the issues of cybersecurity and the fight against cybercrime must be taken seriously. A law along these lines was promulgated in 2010, and since then numerous activities related to cybersecurity and the fight against cybercrime have been undertaken.

Audit of network security

The regular audit of the security of networks and information systems, which is the responsibility of the National Information and Communication Technologies Agency (ANTIC), is mandatory (Article 13 of the Law on Cybersecurity). The audits are carried out by ANTIC officials or by approved external auditors. The activity commenced effectively in 2013. Seven private audit firms have been approved by the minister responsible for telecommunications, based on files comprising, inter alia, proof of the qualifications of staff to audit information system security (CISA certification or equivalent). However, the procedures for assigning the entities to be audited to the different audit firms are still under development, as the principles of competition and transparency must be obeyed.

The approach recommended is that of developing healthy competition between the external auditors, in order to reduce the costs borne by the entities audited while ensuring the reliability of the audit. The audits produce an audit report which is used to establish, in agreement with the entity audited, any corrections required to its network to enhance its security or remedy the shortcomings identified, along with an implementation schedule. The security audit standard used is ISO 27002. Between 2013 and 2014, 39 administrations and 16 public enterprises/establishments were audited and 2 435 vulnerabilities noted.

Security monitoring

Since 2012, Cameroon has had a computer incident early warning and response centre (CIRT-ANTIC), set up with the support of ITU and the International Multilateral Partnership against Cyber Threats (IMPACT). The basic missions of the centre are to centralize requests for assistance resulting from security incidents (attacks and intrusions) on networks and information systems, process the incidents, react to computer attacks (technical analysis, exchange of information with other structures of the same kind), and establish and maintain a database of vulnerabilities.

CIRT-ANTIC also provides prevention by disseminating information on precautions to be taken to minimize the risk or consequences of incidents. It oversees the critical Internet resources of Cameroon’s cyberspace (IP addresses, DNS servers, web servers, message servers) to ensure their availability or detect potential attacks on them. Although CIRT-ANTIC was set up with a view to national coverage, its activities are focused for the time being on public and parastatal administrations and organizations. Within this framework, on a daily basis CIRT-ANTIC scans the various systems monitored. It issues vulnerability warnings in real time, which are communicated to the technicians responsible for the information systems. General alerts are issued for the general public, and are consultable on the website www.antic.cm. In 2014, CIRT-ANTIC recorded 300 cases of scamming, 50 phishings, and 18 web defacings.

Other cybersecurity activities

Numerous training or awareness-raising sessions are organized for users in general, or for specific user groups, nationwide. Electronic media are also used, notably in the form of radio or TV programmes to provide mass awareness-raising on cybersecurity.

The formal identification of SIM card holders has been mandatory since 2011. This is carried out by operators under the supervision of the Telecommunications Regulatory Authority.

Conclusion and way forward

Numerous cybersecurity initiatives are under way in Cameroon, reflecting real awareness of the stakes involved with cybersecurity. However, there is still no national cybersecurity policy. It is also important to review the legal and regulatory environment, at least in order to take into consideration the commitments made through the African Union Convention on Cybersecurity and Personal Data of 24 June 2014.

Country: Russian Federation

Document: 2/369

Title: The experience of the CIS countries in the field of experts’ professional competences formation on data protection and information security in information and communication systems

Summary: This document from the Russian Federation presents the results of the project in the framework of the Regional Initiative 5 CIS region “Building confidence and security in the use of ICTs” in terms of human capacity building in the field of information security. The state of affairs in the region is analyzed, recommendations for the formulation of requirements to system of training and retraining of specialists on the basis of competences formulated professional infocommunication community as well as themselves competence are given.

Introduction

Issues of building confidence and security in the use of ICT in the CIS region are in charge of the Information Security Commission of the Regional Commonwealth in the fields of Communications (RCC). Acknowledging that the relevance and ensuring technological independence and information security of the state are the strategic objective, the heads of the CIS states in October 2008 approved the Concept of cooperation of the States – participants of the CIS in the sphere of information security and a Comprehensive action plan for its implementation. Enactment of these documents promoted further forming and enhancement of the legal basis for an interstate cooperation in this sphere and the establishment of a secure information environment in the CIS.

Information Security Commission has prepared a draft Agreement on cooperation of states – participants of the CIS in the field of information security and the Regulation on the basic organization of CIS Member States, which provide methodological, organizational and technical support for the work in the field of information security and the training of specialists in this field.

At the same time there was an inquiry of administrations, regulators and the CIS region’s business to determine common requirements for training of specialists in information security. They should take the form of requirements for appropriate educational standards and are embodied in these standards. According of such factors as historical community of the educational systems of the CIS countries and their current compliance with the terms of the Bologna agreement, allows a large extent unify and make regional standards of training, including such specialties as “Information Security Specialist of Information and Communication Systems" "The system administrator of information and communication systems”; “Specialist in Administration of network devices of information and communication systems”; “The system programmer”; “Specialist in design and graphic user interfaces”; “Technical support specialist of information and communication systems”. The corresponding functional cards of labor activity types, the characteristics of the generalized labor functions, necessary knowledge and skills form a basis for training of specialists, in one way or another responsible for building confidence and security in the region.

Competence-based approach in educational activity and its interface to inquiries of employers

The modern needs of the labor market for specialists of a certain qualification are increasingly placed at the forefront in reforming the educational systems of countries in various regions. These requirements directly affect the modular structure and the flexibility of education in the 48 countries that joined the Bologna Declaration (1999). This process is active in the CIS region. In different countries the professional ICT community formulates its requests in the form of the direct order both to system of professional training, and subsystems of retraining and advanced training. This social order is a list of specific competencies that form the ability to apply knowledge, skills and personal qualities to be successful in a particular field. Competencies and learning outcomes are seen as the main target setting in the implementation of vocational training programs as the integrating beginnings of a graduate’s “model”.

The competence-based model of the graduate, on the one hand, covers the qualification linking his future activities with the subjects and objects of labor, on the other hand, reflects the interdisciplinary requirements to the result of education.

As a result of discussions in the professional community, the features of key professional competencies have been formulated, they:

– Allow to solve complex tasks (non-algorithmic);

– Are multifunctional (allow to solve different problems from one field);

– Transferable to different social fields (different activities);

– Require complex mental organization (the inclusion of intellectual and emotional qualities);

– Are complicated to implement and require a set of skills (skills of cooperation, understanding, reasoning, planning...); and,

– Should be implemented on different levels (from elementary to profound).

Advantages of competence-based approach are in the fact that at the same time:

– The goals and objectives of training programs conforming to requirements of employers are formulated;

– Flexibility of training programs increases;

– Efficiency and quality of professional training, level of professional competences increases;

– Standard, objective and independent conditions of a training quality evaluation are created;

– Level of interaction and the mutual responsibility of students, teachers and employers increases;

– Preparation for professional activity is carried out taking into account the real production conditions, due to which accelerated adaptation of professionals in the workplace; and,

– Formed organizational culture, including the field of information security.

Competences of experts in information security as basis for creation of the corresponding human potential

Focusing on the labor market needs in the field of training and retraining in the application of ICT security experts, the required competences can be divided into several blocks:

1) The general professional competence of providing including the ability to:

• Undertake the operation of infocommunication systems (ICS) with the use of methods and means to ensure their safety;

• Administer software and hardware protection of information in the ICS;

• Carry out the work on assessing the safety of ICS; and,

• Build distributed protected ICS.

2) Competence in the ICS operation using software methods and tools for their safety, providing including the ability to:

• Provide the information security (IS) in ICS with software and hardware;

• Provide the information security (IS) in the ICS using technical means; and,

• Provide information security (IS) in ICS with a complex application software, hardware and technical resources.

3) Competence in the field of management software and hardware protection of information in the ICS, including providing skill to:

• Configure software and hardware ICS protection;

• Perform maintenance regulations and current repair of software and hardware tools of information protection; and,

• Carry out the analysis of the violations allowed by users in ICS and to hinder with their repetition.

4) Competence in the field of the assessment ICS security:

• The monitoring of the efficiency and effectiveness of hardware-software means of information protection;

• The application of methods and techniques for ICS safety assessment under protection system control analysis;

• Carrying out experimental and research works in case of objects certification taking into account requirements to ensuring ICS protection;

• Instrumental monitoring of the ICS protection; and,

• Expertise in the investigation of security incidents.

5) Competences in the area of distributed protected ICS design:

• Development of requirements for distributed secure ICS and remedies for them, taking into account existing regulations and guidance documents;

• Design of the distributed protected ICS; and,

• Commissioning and maintenance of distributed ICS with the protection of information resources, organizational and technical measures for information security.

Each of these competencies is accompanied by a list of actions committed by labor and the necessary knowledge, abilities and skills.

Conclusion

Human capacity building to enhance confidence and security in the use of ICT is an urgent task, which requires the business partnership as the customer, the educational system as a contractor and the state as regulator of the entire process. Business priority in the formulation of requirements for specialists guarantees the success.

As a result of the project for the implementation of the Regional Initiative 5 in the CIS region has developed standard professional competencies, which are put at the forefront in the creation of educational programs in the field of training and retraining of information security specialists.

These competencies are complemented by a specific list of employment action, knowledge and skills that allows both carrying out examination of educational programs and creating new programs of training and retraining for building confidence and security in the use of ICT in the region. Dissemination of results in the region will be implemented within the framework of the ITU project “Centre of Excellence” in the CIS region in the area of “Cyber security”, which is a priority for the region and assigned to the main contractor of the Regional initiative 5 – Moscow Technical University of Communications and Informatics, a member of ITU-D.

The obtained results should be used to enhance the use of ICT awareness activities to build confidence and security in different countries, particularly developing countries, as they have a number of valuable qualities: relevance trends of infocommunications, compliance with modern educational trends and international standards of construction of educational process, scalability and reproducibility.

Country: Norway

Document: SG2RGQ/204

Title: Creating a metric for cyber security culture

Summary: The Norwegian Centre for Cybersecurity (NorSIS) has conducted a study to provide new insight in the Norwegian Cybersecurity culture. The study aims to develop grounds for effective cyber security practices and to improve national cyber resilience. The study included method development for a metric for cybersecurity culture, as well as an extensive national survey. NorSIS recently published the report “The Norwegian Cybersecurity Culture”, which includes a full description of the method, as well as the key findings from the national study. We encourage other nations to make use of the method, and to share the results with an international community.

Introduction

The Norwegian Centre for Cybersecurity (NorSIS) has conducted a study to provide new insight in the Norwegian Cybersecurity culture. The study aims to develop grounds for effective cyber security practices and to improve national cyber resilience. Cyber criminals and foreign intelligence agencies have over time analysed our cultural characteristics to disclose vulnerabilities to exploit. This gives them definite advantages. Therefore, we should feel obliged to increase our understanding of the dynamics in how a cyber security culture is shaped and how it affects the digitalization in businesses, sectors and on a national level. Human factors have long time been recognized as fundamental to cyber security, but so far efforts to understand this important phenomenon has been limited in scope. NorSIS sees mapping cyber security culture as a way of understanding yourself, your company and your country.

In order to create a resilient digital Norway, it is paramount that the government apply a holistic approach. The study shows that it will be necessary to increase the reach and quality of cyber education, establish effective online law enforcement, and engage private and voluntary sector in a struggle to increase the national “cyber hygiene”.

The need for a cyber security metric

Our society is undergoing a fast-moving digitalization in both private and public sector. Manufacturing, products and services are digitized, causing our national economic growth to be strongly linked to the digitalization efforts. The digitalization has the potential to create economic growth and welfare through national and global trade, and more efficient public services. However, this potential is nearly eliminated as a result of an increased level of cybercrime. When adding the fact that foreign powers are stealing Norwegian technology research and development, the very thing our future generation will base their economy on, we understand that we need to do more to safeguard and protect our national ability to freely utilize the tremendous power that lies in the digitalization.

For a nation, a deeper understanding about a cyber security culture is of utmost importance as it touches upon some of the most profound questions for development. Not only does digitalization help businesses make smart use of information technology and data, it ensures citizens benefit from the digital age and it underpins economic growth. A safe e-citizen is fundamental to the success of the national digitalization. Mistrust in digital services and fear of online crime are some of the challenges that people face in the digitalization processes. Thus, we must understand the dynamics in how a cyber security culture is shaped and how it affects the digitalization in businesses, sectors and on a national level.

Measuring cybersecurity culture

In creating a metric for measuring the national cybersecurity culture, there are at least two critical challenges: One is the question of terminology, i.e. what do we actually mean when we refer to “cybersecurity culture”? The other is the level of analysis, i.e. how can we identify a “cybersecurity culture” concept that is valid and applicable to both businesses and nations? That is to say that whilst the concept might be developed within the confines of industries and businesses focused on cybersecurity, also nations have “cybersecurity cultures”. It may, however, not play out the same way. There is a huge gap in how “culture” is shaped and expressed depending on the level on which it is discussed. For example, whereas a business, an organisation and an institution all have defined purposes and thereby measures, the scope of a nation is much vaguer.

Secondly, while business can actively tutor and educate their personnel in cybersecurity, citizens of a state cannot be equally monitored. Is it, then, possible to generate a general comprehension of “cybersecurity culture” that is equally applicable to business and nations?

We believe that measurements of cybersecurity cultures can benefit from a more comprehensive approach, taking a step back from simple registrations of whether employees open phishing-emails and rather look at the attitudes and perspectives towards technology and cyber security, and how this resonates with other core values, interests and abilities.

Understanding cyber security culture: Key components

Among the features that differentiates nations, culture is one of the most dominant ones. All nations have cultures. National cultures shapes who we are as a group, and how we as individuals orient ourselves in the world. In other words: National cultures functions as glue amongst the citizens, and relates to our deeply held values regarding such as what we consider as normal versus abnormal, safe versus dangerous, and rational versus irrational. Our national cultures offer a set of values that help us make sense of our surroundings by establishing a compass that tells us “how we do things”. The result is that national cultures comprise systems of shared values, preferences, and behaviours of population groups that differ widely between countries. These cultural values and norms are learned at an early stage in life, and is passed on both formally (at school, our workplace, in our leisure time activities etc.) and informally through interaction with friends, parents, siblings and others. As a result, national cultures are deeply rooted in us, and last over the course of generations.

Cybersecurity cultures have so far been considered a part of organizational cultures, thereby a concern for businesses and industries. As a consequence, cyber security culture has been treated as a tool for organizational efficiency and success. Yet, organizational cultures differ from national cultures on the most fundamental level: Whilst national cultures concern the shared values and norms, organizational cultures are based on shared practices.

Organizational cultures are based on broad guidelines, which are rooted in the organizational practices that businesses not only teach their employees; organizational cultures are comprised of norms and practices that businesses expect their employees to follow. If they do not act according to them, they may lose their jobs.

This is of course not to say that organizations’ cyber security cultures are less significant. However, they are something else than national cyber security cultures. Moreover, they are less deep-seated than cyber security cultures on a national level.

There are a number of definitions of cyber security culture, and whilst there is as of yet not one definition all cyber security professionals seem to be able to gather around, they all converge around the same key issues: All security is about the protection of assets from the various threats posed by certain inherent vulnerabilities, and cyber security is consequently about protecting the information assets. Cyber security culture, then, is the attitudes, assumptions, beliefs, values, and knowledge that people use in their interaction with the information assets. Thus, cyber security culture is comprised of behaviour and a set of values, ideas and attitudes.

Thus far, most studies of cyber security culture focus on the behavioural dimension. That is, they focus e.g. on the degree to which employees click on phishing links, or whether or not they share their passwords. As a consequence, although the general notion is that cybersecurity culture contains elements of values and attitudes, the way it is dealt with tend to set these elements aside in favour of a focus on behaviour.

As we see it, the focus on behaviour in the context of cybersecurity culture can say something about what people are doing or have been doing. In other words, focusing on behaviour can project an image of security conduct in the past (“this is what they did”), but it can say relatively little about the future. Yet, we strive to increase security predictions. That is to say that timely security measures must be one step ahead. Thus, instead of being able to portray what people have done or how people have used to behave, one should rather be able to have a credible prediction of what people are most prone to do in certain situations. In our approach to cybersecurity culture, then, we have chosen to downplay behaviour and rather focus on attitudes, values and sentiments that can say something about what people will do, or how they will respond.

In our study, we have mapped the core traits of the national cyber security culture in Norway. We departed from the assumption that national cultures – and thereby also cyber security cultures – cannot be approached merely as behaviour: Rather, the national cyber security culture ought to be considered as a set of values, sentiments and attitudes regarding a given topic, i.e. cyber security. Cyber security on a national level relates to a wide set of themes, ranging from governance and state control to individual notions of technological competence and risk-taking.

Any culture balances between the individual and the collective, between individual judgements and perceptions and collective norms and standards. We are neither completely individual, nor are we completely part of the larger collective. Conceptualizing cybersecurity culture, then, implies pinpointing those factors that not only comprise cyber security culture as a whole, but that also highlight the central debates and challenges of cyber security culture that together constitute the building blocks.

In the following we will present the eight core issues that comprise cyber security culture as we see it. These are: Collectivism, Governance and Control, Trust, Risk perception, Digitalization-optimism, Competence, Interest and Behaviour.

– Collectivism

Cultures are per definition collective. Cultures are developed by individuals, whilst at the same time contribute to shaping the individuals that are part of any given culture. Cultures point to the characteristics of a particular group of people, including such as their social habits, their attitudes, their values and priorities. Cultures necessitate some degree of solidarity amongst the members. That is to say that in order to last, cultures necessitate loyalty and solidarity. The individuals must identify themselves as part of the group, contribute to it, and adhere to the explicit and implicit norms of behaviour. When singling out collectivism, we wish to point towards how the individual relates to the collective.

– Governance and control

With reference to collectivism, governance is a collective term that refers to the questions of how the collective should be regulated and by whom. Hence, the issue of governance refers to the users’ views on governance and control of information and communications technology (ICT). A critical issue here is e.g. the question of surveillance: Who are responsible for drawing the red lines of what is acceptable in the use of ICT, where should these lines be drawn and how should citizens abide to these lines?

By raising the issue of governance, then, we wish to draw attention to the question of who is responsible for our safety online. In the context of security, there is always the question of how to balance between individual freedom and collective safety. “Everybody” wants freedom and “everybody” wants at the same time to be safe. How does this balance play out in a given cyber security culture? How much surveillance is acceptable when individual safety is at stake?

– Trust

Trust is a cornerstone to any viable democracy. Democracies depend on trust in a whole variety of forms: A well-functioning democracy necessitates trust amongst its citizens, amongst citizens and the government, between governmental institutions, between business, between citizens and their employer and so forth. In other words: Trust is a prerequisite for economic welfare, stability and growth in a country. As more and more of our national growth is tied to the digitalization of the nation, trust in this area is of great significance.

For authorities to govern efficiently and in accordance with the law, while at the same time maintaining stability, they need not only to have the jurisdiction on their side: They need trust from the citizens. This implies that authorities must be allowed to govern also when e.g. executing policies that citizens may disagree with, or when implementing measures that are alien or new to citizens.

– Risk perception

Competence, learning and risk are tightly knit together. Risk perception is also highly subjective, and it’s a powerful factor that greatly influences how we think and act when it comes to digital threats. It is a factor that, to some degree, can’t be calculated or predicted, although we know that it can and will be influenced by security events, what we think we know about digital threats, our experiences in the past etc.

– Digitalization-optimism

By focusing on techno-optimism and digitalization we want to transgress the mere fact that digitalization is part of how our societies develop. Instead, we want to draw attention to citizens’ attitude towards this societal tendency. In other words: Your attitude towards digitalization influences how you relate to technology. A safe e-citizen is fundamental to the success of the national digitalization. Mistrust in digital services and fear of online crime are some of the challenges that people face in the digitalization processes. Thus, we must understand the dynamics in how a cyber security culture is shaped and how it affects the digitalization in businesses, sectors and on a national level.

– Competence

As everything from social services and state tax payment to individual communication and the sharing of holiday photos are happening online, citizens are forced to make use of ICT regardless of whether they appreciate it or nor. This implies that citizens must acquire a digital skill-set that makes them capable of being part of modern society. Consequently, all citizens of Norway must have fundamental digital skills. The question is: Where and how do they acquire this skill-set? The paradox today is that most countries push their citizens to go online, and our societies’ development depend on a comprehensive process of digitalization. Yet, a thorough digital skill-set is rarely taught in schools. The general public must therefore acquire this skill-set through informal channels. By focusing on this, we explore how and by whom people learn about cybersecurity.

– Interest

In a society that is increasingly digitalized, one may be tempted to conclude that citizens with an interest in ICT have an advantage over those citizens that lack this interest. Interest shapes our attitudes, our skills and our knowledge. Interest influences who we relate to and thereby who we learn from. With interest comes awareness, curiosity and time. These are cornerstone in learning. It follows that one may wonder whether people with an interest in ICT learn faster than those who lack such an interest. Therefore, interest appears to be decisive in a digitalized society.

– Behaviour

In terms of cyber security there are certain types of behaviour that are encouraged, whilst others are warned against. Governments, authorities, business leaders and experts provide advice that form a normative standard for how citizens or employees should behave. However, given the rapid development of technology, this “best practice” standard is perishable. That is to say, that expert advice and norms for ICT behaviour have changed over time. As a result, going through training and courses in information technology once does not suffice: It must be repeated.

Measuring the behavioural patterns of the Norwegian cyber security culture implies two things: Firstly, we want to paint a general picture of the behaviour of Norwegians in the context of cyber security. Secondly, we want to see to what degree Norwegians comply with the “best practice” norms of behaviour communicated to them.

Key findings

The study is unique as we encompass a broad approach to cybersecurity culture, and because the scope is much larger than any study we are aware of. We worked with 29 partners in the public and private sector, and reached 150.000 individuals in Norway. Our key findings are:

– Fear of cybercrime creates a chilling effect on the digitalization process

Although most people (approximately 90 per cent) thinks that the police should handle online crime, far less (46 per cent) trusts that the police will be able to help them. The police reported in 2015, that a mere 13 per cent of individuals that are victims to online crime actually files a police report. At the same time, as many as 44 per cent thinks that individuals and activist groups has a role to play in the fight against online crime. Apart from the fact that such involvement may cause suspicion towards innocent, let the guilty go free and tamper with ongoing investigations, we believe that it may cause a chilling effect for the digitization efforts. 44 per cent reports that they have abstained from using online services due to digital threats. Norway is currently undergoing a digital transformation in both public and private sector, and this development is worrying.

– The Norwegian citizenry is not properly educated in cybersecurity

The government is not educating the population in cybersecurity, despite that the digitization demands it. The society expects the individual to know how to protect themselves from digital threats. We find that only 50 per cent of the population has received cybersecurity education during the last two years, and that businesses are taking that responsibility upon themselves. This causes vulnerable groups to be left out, such as the young and the elderly.

– There is a low awareness of the concept of online hygiene

People see cybersecurity as a means to protect themselves, but are not aware of the complex co-dependencies in a digitized society. In short, cybersecurity to them is about protecting themselves, not the people around them. In a digital world, everything is connected to everything else. Long and complex digital value-chains makes up our critical infrastructures, our financial systems etc. Our study reveals shortcomings in the way cybersecurity is taught today, and we need to develop new educational methods if we are to prepare the citizenry for a new digital reality.

Conclusion

The full report is available for digital download at https://norsis.no/wp-content/uploads/2016/09/The-Norwegian-Cybersecurity-culture-web.pdf. NorSIS encourages other nations to make use of this metric, and to share the results with the international community.

Appendix 1: The Norwegian Center for Cybersecurity

The Norwegian Center for Cybersecurity (NorSIS)[46] is an independent driving force and partner supporting government, businesses and research in facing up to and dealing with information security issues.[47] NorSIS was first established as a project in 2002, and after evaluation, founded on February 2, 2010 on request from the Norwegian government. NorSIS is an independent center of knowledge in cybersecurity.

The purpose of NorSIS is to ensure that information security is a natural part of a business’, a government department’s or an individual’s every day. We achieve this through building awareness of threats and vulnerabilities, by providing information on specific solutions and by influencing good attitudes and information security habits. The main target group for NorSIS is Norwegian enterprises in both the private and public sectors. Activity is aimed especially at small and medium-sized private enterprises and local government as well as the individual citizen.

NorSIS has a particular emphasis on collecting, organizing and disseminating knowledge about cyber threats to create awareness around information security. NorSIS acts as an organiser of meeting places for businesses and organisations within the public, private and voluntary sectors. Public-private partnerships are important for NorSIS to achieve cyber security. NorSIS also cooperates with several international partners in cybersecurity, for example Europol (Ec3), and The European Union Agency for Network and Information Security (ENISA).

NorSIS reports and surveys:

“Threats and trends” – A threat report published once a year on request from the Ministry of Justice.

“The Norwegian cybersecurity culture” – A study published for the first time in September 2016, and planned to be carried out once a year. The study is also on request from the Ministry of Justice.

Services NorSIS provide:

Slettmeg.no – is a free service to help people who experience privacy violations online.

Nettvett.no – is a free service providing information, advice and guidance on a safer use of the Internet. The information is aimed at individuals, from child to adult, consumers and small and medium enterprises. NettVett is a service in cooperation with The Norwegian National Security Authority and the Norwegian Communications Authority, but NorSIS has the editorial responsibility for this service.

Security Divas – is a network for women in the field of cybersecurity. 6 years ago NorSIS established the Security Divas conference. The conference has grown every year since then and has evolved to become an important network for women nationally who are studying or working with information security.

National Security Month – the pan-European exercise to protect EU Infrastructures against coordinated cyber-attacks. NorSIS coordinates this campaign in Norway.

Country: United Kingdom of Great Britain and Northern Ireland

Document: 2/228

Title: Cybersecurity in government and industry

Summary: Cybersecurity is a very important issue for all nations. The United Kingdom has developed a number of tools to help citizens, industry and government to protect systems and networks against the effects of internet-based attacks.

This contribution from the United Kingdom focusses on a scheme called “Cyber Essentials”. This is quite a new scheme and has proved very successful, with many organisations becoming certified.

Cybersecurity has been a priority for the UK Government for several years. Under the National Cybersecurity Programme there has been significant resource devoted to improving the UK’s cybersecurity stance. Among the initiatives are several which are aimed at improving cybersecurity in both large and small organisations, and the relevant schemes have been developed jointly with industry. Of particular note is the scheme known as Cyber Essentials. The approach was developed after the analysis of a number of cyber attacks. That analysis indicated that in many cases a small number of precautions would have mitigated the attacks or caused the adversary to work much harder. Whereas the focus of the development has been within the UK, much of the work is equally applicable in any country and the details of the schemes are available to all. Cyber Essentials has proved to be very successful in the UK, with several hundred organisations becoming certified despite the scheme being relatively new.[48]

The Cyber Essentials scheme has been developed by Government and industry to fulfil two functions. It provides a clear statement of the basic controls all organisations should implement to mitigate the risk from common internet based threats, within the context of the Government’s 10 Steps to Cyber Security. And through the Assurance Framework it offers a mechanism for organisations to demonstrate to customers, investors, insurers and others that they have taken these essential precautions.

Cyber Essentials offers a sound foundation of basic hygiene measures that all types of organisations can implement and potentially build upon. Government believes that implementing these measures can significantly reduce an organisation’s vulnerability. However, it does not offer a silver bullet to remove all cyber security risk; for example, it is not designed to address more advanced, targeted attacks and hence organisations facing these threats will need to implement additional measures as part of their security strategy. What Cyber Essentials does do is define a focused set of controls which will provide cost-effective, basic cyber security for organisations of all sizes.

The Assurance Framework, leading to the awarding of Cyber Essentials and Cyber Essentials Plus certificates for organisations, has been designed in consultation with SMEs to be light-touch and achievable at low cost. The two options give organisations a choice over the level of assurance they wish to gain and the cost of doing so. It is important to recognise that certification only provides a snapshot of the cyber security practices of the organisation at the time of assessment, while maintaining a robust cyber security stance requires additional measures such as a sound risk management approach, as well as on-going updates to the Cyber Essentials control themes, such as patching. But we believe this scheme offers the right balance between providing additional assurance of an organisation’s commitment to implementing cyber security to third parties, while retaining a simple and low cost mechanism for doing so.

Country: United States of America

Document: 2/198

Title: Partnering with the private sector to manage cyber risk

Summary: Public-private partnerships are a foundational element for effective critical infrastructure protection, resilience, and overall cyber risk management. Managing cyber risk to critical infrastructure is an enormously complex but vitally important undertaking, and tackling cybersecurity challenges is often beyond the capability of either government or the private sector to manage independently.

This contribution from the United States to Question 3/2 outlines the importance of partnering with the private sector to manage cyber risk; lays out the United States’ whole-of-community approach to cyber risk management, highlighting key tools that support this approach; and provides concrete examples of implementing effective public-private partnerships.

Introduction

Managing cyber risk to critical infrastructure is an enormously complex but vitally important undertaking. The compromise of, or malicious exploitation of critical infrastructure, can cause significant consequences on a local, regional, or even global scale. The cybersecurity risks to critical infrastructure have become progressively more important because nations, industry, and people increasingly rely on information systems and networks to support critical infrastructure functions.

Cybersecurity risks necessitate close cooperation among government, the private sector, and non-governmental organizations to ensure a coordinated approach to protecting critical infrastructure. Often, a nation’s critical infrastructure is owned and operated by private companies; thus, managing cyber risk to these vital systems requires a strong partnership between the government and industry. This is particularly relevant to cybersecurity of critical infrastructure, where crime, data protection, control systems security, network defense, and cyber incident response and recovery issues present increasing challenges for government and industry alike.

The United States government consistently emphasizes a cybersecurity approach that focuses on partnerships and risk management as two critical components to an effective strategy. This approach builds off of the United States’ previous contribution in 2011 to the ITU-D paper on Question 22-1/1: Best Practices for Cybersecurity: Public-Private Partnerships.[49]

The importance of public-private partnerships in support of cybersecurity

The efficacy of collaborative solutions to complex and ubiquitous challenges has been demonstrated repeatedly. Partnerships between government and the private sector have been applied successfully to a wide range of issues, from academic and scientific questions, to social and economic challenges, to armed conflict and efforts to combat terrorism. Participants create partnerships because they see value in the relationship and expect to accrue some level of benefit, and also recognize that the goal of the partnership would either be more difficult to accomplish or could not be achieved without this collaborative relationship.

Governments generally recognize that protecting their citizens from the potentially devastating consequences associated with critical infrastructure exploitation or disruption would be almost impossible without the extensive and willing participation of the private sector. In the United States, private industry owns, operates, and maintains most infrastructure, so private sector expertise, collaboration, coordination, resources, and overarching engagement are essential to government critical infrastructure risk management efforts.

Public-private partnerships are a foundational element for effective critical infrastructure protection, resilience, and overall cyber risk management. Tackling cybersecurity challenges is often beyond the capability of either government or the private sector to manage independently. To best serve international, national, corporate, and even individual interests, the public and private sectors—and the international community—must share responsibility for strengthening the global cyber security posture.

Partnership between government and industry helps the government disseminate vital threat and vulnerability information, coordinate effective incident management, and understand the resilience and risk posture of critical infrastructure. The same partnership also helps promote greater security awareness, facilitates the exchange of technical expertise, the creation and promulgation of best security practices and standards, and generally improves industry’s ability to manage risk.

Voluntary collaboration between private sector and government stakeholders remains the primary mechanism in the United States for advancing collective action toward cybersecurity that utilizes the diverse resources of all partners.

United States collaborative approach to cybersecurity risk management

As cybersecurity threats and vulnerabilities cannot be entirely eliminated, the U.S. Government approach to addressing cybersecurity is centered on risk management.

Risk management is the ongoing process of identifying, assessing, and responding to risk. To manage risk, organizations should understand the likelihood that an event will occur and the resulting impact. With this information, organizations can determine the acceptable level of risk for delivery of services and can express this as their risk tolerance. With an understanding of risk tolerance, organizations can prioritize cybersecurity activities, enabling them to make informed decisions about cybersecurity expenditures. Implementation of risk management programs offers organizations the ability to quantify and communicate adjustments to their cybersecurity programs. Organizations may choose to handle risk in different ways, including mitigating the risk, transferring the risk, avoiding the risk, or accepting the risk, depending on the potential impact to the delivery of critical services.

Whole-of-Community approach to risk management

To further promote risk management, in 2013 the U.S. Government issued Cybersecurity Executive Order (EO) 13636, which directs a whole-of-community approach to risk management, security, and resilience for cyber threats.

A whole-of-community approach involves partnership between public, private, and non-profit sectors, and a clear understanding of the risks collectively faced. This whole-of-community approach is intended to ensure that those with responsibility for the security and resilience of critical infrastructure receive the information that they need, and that the programs that enable these protection and resilience efforts reflect the needs and imperatives faced by critical infrastructure partners.

Reflecting this whole-of-community approach, the U.S. Department of Homeland Security (DHS) established a task force consisting of government and industry representatives to work together toward implementation.

Framework for improving critical infrastructure cybersecurity

As part of the Cybersecurity Executive Order, the National Institute of Standards and Technology (NIST) worked collaboratively with stakeholders, including industry, academic, and government representatives, through a formal consultative process to develop the Framework for Improving Critical Infrastructure Cybersecurity (the Framework), a voluntary framework for reducing cyber risks to critical infrastructure.[50]

The Framework is a business-driven, proactive framework for voluntary cyber risk management designed for companies of all sizes that operate in diverse sectors of the economy. It provides a common starting point and language to assess cyber risk. It is easily adaptable, enabling organizations – regardless of size, degree of cybersecurity risk, or cybersecurity sophistication – to apply the principles and best practices of risk management to improving the security and resilience of critical infrastructure.

The Framework’s development represents an example of successful public-private collaboration on cybersecurity risk management. It was developed through a collaborative process, led by NIST, in which stakeholder input played a significant role in shaping the process and the final document. The Framework is the product of a year-long, voluntary development process that included input from more than 3,000 members from industry, academia, and government, including international partners.

The Framework references existing international standards and guidelines, and industry best practices, to promote the protection of critical infrastructure through risk management. It represents a collection of existing standards and best practices that have proven to be effective in protecting IT systems from cyber threats, ensuring business confidentiality, and protecting individual privacy and civil liberties. In addition, the Framework provides a structure for organizing practices, as well as tools to support the use and adoption of standards and practices. Because it references globally recognized standards for cybersecurity, the Framework also has the flexibility to serve as an international model for managing cyber risk.

The Framework uses risk management processes to enable organizations to inform and prioritize decisions regarding cybersecurity. It supports recurring risk assessments and validation of business drivers to help organizations select target states for cybersecurity activities that reflect desired outcomes.

Implementation of the cybersecurity framework

The Framework is being implemented in a host of critical infrastructure sectors, government departments and agencies, and organizations ranging from multinationals to small businesses.

To support Cybersecurity Framework implementation, DHS developed the Critical Infrastructure Cyber Community (C3) Voluntary Program to provide resources to help those using the Framework to manage their cyber risks.

DHS offers a range of cybersecurity resources to public and private sector organizations, including information on cyber threats and vulnerabilities; cybersecurity incident resources, such as via the National Cybersecurity and Communications Integration Center (NCCIC), the United States Computer Emergency Readiness Team (US-CERT), and the Industrial Control Systems Computer Emergency Response Team (ICS-CERT); software assurance programs; and technical resources such as cybersecurity strategy development, cybersecurity assessment tools, cyber exercise planning, cybersecurity risk management training, a national vulnerability database, and roadmaps to enhance cybersecurity in certain sectors.

In particular, one publicly available resource is the Cyber Resilience Review (CRR). The CRR is a voluntary, non-technical, government-developed assessment tool to evaluate an organization’s information technology resilience. The goal of the CRR is to develop an understanding and measurement of key capabilities to provide meaningful indicators of an organization’s operational resilience and ability to manage cyber risk to its critical services during normal operations and times of operational stress and crisis. The CRR is available to download at https://www.us-cert.gov/ccubedvp/self-service-crr.

In addition to offering these resources, the U.S. Government is also partnering internationally to promote a risk management approach to cybersecurity by promoting the Framework’s global adoption.

Examples of cybersecurity framework implementation

Intel Corporation: cybersecurity framework implementation in the Information Technology sector

Following the release of the first version of the Framework in February 2014, Intel Corporation (Intel) launched a pilot project to test the Framework’s use at the company.[51] Intel’s pilot project focused on developing a use case that would create a common language and encourage the use of the Framework as a process and risk management tool, rather than a set of static compliance requirements.

Intel’s early experience with the Framework has helped harmonize the company’s risk management technologies and language, improve their visibility into the risk landscape, inform risk tolerance discussions across the company, and enhance their ability to set security priorities, develop budgets, and deploy security solutions. The pilot resulted in a set of reusable tools and best practices for utilizing the Framework to assess infrastructure risk. Intel plans to use these tools and best practices to expand their use of the Framework.

Communications Security, Reliability and Interoperability Council (CSRIC): Advisory committee Use of the cybersecurity framework

The private sector, under flexible oversight from the regulator and in coordination with their non-regulatory public sector counterparts across the U.S. Government, is in the best position to recognize threats in the context of their business operations.

The U.S. Federal Communications Commission (FCC) works with the U.S. Department of Homeland Security (DHS) to promote proactive and accountable cybersecurity risk management for companies in the communications sector. A recent collaborative effort between the government and the private companies that build, own, and operate the majority of the networks has led to positive results. From 2014 to 2015, the FCC convened a working group within its advisory committee—the Communications Security, Reliability and Interoperability Council (CSRIC)—to further support the communications sector’s cybersecurity risk management activities.[52]

Council members are selected from among public safety agencies, consumer or community organizations or other non-profit entities, and the private sector to balance expertise and viewpoints. The FCC releases a Public Notice seeking nominations and expressions of interest for membership on the Council. Currently, there are 55 members serving on the Council, representing a diverse and balanced mix of viewpoints from public safety organizations; federal, state, and local government agencies; the communications industry; organizations representing Internet users; utility companies; public interest organizations; and other experts.

The CSRIC Working Group on Cyber Risk Management was structured around five industry segments that make up the communications sector: broadcast, cable, satellite, wireless, and wireline. CSRIC applied the Cybersecurity Framework to each segment, developing and recommending voluntary mechanisms by which the communications industry could improve their management of cyber risks and clarify accountability within the corporate structure. Each segment developed customized implementation guides for its segment, along with tailored steps for small- and medium-sized businesses, while prioritizing the risk factors most relevant to the segment.

The CSRIC process demonstrated the value of the U.S. Government working with the private sector to achieve a voluntary, risk-based model that enables the communications sector to prioritize and implement solutions based on informed, business-driven considerations. By leveraging the diverse participants’ expertise, the FCC and CSRIC working groups were able to develop a set of best practices that can be used by communications providers of any size.

While application of the risk management Framework is the responsibility of each company, the U.S. Government also has an ongoing responsibility to understand the risk environment of all the sectors with critical cyber infrastructure. To achieve this, many agencies work with the private sector. For example, the FCC will confer with communications providers in cyber assurance meetings to learn about industry practices and procedures, provide guidance as needed, and use its role to identify relevant trends and best practices that can further aid in cyber risk management.

Securities Industry and Financial Markets Association (SIFMA): cybersecurity framework implementation

The Securities Industry and Financial Markets Association (SIFMA) collaborated with NIST to develop the Cybersecurity Framework. Drawing upon the resulting Framework, as well as other industry and government resources, SIFMA has composed a guidebook tailored to small firms. SIFMA has also worked with a group of banks, exchanges, and audit firms to align the American Institute of Certified Public Accountants (AICPA) Service Organization Control 2 (SOC-2) criteria, the Cybersecurity Framework, and specific industry requirements to create a consistent control framework for third-party providers.

U.S. Department of energy: energy sector cybersecurity framework implementation guidance

On January 8, 2015, the U.S. Department of Energy (DOE) released guidance to help the energy sector establish or align existing cybersecurity risk management programs to meet the Cybersecurity Framework objectives. In developing this guidance, DOE collaborated with private sector stakeholders through the Electricity Subsector Coordinating Council and the Oil and Natural Gas Subsector Coordinating Council. DOE also coordinated with other Sector-Specific Agency representatives and interested government stakeholders.

Information Systems Audit and Control Association (ISACA): implementing the cybersecurity framework and supplementary toolkit

ISACA participated in the development of the Cybersecurity Framework and helped embed key principles from its Control Objectives for Information Technology (COBIT) framework into the industry-led effort. As part of the knowledge, tools, and guidance provided by ISACA’s Cybersecurity Nexus (CSX) platform, ISACA has developed a supplementary toolkit for implementing the Framework.

Conclusion

Critical infrastructure security and resilience requires a whole-of-community effort that involves partnership between public, private, and non-profit sectors, and a clear understanding of the risks faced. The U.S. has embraced a public-private partnership model for cybersecurity risk management, where both the public and private sector leverage their relative strengths to develop effective cybersecurity practices. This is emphatically not a “one-and-done” process. Cyber threats continually evolve, and cyber risk management must evolve with them. This means that any collaboration model must be a living process that allows for continuous improvement as technologies and threats change.

Country: United States of America

Document: SG2RGQ/42

Title: Best practices for establishing a cybersecurity awareness campaign

Summary: This contribution provides recommended steps and best practices that a country may follow when establishing a cybersecurity awareness campaign at the national level. It cites examples from the Stop.Think.Connect.™ Campaign, which is the United States’ national public awareness campaign aimed at increasing national understanding of cyber threats and empowering the American public to be safer and more secure online. This contribution is related to the following issues for study from the Terms of Reference:

c) Continue to gather national experiences from Member States relating to cybersecurity, and to identify common themes within those experiences.

e) Provide a compendium of relevant, ongoing cybersecurity activities being conducted by Member States, organizations, the private sector and civil society at the national, regional and international levels, in which developing countries and all sectors may participate, including information gathered under c) above

g) Examine ways and means to assist developing countries, with the focus on LDCs, in regard to cybersecurity-related challenges.

Introduction

The rapid growth and adoption of the Internet is creating unprecedented opportunity for innovation as well as social and economic growth around the world. While the benefits of more and more users coming online are undoubtable, it also makes securing cyberspace more difficult. To address this challenge, many countries organize cybersecurity awareness campaigns, which aim to educate governments, private industry, educators, and individual citizens to spot potential problems and understand their individual roles and responsibilities for creating a safer cyberspace.

In the United States, the U.S. Department of Homeland Security (DHS), in coordination with the National Cyber Security Alliance, leads the national cybersecurity awareness campaign, Stop.Think.Connect.™ Stop.Think.Connect.™ is aimed at increasing the understanding of cyber threats and empowering the American public to be safer and more secure online. It seeks to propagate the concept of cybersecurity as “a shared responsibility” where each individual, by taking simple steps to be safer online, makes using the Internet a more secure experience for everyone. Its key messaging includes:

– Stop: Before you use the Internet, take time to understand the risks and learn how to spot potential problems.

– Think: Take a moment to be certain the path ahead is clear. Watch for warning signs and consider how your actions online could impact your safety, or your family’s.

– Connect: Enjoy the Internet with greater confidence, knowing you’ve taken the right steps to safeguard yourself and your computer.

– Stop. Think. Connect. Protect yourself and help keep the web a safer place for everyone.

This contribution is made up of four sections, which outline recommended steps and best practices for launching a cybersecurity awareness campaign. These steps and best practices are based on the United States’ experience in running Stop.Think.Connect™, which is a global campaign that any country may join.

Section 1: Best practices checklist

While every country has unique needs and challenges related to cybersecurity threats and protection, the following best practices can help with launching a cybersecurity awareness campaign.

– Develop a communications plan that includes well-defined goals and objectives and identifies primary target audience(s). The first step to launching a cybersecurity awareness campaign is to determine the campaign’s specific goals and objectives as well as its primary target audience. For details on how to create a strategic communications plan, see below.

– Develop targeted communications strategies and resources to reach specific audiences. Everyone has different cybersecurity needs. For example, students may need to know about cyber predators while IT professionals need to know about hackers. Different materials should be developed for each audience’s needs, knowledge, and ability level.

– The Stop.Think.Connect.™ Campaign offers tip sheets tailored to each specific audience group to address its unique needs and threats. Comprehensive educational materials, such as the Stop.Think.Connect.™ Toolkit, emphasize the shared responsibility for cybersecurity while helping ensure that resources are available for all segments of the community. Simple reminders in the form of posters, wristbands, etc. help individuals keep cybersecurity best practices as a top priority. Stop.Think.Connect.™ materials can and have been translated and used around the world.

– Use social media. Much of cybersecurity awareness raising takes place online. Using social media helps connect cybersecurity awareness messaging to individuals through the channels they are already using—and in some cases, the ones they prefer to use. Posting information on social networking sites like Facebook, Twitter, and YouTube provides a means of engaging and sharing information while also receiving valuable input. Stop.Think.Connect.™, for example, connects with users in a variety of ways online, including Twitter chats and blog posts that raise awareness on specific topics[53].

– Create and maintain partnerships with allies in target audiences. No organization, whether government agency, corporation, or non-profit, can single-handedly spread cybersecurity awareness. Therefore, both public and private partnerships are essential. Develop and engage partnerships with organizations such as:

a) Government agencies. Government agencies lend authority to the message, and have a wide reach to individuals and communities.

b) The Stop.Think.Connect.™ Campaign developed the Cyber Awareness Coalition to engage with federal agencies as well as state, local, tribal, and territorial government entities to help them educate their employees and constituents to identify and deter online dangers. Key government partners at various levels include Computer Security and Incident Response Teams (CSIRTs), Offices of the Chief Information Security Officer (CISOs), and Offices of the Chief Information Officer (CIOs).

c) Non-profit organizations. Non-profit organizations offer a variety of resources and flexibility to spread cybersecurity awareness messaging.

d) The Stop.Think.Connect.™ Campaign developed its National Network of non-profits to advocate and promote cybersecurity within their organizations and to their members and audiences. Non-profit partners span all audience groups identified in the strategic plan. Regular calls including all partner organizations help build networks between each organization, both public and private.

e) Academic institutions. Academic institutions contribute key, up-to-date research that help to ensure that the campaign remains current and informed. They also provide access to the nation’s future workforce. Partnerships with high schools and elementary schools are also crucial since encouraging cybersecurity awareness education from a young age helps students use the Internet safely throughout their lives. Engaging with universities or centers of excellence, helps establish relationships between the workforce-in-training and the organizations that will employ them in the future.

f) Private sector organizations. Industry leaders, including information, retail, finance, and educational services, can educate employees, consumers, and other audiences about the threats affecting them as well as receive input on strengthening cybersecurity practices. Innovative cybersecurity solutions developed by private sector organizations can drive best practices in both the public and private sectors.

g) DHS’ co-leader in the Stop.Think.Connect.™ Campaign, the National Cyber Security Alliance,[54] coordinates the private sector aspects of the campaign.

– Engage audiences at the individual level through grassroots efforts. Individual awareness is foundational to an effective cybersecurity awareness program.

– The Stop.Think.Connect.™ Campaign, for example, invites individuals to become “Friends of the Campaign” by signing up for monthly email newsletters with the latest cyber tips, news, and information relevant to them. The Campaign also reaches individuals by conducting outreach events tailored to each audience and providing speakers who can discuss the cybersecurity issues that most affect the audience.

– Measure whether the effort is truly raising awareness among the target audiences. To measure the effectiveness of a campaign, it is important to collect feedback from focus groups, surveys, or other like methods. Also, track which webpages are most viewed, which materials are most downloaded, which events are best received, and which practices audiences find most effective to identify successes and foster improvement. Feedback from partner organizations helps future planning focus on effectiveness and creativity.

Section 2: Sample communications plan

A communications plan is an essential component of a successful campaign as it provides a roadmap for how the organization plans to accomplish its key goals and objectives. Although a communications plan must be tailored to fit the needs of a specific organization, most plans will include the following sections:

Purpose and background

The Purpose and background section articulates the organization’s rationale for creating a communications plan and what it plans to accomplish.

Overarching communications goals

Overarching communications goals are high-level aims for the cybersecurity awareness program. Such goals are strategically broad while remaining measureable. For example, DHS’ overarching communications goal for the Stop.Think.Connect.™ Campaign is as follows:

To promote public awareness about cybersecurity by increasing the level of understanding of cyber threats, simple mitigation actions, and empowering the American public to be more prepared online to:

– Elevate the Nation’s awareness of cybersecurity and its association with the security of our Nation and safety of our personal lives

– Engage the American public and the private sector as well as state and local governments in our Nation’s effort to improve cybersecurity

– Generate and communicate approaches and strategies for Americans to keep themselves, their families, and communities safer online

Communications objectives

Communications objectives describe how the campaign will achieve its overarching goals. Like overarching goals, the objectives should be measureable.

DHS communications objectives for the Stop.Think.Connect.™ Campaign are to:

– Educate the American public on cyber safety practices to protect themselves and ensure stakeholder groups are aware of available resources (from DHS and others).

– Increase the number of national stakeholder groups engaged with Stop.Think.Connect.™ and strengthen existing relationships with State and local governments, industry, non-profits, school systems, and educators.

– Increase and strengthen the cyber workforce by promoting science, technology, engineering, and math (STEM) education.

Key target audiences

Identifying key audiences helps ensure that messaging focuses on those most receptive to or in need of the message. Clearly defining those audiences keeps the messaging targeted to specific groups by maintaining a shared understanding of what audience titles mean.

The Stop.Think.Connect.™ Campaign identified at the outset seven audience groups: students; parents and educators; young professionals; older Americans; government; industry; and small business. As an example of audience group definitions, Stop.Think.Connect.™ considers older Americans to be individuals who are 60 years of age and older, as defined by the Office of Aging, U.S. Department of Health and Human Services.

Communications channels

Communications channels are the various vectors to convey messaging to the target audience(s). Carefully consider all currently used means of communication as well as additional methods that may be available for use. The communications plan should clearly specify both what the channels are and how to use them.

The Stop.Think.Connect.™ Campaign engages audiences through the following channels:

– Events: Hosting events with target audience groups

– Traditional Media: Proactively reaching out to national/regional/local media (e.g., broadcast, print, web)

– Social Media: Actively using social media platforms (DHS blog, Facebook, Twitter)

– Newsletter: Distributing a monthly newsletter as well as informational toolkits

– Website: Regularly updating campaign websites with news, tips, and key information

– Partners: Encouraging outreach from partner organizations

Campaign strategies

Campaign strategies take into account both the practical methods of disseminating information as well as means for creating campaign momentum and growth. Each broad strategy contains many small steps to accomplish it, and both the steps and the strategies should be flexible enough to adapt to a changing environment. The example below includes only a few strategy samples from the U.S. Stop.Think.Connect.™ Campaign.

Stop.Think.Connect.™ uses the following strategies, among others, to meet its communication objectives:

– Disseminate Campaign messaging through events and media (social and traditional)

– Build a cadre of messengers via partnerships with non-profits and grassroots outreach

– Work across the federal government agencies to collaborate on events and messaging

Messaging

Top-line messaging should focus on the basic, core messages that the campaign seeks to disseminate. Each country and campaign—and each audience and event—has specific needs that require tailored messaging. Top-line messaging serves as the foundation for each of those customized outreaches.

Stop.Think.Connect’ s top-line messages include:

– Stop: Before you use the Internet, take time to understand the risks and learn how to spot potential problems

– Think: Take a moment to be certain the path ahead is clear. Watch for warning signs and consider how your actions online could impact your safety, or your family’s

– Connect: Enjoy the Internet with greater confidence, knowing you’ve taken the right steps to safeguard yourself and your computer

– Stop. Think. Connect. Protect yourself and help keep the web a safer place for everyone

Other universally applicable messages include, using strong passwords, keeping operating systems and security software up-to-date, connecting only with people you trust, and avoiding websites that sound too good to be true.

Roles and Responsibilities

Clearly designating roles and responsibilities enables teams to work together effectively while preventing overlap or confusion. Such differentiation occurs between organizations when multiple groups support a campaign, as well as among team members of a particular organization.

For example, as part of the overarching Stop.Think.Connect.™ Campaign, DHS coordinates relationships with non-profit organizations and government agencies while its partner, the National Cyber Security Alliance (NCSA), coordinates with industry.

Resources

Listing the resources available to a campaign makes clear the scope and limitations for outreach activities within a given time period. In this section, the author may choose to detail the number of dedicated staff and materials that the organization has available to serve specific target audiences within a given time period.

Challenges to ommunications

Identifying expected challenges to communications may help to overcome gaps and obstacles. Examples for Stop.Think.Connect.™ include:

– Technical aspects of cyber threats are difficult for audiences to comprehend and understand how it relates to them.

– The general public does not necessarily see cyber threats as real or pertinent to their everyday lives.

Measurements of success/Metrics

Any communications plan needs a way to receive feedback and measure effectiveness. Due to the nature of cybersecurity awareness campaigns, such measurements typically focus on outward activities more than input, but timely feedback is essential.

Examples of Stop.Think.Connect.™ Campaign metrics include:

– Number of participants for each event or series of events in a region;

– Number of marketing collateral distributed;

– Media coverage;

– Number of stakeholders involved (e.g., Friends, Cyber Awareness Coalition members, National Network members, etc.);

– Hits to webpage;

– Feedback and testimonials from participants and partner organizations;

– Feedback from Congress, state and local leaders/officials.

Section 3: Metrics

This section describes the type of metrics the Stop.Think.Connect.™ Campaign uses to track and evaluate its cyber awareness programming.[55] Countries may find the outlined metrics useful as a baseline for establishing their own measures of effectiveness.

The metrics fall into several broad categories. How these types of categories are applied to differing cybersecurity awareness programs depends on particular programs’ goals and resources. Stakeholder Engagement deals with formal partnerships with government agencies and non-profit organizations. Traditional Media Outreach and Digital and Online Outreach each apply to distributing written and multimedia products through established communication channels. Events and Forums and Resources each cover in-person interactions. A combination of metrics categories is required to understand and measure the full scope of a campaign.

Metrics categories and examples

– Stakeholder engagement. Stop.Think.Connect.™ partners with a number of non-profit organizations that form its National Network, as well as with federal, state, local, tribal, and territorial government agencies that compose its Cyber Awareness Coalition. The Campaign additionally partners with academic institutions around the country. The Campaign measures the number of organizations in each of these stakeholder groups, as well as growth rates per year and the number of people reached by each partner organization.

• By December 2014, the National Network grew to 52 organizations. The National Network includes the Boys & Girls Clubs of America, YWCA, National Sheriffs’ Association, (ISC)2 Foundation, and Neighborhood Watch. Through these and other organizations Stop.Think.Connect.™ reaches Americans nationwide, including parents, educators, students, small businesses, older Americans, and young professionals. With the help of the Campaign, National Network members have instituted many successful cyber awareness efforts, such as providing cyber awareness training for more than 1,500 D.A.R.E. officers. In 2014, the National Network grew by 44 per cent.

• By December 2013, the Cyber Awareness Coalition grew to 65 government partners. The Coalition includes partners ranging from the Department of Education to the State of California that promote awareness about cyber threats and online safety practices within their organizations and to their constituents. Stop.Think.Connect.™ has worked with its Coalition members to help spread cybersecurity messaging and combat threats. For example, the Federal Communications Commission worked with Stop.Think.Connect.™, and other agencies, on the development of its Smartphone Security Checker and Small Biz Cyber Planner. Also, Stop.Think.Connect.™ and the Federal Trade Commission partner on digital outreach and created co-branded community outreach toolkits that have been distributed nationwide to help educate Americans on protecting themselves online.

• The Academic Alliance grew to 41 new universities and colleges joining the Campaign. These partners include Florida State University, Sam Houston State University, and the University of Minnesota, among many others, The Academic Alliance partners spread the cybersecurity awareness message to students, staff and faculty. They also often encourage students to consider educations in STEM and more specifically, cybersecurity, through classes, presentations, and cybersecurity competitions.

• In 2014, the entire Stop.Think.Connect. partner program grew by 84 per cent since 2013.

– Traditional media outreach. Stop.Think.Connect.™ encourages awareness through a number of traditional media sources. Metrics track the number of print circulation hits; online impressions; broadcast reach; articles online and in print; television, radio, and audio news releases; and independent press releases.

– Digital and online outreach. Many of Stop.Think.Connect’s resources are distributed online, allowing for ample opportunity to measure interaction and feedback. The Campaign measures the number of: Friends of the Campaign; hits to the DHS Stop.Think.Connect.™ Campaign website; Twitter chats and Facebook Events; Tweet mentions; Facebook “Likes;” and number of blog entries posted.

• Friends of the campaign: Stop.Think.Connect.™ reaches people in their own communities through its Friends of the Campaign effort. The Friends program is a grassroots outreach effort that enables individuals to sign up and commit to becoming messengers of the Campaign. An average of 762 people joined the Friends of the Campaign each month in 2014. The Campaign distributes monthly newsletters with tips and information about safer online practices to Friends of the Campaign.

• Stop.Think.Connect.™ Campaign Website: Campaign materials point users to the website www.dhs.gov/stopthinkconnect. The Campaign tracks the total number of visits to the site as well as which pages and materials are most accessed. There were over 63,514 hits to the website in 2014.

• Social media: Stop.Think.Connect.™ participates in regular Twitter chats through @Cyber and posts blogs on the Blog@Homeland Security. The Campaign measures the number of blog posts and Twitter chats each year, as well as the impressions from the Twitter chats. For example, a series of Twitter chats for National Cyber Security Awareness Month 2014 had an estimated 45,000,000 impressions. Additionally, the Campaign works with the National Cyber Security Alliance (NCSA) to monitor the number of Twitter followers and retweets as well as Facebook Friends and “likes” on @STOPTHNKCONNECT and the Stop.Think.Connect.™ Facebook accounts.

– Events and forums. Stop.Think.Connect.™ conducts grassroots events across the Nation to encourage communities to embrace a more sustained, proactive approach to online safety. The location and audience for community events are based upon market analysis that considers statistics on demographics and trends so the Campaign can strategically reach target audiences. For example, as part of National Cyber Security Awareness Month, the Campaign organized a special forum for federal, state, and local law enforcement officials to address electronic-based crimes in South Florida, where identity theft cases are the highest in the Nation. In addition to tracking the number of events, the Campaign analyzes the demographic groups and geographic areas reached by the events. During National Cyber Security Awareness Month 2014 alone, 122 events were held across the country, 91 of those events provided with speakers from DHS.

– Resources. The Stop.Think.Connect.™ Toolkit provides resources for all ages and segments of the community, including materials to host independent cybersecurity awareness discussions or activities. The Campaign monitors the number of materials distributed, which is typically several thousand per year.

Section 4: Additional references

For more information and examples of use, please visit the following websites:

– Stop.Think.Connect.™ campaign:

• http://www.dhs.gov/stopthinkconnect

• http://www.stcguide.com (mobile-friendly website)

• http://stopthinkconnect.org/ (National Cyber Security Alliance)

– Communications strategies and resources:

• http://www.dhs.gov/stopthinkconnect-get-informed

• http://stopthinkconnect.org/resources/ (NCSA)

• http://stopthinkconnect.org/tips-and-advice/ (NCSA)

– Social media:

• https://twitter.com/cyber

• http://blog.dhs.gov/

• https://www.facebook.com/homelandsecurity

• https://twitter.com/STOPTHNKCONNECT (NCSA)

• https://www.facebook.com/STOPTHINKCONNECT (NCSA)

– Partnerships with organizations:

• http://www.dhs.gov/stopthinkconnect-national-network

• http://www.dhs.gov/stopthinkconnect-cyber-awareness-coalition

– Connecting with individuals:

• http://www.dhs.gov/stopthinkconnect-Friends-campaign-program

• http://www.dhs.gov/stopthinkconnect-your-community

• http://www.dhs.gov/stopthinkconnect-campaign-news

– Measuring effectiveness:

• http://stopthinkconnect.org/research-surveys/research-findings/ (NCSA)

Country: Côte d’Ivoire (Republic of)

Document: 2/317

Title: Experience of Côte d’Ivoire in developing a national cybersecurity culture

Summary: This contribution presents the experience of Côte d’Ivoire in developing a national cybersecurity culture and puts forward recommendations for cybersecurity development in developing countries.

Background

Development of the national Internet infrastructure has resulted in the proliferation of online services and infrastructures, particularly mobile-money and web applications (websites, databases, etc.). However, very many security holes and vulnerabilities with varying levels of criticality are to be found within the configuration of such applications and services. In such an environment, the risk of personal data theft, compromising of IT systems and financial damage is very high.

The implementation of organizational measures and tools for securing electronic communications and users’ personal data is therefore crucial in the context of stimulating the digital economies of developing countries in general, and of Côte d’Ivoire in particular. Securing information systems and taking effective measures to combat cybercrime is a key way in which to strengthen digital confidence.

Inventory of organizational arrangements adopted by Côte d’Ivoire

Under the guidance of the Telecommunication/ICT Regulatory Authority of Côte d’Ivoire (ARTCI), the country has implemented a number of measures intended to constitute an effective operational response to the threats causing digital insecurity.

– Establishment of the Côte d’Ivoire Computer Emergency Response Team (CI-CERT)

Côte d’Ivoire has put in place a national CERT which serves as the centre for responding to computer-related incidents nationwide. As such, it coordinates the emergency response measures in cases of actual security incidents, while at the same time playing a very important preventive role by conducting periodic security audits on the online infrastructures of critical and/or strategic entities. A significant part of its work also involves sharing the information it derives from its monitoring system, proactively alerting stakeholders to any threats to which their IT systems are exposed and providing them with appropriate corrective measures. Furthermore, in an effort to strengthen the cybersecurity culture, ARTCI periodically holds training and awareness-building seminars on the subject of cybersecurity.

– Establishment of the Platform for Combating Cybercrime (PLCC)

Initiated by ARTCI, the PLCC is a collaborative platform set up in the interests of responding effectively to the problem of cybercrime in Côte d’Ivoire. The platform’s modus operandi is original inasmuch as it comprises IT-security engineers from ARTCI and police officers from the Information Technology and Technological Traces Directorate (DITT), which is a central directorate of the scientific police.

The platform was established through an agreement signed between the Director-General of ARTCI and Director-General of the National Police of Côte d’Ivoire. It brings together a range of skills, particularly those of IT engineers and police officers, and carries out its activities under the supervision of the public prosecutor’s office (Ministry of Justice).

Shared working has enabled, among other things, a transfer of skills between the ARTCI security engineers and police officers in regard to digital investigations. This has resulted in a broad enhancement of the requisite skills, boosting the effectiveness of the PLCC officials. By way of illustration, in 2014 we saw a 73 per cent reduction in the number of cases of cyber fraud by comparison with 2010.

Last but not least, PLCC carries out numerous awareness-building and training campaigns among specific target populations, such as pupils and students, banking and financial establishment employees, officials within the various services of the national police and other law-enforcement officials.

– Consultative activities with a view to defining the national cybersecurity strategy

In its ongoing efforts to implement a reference framework conducive to the emergence of a secure national cyber environment, Côte d’Ivoire has initiated, in response to calls from ARCTI, a set of coordinated activities aimed at defining a national cybersecurity strategy for the period 2016-2020. All of the local players have been involved in the preparatory discussions in the interests of harnessing all the relevant skills and accommodating all of the specific requirements of the various key sectors concerned. This approach has helped to create a lively and inclusive process of reflection on the best practices to be pursued in order to develop a national cybersecurity culture and thereby enhance digital confidence.

Proposal

In the light of the foregoing, we hereby propose the following guidelines to encourage States in their policies and strategies for combating cybercrime:

– Establish national CERTs.

– Establish multistakeholder operational teams to combat cybercrime.

– Develop national awareness-building programmes in regard to cybersecurity.

– Develop international cooperation through information-sharing programmes with computer incident response centres in other countries around the globe.

– Create the conditions for multistakeholder dialogue aimed at the elaboration of national cybersecurity strategies.

Country: China (People’s Republic of)

Document: 2/174

Title: Best practices for developing a culture of cybersecurity: Promoting awareness of cybersecurity and enhancing its management

Summary: This contribution discusses the huge challenges encountered in the information era and the importance of securing information and communication networks. Cybersecurity does not depend on technology alone: human elements serve as the basis for technological measures, and human error and social engineering can seriously endanger cybersecurity. Promoting awareness of cybersecurity and enhancing its management are therefore the most effective ways in which to develop a culture of cybersecurity. In addition, this contribution sets out specific practices for developing a culture of cybersecurity from four standpoints: regulations, driving factors, training programmes and feedback for improvement.

The rapid technological development and huge physical expansion of information and communication networks have made people’s lives easier than ever before. While the fundamental transformation of the digital era, characterized by cloud computing, big data and “Internet +”, has been playing a role in promoting economic growth by leveraging the Internet, it also touches the very heart of personal data, making cybersecurity a key challenge for present-day society. While network applications concern functionality, cybersecurity is essential to national defence and national strategy. The ancient Chinese “Sun Zi Bing Fa” (Master Sun’s Art of War) states that the art of war is of vital importance to the State. Hence, it is a subject of enquiry that can on no account be neglected. For the sake of protecting public interests, maintaining social stability and even defending the integrity of national sovereignty, the task of securing information and communication networks has become ever more important and pressing.

How should we proceed to address this vital issue of cybersecurity? From the standpoint of defence, there are two major components in securing information and communication networks, namely technology and human beings. Here we are not referring to legal provisions (laws specifically targeting cybercrime are often lagging far behind the pace of technological change). Securing information and communication networks by means of technology is tangible and self-evident with the availability of encryption, firewalls, anti-virus software, ID authentication, network isolation, security services, restoration from backups, PKI and VPN, all of which clearly play a significant role in ensuring cybersecurity. However, the role of technological solutions is limited, and cybersecurity vulnerabilities and problems are constantly emerging, posing major challenges for the entities concerned and people responsible for network operation and maintenance. So much so, in fact, that the whole thing has become a vicious cycle: on the one hand, ever more financial and human resources are being invested in cybersecurity, while on the other hand, cybersecurity risks have not been mitigated. The world-renowned hacker Kevin Mitnick wrote in his book The Art of Deception: Controlling the Human Element of Security that the failures of many people are not due to the lack of critical cybersecurity technology, but rather to the human behaviour of the user of the technology and employees in the organization. While this does not mean that investment in technology by the management is to no avail, it does point to the fact that security cannot be guaranteed solely by means of a set of technologies and products.

Technology can be used to mitigate threats, but a consolidated solution can be far more powerful than technology alone. The application of technological means will never be fully effective in securing information and communication networks without the second element: the human being. The human element in the entire defence system is not only the core, but can also constitute its worst defect. For example, symmetric encryption algorithms in cryptology provide strong protection for data privacy; asymmetric cryptographic algorithms can be used to create digital signatures, thereby protecting the integrity of data and its non-repudiation. However, the effective implementation of these cryptographic algorithms depends on proper management of the keys by the user. Any key management error or misoperation will completely undermine the robust cryptography: keys using a combination of common keywords can be obtained in no time at all by a hacker running a dictionary attack; loss of the key or failure to keep a backup could lead to permanent non-restoration of the data. In another example, while physical isolation technology can protect private networks from attacks by malicious external programs, those same networks can be affected by viruses residing in personal mobile devices when the latter are connected to the private network, resulting in leaks of an organization’s data and at worst the collapse of the entire system. Controlling the “human element” is therefore a critical factor in limiting the risk of such attacks.

The above conclusion regarding the need to control the “human element” in order to reduce the risk of organizations being attacked goes hand in hand with the notion of “security culture”. According to Wikipedia, “A security culture is a set of customs shared by a community whose members may engage in illegal or sensitive activities, the practice of which minimizes the risks of such activities being subverted, or targeted for sabotage. […]The main focus of a security culture is keeping infiltrators and other potentially damaging parties out.” In other words, the control of human conduct in terms of security is a kind of “security culture”, its purpose being to secure information and communication networks.

Controlling security-related human conduct is the most effective approach for developing a cybersecurity culture, for the simple reason that it is often improper human conduct in this regard that poses the greatest threat to information and communication networks. We can illustrate this with two cases. First, IBM’s Cybersecurity Intelligence Index shows that, in 2014, up to 95 per cent of information security incidents were related to human error (intentional or unintentional). Controlling the human element can therefore go a long way towards eliminating such errors. Human error generally refers to employee conduct that results in inconsistencies between the realized function and the required function in the production process and the negative impact this has on the work or products. In the cybersecurity sphere, common human errors are: misconfiguration of the system; improper management of patches; use of default usernames and passwords (or very simple passwords); loss of devices; leakage of information due to an incorrect e-mail address; double-clicking on an insecure URL or attachment; password-sharing with other people; unattended computers; and connection of personal mobile devices to the corporate network.

Second, the priority accorded to social engineering in the chain of cybersecurity constitutes the weakest link. Based on the bucket principle, the security level of the information and communication network is determined by the security measures at the lowest level. The Official Guide to CISSP defines social engineering as attempts to influence the internal staff to get them to disclose corporate information or induce them to behave in such a way that the probability of intrusion into the system, data theft or information leakage caused by the attacker increases drastically. The reason why Snowden, who had a fairly low security clearance level, could disclose a large amount of data concerning the United States Prism Program was that the nature of his work enabled him to acquire the passwords and information of his co-workers and supervisors by means of social engineering. The above two cases demonstrate how human behaviour has a major role to play in cybersecurity. In view of this, what kind of training programmes should information and communication network organizations put in place to improve human conduct in relation to cybersecurity?

It goes without saying that promoting awareness of cybersecurity and controlling the associated conduct is a key factor in securing information and communication networks. First of all, regulations should form the basis for awareness promotion, in particular the development of policies and rules for reporting unexpected incidents and social-engineering incidents, with disaster preparedness and restoration in place. Such regulations are guiding rules and must be incorporated into an organization’s cybersecurity programmes. Only once policies have been developed and enacted can the corresponding employee training be implemented. The goal of personnel training in regard to cybersecurity should become increasingly clear through internal exchanges and discussion, and this goal should be repeatedly emphasized over time.

Secondly, incentives should be fostered to encourage employees to abide by the regulations. Typically, these include the proactive will of the individual, accountability in regard to cybersecurity, and the importance of information security levels. Implementation of cybersecurity differs from performance appraisal in the area of ordinary services and products, which is generally conducted according to the “carrot and stick” approach, with distinct punishments and rewards. Securing information and communication networks is unique in that it is profoundly affected by related risks. Persons responsible for human errors will be held accountable for any damage incurred, whereas strict compliance with the operational rules of security management will not lead to any rewards, even if no security issues arise as a result of the compliance. In cases where human error does not result in loss or damage, the person concerned will not be held accountable. The conduct of employees should be measured in accordance with the relevant rules and norms. At the same time, a “non-accountability” system should be implemented, whereby, should the information system be attacked while being properly operated by the persons concerned, those persons will not be held responsible for any damage resulting from the attack.

Thirdly, training of the security personnel should focus not only on ensuring proper conduct on the part of the user, but should also help employees to understand fully the internal vulnerabilities that could be used by attackers. Identification and reporting of such vulnerabilities is a prerequisite for addressing the issue in an appropriate manner. Securing information and communication networks is the responsibility not only of an organization’s IT professionals, but also of all the other members of its workforce. All staff should therefore, in addition to understanding their own roles and responsibilities in protecting the information resources, also be fully aware of how to foster cybersecurity and respond to potential security threats and incidents. Cybersecurity awareness enhancement programmes emphasize training of the entire staff so as to help them protect the corporate information assets effectively and reduce the possibility of human error.

Finally, the feedback and assessments provided during such training can be used to upgrade and improve future cybersecurity training programmes. Assessment results can contribute to the organization’s appreciation of the effectiveness of the cybersecurity training programme while helping it to identify any problems or shortcomings, with a view to ongoing development of the programme. Assessment – in the form of questionnaires, physical interviews, examinations, audits, etc. – should therefore be conducted on a regular basis to ensure continuous adaptation of the cybersecurity training programme to the changes and emerging security issues in a dynamic environment.

Country: China (People’s Republic of)

Document: 2/67

Title: Proposal for a new work item on framework of detection, tracking and response of mobile botnets

Summary: This document proposes a new work item to research how to detect, track and response mobile botnets. With the rapidly-growing number of smartphones, PC-based botnets are moving towards this mobile domain, which will pose serious security threats on mobile devices.

Background

PC-based botnets are a serious security threat in today’s Internet; hackers can use botnets to launch all kinds of attacks, such as spam, fraud, identity theft, DDOS, scan, etc. With the rapid development of the computing and Internet access capabilities of smartphones, smartphones are powerful enough to host a bot. There are more privacy information in smartphones, such as call records, phone book, SMS, and etc., than PCs, and so mobile botnets would offer more financial gains for hackers. In facts, vulnerabilities exist in all major smartphone platform.

Since the appearance of the first mobile bot Cabir (which was found in 2004), we have witnessed a rapid development in mobile botnets. The mobile botnet, SymbOS.Yxes targets Symbian in 2009 and its variants E, F and G were again discovered in July 2009. In the same year, Ikee.B was discovered and targeted iPhones. In December 2010, Geinimi was discovered and targeted Android. Comparing with PC-based botnets, mobile botnets have more serious threats for end users, for example, hackers can send SMSs or visit Internet and use your charges; and at the same time, constructing a mobile botnet use different technologies, for example, hackers can construct a MMS if you receive the MMS, you could become a member of these mobile botnets. Comparing with PC-based botnet, the Command and Control (C&C) channel in the mobile-botnet also has many differences, for example, hacks can direct control your smartphones by sending a SMS to you.

Because of these new characters, we need to adopt new technologies which resist mobile botnets, for example, we should detect the command and control channels for MMS or SMS.

Apart from being connected to the provider’s mobility network, the differences in the devices themselves, their use, and billing models all influence the way in which mobile botnets will evolve. Consequently, investigations into how mobile botnets work, as well as how they may be constructed, detected, tracked and prevented, represents an new and important research area.

Use cases

In the following we describe three usage scenarios. Besides the tow usage scenarios described here, there are many other usage scenarios possible.

Scenario 1: Understanding mobile threats

Mobile applications are increasingly reliant on the browser and mobile browsers present a unique challenge. To enhance usability, the address bar disappears above the screen so that more of the page content can be displayed. If a user does click a malicious link on a mobile device, it becomes easier to obfuscate the attack since the Web address bar is not visible.

Mobile devices do not commonly receive patches and updates. For most users, their operating system (OS) and mobile browser is the same as it was on the phone’s manufacture date. That gives the attackers a big advantage.

Smartphones can be controlled by hackers to earn money, for example, sending SMSs or MMSs to a deliberate mobile number.

Scenario 2: Understanding mobile botnets

Constructing mobile botnets need some new technologies. There are some differences between smartphones and PCs. 1) The battery power is rather limited on a smartphone and so a mobile bot cannot be active at all times. 2) The cost of smartphones is an extremely sensitive area for users and so a mobile bot need to decrease its communications, such as Internet connection, SMS and MMS. 3) Lack of IP address. The lack of IP address may cause the problem of indirect connect. Due to the lack of IP address, most mobile phones are using NAT gateway and thus the devices are not directly reachable, so the traditional P2P based C&C network may not suit for mobile botnet. 4) The diversity of operating system of smart phone. The design of mobile botnet has to consider the diversity of the OS platform of smart phone.

Botmasters how to choose its C&C channels, and are traditional IRC-based, P2P_based and HTTP-based C&C channels still fit for mobile botnet? Base on new characters of mobile botnets, hackers can adopt SMSs or MMSs to control the mobile bot and send command messages to mobile bots.

Scenario 3: Attack of mobile botnets

Comparing with PC-based botnets, one of the main targets of the mobile botnet is to retrieve sensitive information from the victims. The mobile bot can quickly scanning the host node for significant corporate or financial information, such as usernames and passwords, address list and text messages.

Additional important difference, because most of the functionality of cellular network rely on the availability and proper functioning of HLRs(Home Location Register), so the DoS attack could block the legitimated users of a local cellular network from sending or receiving text messages and calls. In the practical circumstances, a bot master of a mobile botnet could control the compromised mobile phones to overwhelm a specific HLR with a large volume of traffic. Through the DoS attack, it will affect all the legitimated users who rely on the same HLR, their requests will be dropped.

Scenario 4: Detection and response of mobile botnets

A mobile botnet is a group of compromised smartphones that are remotely controlled by botmasters via C&C channels. Because mobile botnets adopts some new technologies, how to find mobile botnets has to use some new methods and mechanism, for example, building international coordinated mechanism, some mobile botnets use Web 2.0 Services to construct C&C channel. We should find and prevent these services from being abused and enhance the cooperation among different Countries and Enterprises, such as Microblog, blog, Google App Engine, etc.

At the same time, mobile botnets can bring the significant threats for the core network and can attack against cellular network infrastructure, and so communications service providers have to face unique challenges in protecting their networks from mobile botnet threats.

Proposal

Based on the analysis of the sections before, we propose a framework of detection, tracking and response of mobile botnets.

The basic thinking of this framework includes:

– Define the mobile threats, understand and find the basic principles of mobile threats.

– Define mobile botnets, understand and find the basic principles of mobile botnets.

– Define a framework of detection and tracking mobile botnets, build international coordinated mechanism.

– Define a response framework of mobile botnets and decrease the loss of users and operators.

Country: Korea (Republic of)

Document: SG2RGQ/64

Title: The meeting is expected to consider Korea’s experiences and related proposal for international cooperation in preventing Internet addiction.

Summary: Internet and smartphone is very widely used in Korea across all age groups, thus, the dark side of Internet use such as Internet addiction has becoming a hot social issue. Annual survey shows that Internet addiction rate in 2013 is 7.0 per cent, the figure for the adolescents is increasing to 11.7 per cent. Smartphone addiction rate is higher as 11.8 per cent, the figure for the adolescents is also much higher to 25.5 per cent. Therefore, Korean society do various activities to prevent and treat Internet addiction such as annual social survey to measure the Internet addiction, various preventive education/program, and operation of Korea Internet Addiction Centre. Special features of Korea’s policies and the necessity of international cooperation for preventing Internet addiction also will be described.

Current status of internet and smart phone addiction in Korea (Rep. of)

The “Internet addiction” has appeared as one adverse effect as a result of the country’s advance into information and a wide diffusion of Internet use. Although its concept is yet to be clearly defined in psychological and medical terms, the Internet addiction is generally referred to inflictions of hard-to-recover damages to people’s physical, mental and social functions which occur as a result of excessive use of IT network service (National Information Basic Law, Article 13). Most Internet addicts tend to have withdrawal and tolerance symptoms like extreme anxiety or nervous breakdown, showing serious impediment in their daily life. So deeply hooked up with cyber world, excessive Internet users show symptoms that take diverse forms of game addiction, chatting addiction, porno addiction, etc.

In recent years, the smart media addiction has occurred in the rapidly changing lifestyle and communication styles resulting from a rapid rise of smart media adoption and ICT evolution of fusion and convergences.

About 7.0 percent of the Internet users aged from 5 to 54 were the risk group of Internet addiction, according to the 2013 Internet addiction status survey (released in March, 2014 by Ministry of Science, ICT and Future Planning, and National Information Society Agency). The share of Internet users at risk group to the total Internet users has reduced from 7.7 % in 2011 to 7.2 % in 2012 and 7.0 % in 2013. But, the share of teenager users at risk group has increased from 10.4 % in 2011 to 10.7 % in 2012 and 11.7 % in 2013.

Meanwhile, the smart phone addiction increase was found to be steeper than the Internet’s. About 11.8 % of smartphone users aged 10 to 54 was a risk-group of excessive smartphone users, up 3.4 % point from 8.4 % in 2011 when the smartphone addiction survey started. Teenage users were the highest risk group: About 25.5 % of Korean adolescents (aged 10 to 19) was a risk-group of excessive smart phone users, compared to 8.9 % of Korean adults.

Korea’s efforts to prevent and reduce internet and smart phone addiction

Established in 2002 by the government, the Korea Internet Addiction Center has executed comprehensive programs of counselling, content development & distribution, specialized counsellor training, as well as preventive education to whole nation in order to systematically address excessive use of Internet and smart devices. It has conducted annual status survey on Internet addiction of general people since 2004 (and smart phone addiction since 2011), producing national statistics that is used as a benchmark index for the government policy development.

In June, 2013, the eight ministries have jointly established a Second Comprehensive Plan for Preventing and Reducing Internet Addiction. The program identifies full ranges of preventive, counselling, psychiatric and aftercare assistances available for the whole age groups of infant, students and adults. The government implements the cross-ministerial policy committee to systematically address the Internet addiction. In March, 2014, the committee established the 2014 Execution Program for Preventing and Reducing Internet Addiction. This program has been jointly executed under the management of the eight ministerial policy committee in an effective and systematic manner.

a) Preventive education

Internet and smart media are so easily accessible in daily life that education should focus on prevention before addictive symptoms like withdrawal or tolerance appear. Korea’s education program is designed to be an effective prevention, aiming at enhancing the public consciousness about potential or actual risk of addiction and helping them better able to prevent it. For example, it provides a preventive education, which adapts its curricular to the need of each of different age groups of infants, teens and adults. Specialized counsellors are sent to schools as lecturers giving a special (one-hour) class.

An intensive (two-hour) education program has been available for primary, middle and high school students since 2013; each course is differently designed to each school age, emphasizing student’s participation and discussion in class activity. In the course, each student uses his or her own ‘workbook’ as self-diagnosis tool, keeping a self-monitoring record of Internet and smart media use and sometimes making a resolution to reduce Internet use, if they are found to be excessive users.

Table 2A: Number of participants of preventive education

Category

2010

2011

2012

2013

June 2014

Total

Preschool

-

31,279

18,200

47,890

26,050

123,419

Teenager

645,981

954,425

621,621

970,696

407,512

3,600,235

Adult

33,753

90,363

93,001

105,363

25,803

348,283

Total

679,734

1,076,067

732,822

1,123,949

459,365

4,071,937

(Unit: person)

Since 2014, it has started ‘Addiction Prevention Play’ for preschool child and lower-grade primary school students in order to easily and effectively deliver the message in a way that amuses these kids. In the program, child and students watch a play or a puppet show which tells stories about favourite animal’s engagement of Internet addiction or Internet addiction in familiar daily life, after watching a play teacher talks about danger of Internet addiction and how to prevent Internet addiction. This program is effective in making child easily understand the concept of addiction without feeling of rejection.

It has also provided assistance the 23 schools that are designated as ‘Clean Schools of Smart Media’. This program is to support school activities/campaigns for promoting a sound culture of using smart media and for preventing Internet addiction by cooperating with parents, teachers and experts.

b) Counselling services and infrastructure establishment

The Ministry of Science, ICT and Future Planning(MSIP) executes the preventive education and specialized counselling service in order to effectively address the addictions of Internet and smart phones. In order to provide region-specific service, it operates 14 Internet Addiction Prevention Center (IAPCs) installed at 13 cities or provinces nationwide as of June 2014.

It provides specialized counselling services that are delivered through a diversity of channels like home-visit or online services. These specialized counselling services are designed to be an effective response to rapidly increasing demand for counselling services, as well as easily-accessible services. An online counselling service at www.iapc.or.kr, as well as the nation-wide call center service at 1599-0075 is available. To provide region-specific services for Internet addiction that is occurring nationwide, the Center provides counselling service in collaboration with 48 related centers like Healthy Family Support Center, Youth Support Centers, etc.

Home visit counselling service merits special attention, which provides free counselling service to family by visiting their home. Any family that suffers from Internet addiction can apply for the service. The program is particularly effective for those Internet addicts who need help as they belong to single-parent or low-income or interracial family, or live with grandparents. Also, whoever else needs help for Internet addiction -any children, teens, the jobless, or double-income family- are welcome to apply for this program. It also operates a training program to produce specialized counsellors for Internet addiction. The training program is available for current counsellors and current teachers so that they can also practice as specialized counsellors for internet addiction. It has produced more than 13,000 specialized counsellors as of June, 2014.

Table 3A: Number of counselling service by type

Category

2010

2011

2012

2013

June 2014

Face-to-face

(Home visit)

15,037

10,522

(6,089)

20,701

(10,595)

24,623

(19,519)

7,484

(4,919)

Online

1,916

569

866

489

148

Telephone

9,569

7,915

16,138

11,512

4,779

Sub-total

26,522

19,006

37,705

36,624

12,411

(Unit: one service)

c) Conduct survey research and develop/distribute content

The policy researches are regularly conducted to increase the operational efficiency and scientific accuracy of the diverse program execution for Internet and smart media addiction. A diversity of educational materials like preventive guide books, flash animation, video, standard teaching books or counselling programs have been posted to be available at website. These materials have been developed in order to effectively execute preventive education and to help people better aware of potential risk of Internet or smart media uses.

In 2013, it developed and distributed standard teaching books for intensive addiction prevention. The courses are available in four editions by different lifetime cycle (e.g. primary school students, middle school students, high school students, and adults). Also, it developed guidelines of appropriate smart media uses, publishing them in four editions for four groups of readers (preschool child’s parents, primary school students, and middle and high school students). The guidelines have been distributed to more than 20,000 schools across the nation. In 2014, it developed self-studying type of education content available in five categories for addiction prevention (for preschool child, primary school, middle and high school, university and adults) so that it can help schools and public institutions better ready to provide education for Internet addiction prevention, which has become mandatory under the revised National Information Basic Act (May, 2013), article 30, item 8 (regarding education related to Internet addiction).

It uses publicity to prevent smart media addiction by cooperating with private business sector. So that it can help teens and parents refrain from excessively using smart media, and make a habit of appropriate smart media use at home and schools.

Special feature of Korea’s policy

In Korea, most of the activities are initiated by Government, thus Korean government is supporting civic organizations financially and technically for them to do the activities for the prevention of the Internet addiction. Strong government commitment is also shown in that minors under 16 years old are not allowed to access the online game from midnight to 6AM, and parents can monitor and block their children’s (under 18 years old) access to the online game by the request to the service providers, and that all students from kindergarten to university and all employees in the public sector should be trained for the prevention of Internet addiction by the law. Furthermore, government is running the 14 Internet Addiction Prevention Centers across the nation. The challenge the Korea government faces in preventing the Internet addiction is how to induce the participation of all stakeholders especially parents, community and private sectors.

Cooperation of Member States

Increasing use of Internet in all countries may cause the Internet addiction to become a world-wide issue. Therefore it is urgent to do international cooperation in developing a proper measure in protecting our citizens from the Internet addiction and developing a right habit to use a smart media. Thus, it is required to share the each nation’s Internet addiction policy, especially guideline and manuals for the proper use of Internet and smart media. What is the appropriate age to be allowed to use smart media? What is a proper regulation on the use of smart media in the school context? How do parents have to respond to child’s excessive use of smart media? These are typical questions concerning the proper use of smart media. Thus, it is required for the Member States to do cooperation in developing a proper policy and guideline/manuals to build the sound/healthy habit in using a smart media.

Country: Japan

Document: 2/90

Title: Sharing knowledge, information and best practice for developing a culture of cybersecurity

Summary: To ensure cybersecurity, not only government but also various entities, including the private sector and academia, should cooperate. It is important for this question to introduce such cooperative activities to members, especially developing countries.

Introduction

Cyber-attacks and malicious use of ICT have increased and become more complicated and their technical development and criminal approaching are also changing very fast. Strict rules and regulations tend to become easily outdated and therefore are not always effective and efficient to address these issues. ICT is used by not only governments but also by many other parties including the private sector, academia etc. and their participations and cooperation are essential to ensure cybersecurity. In light of the above-mentioned situation, Japan has conducted several actions on cybersecurity under cooperation among government and other parties and submitted a contribution (document WTDC14/36) to WTDC aiming at ITU-D SG1 Question 22-1/1 to continuously share best practices for developing countries to strengthen their capability to secure cybersecurity.

Japan’s actions on cybersecurity

In the view of promoting best practice sharing, Japan would like to introduce its actions on cybersecurity. These actions are not only made by the government but also by other parties, especially the private sector, including private security companies. Japan has focused on four aspects, namely “network”, “individuals”, “technology” and “international partnership and collaboration” to ensure reliability of information and communications networks.

From the “network” viewpoint, Japan has encouraged information sharing among telecom operators. For example, in 2002, 19 major ISPs and telecom operators in Japan voluntary launched Telecom-ISAC (Information Sharing and Analysis Centre) Japan[56] that collects analyses and shares security information, such as vulnerabilities, incidents, countermeasures and best practices, among members. From the “individuals” viewpoint, Japan has raised awareness of internet users through website and seminars etc. From the viewpoint of “technology”, Japan has promoted advanced research and development projects such as the PRACTICE project.[57] Through paying attention to these aspects, Japan has contributed to establishing reliable ICT networks and promoted international cooperation.

Proposal

Japan recognises the importance of sharing information on best practices, with public, private and academia, in Question 3/2 and therefore we would like to propose organising events , e.g. seminar, workshop etc., with other countries targeting developing countries with regard to cybersecurity. These events should be in collaboration with other Study Groups especially ITU-T Study Group 17, (Security). (Note: The ITU Workshop on ICT Security Standardization Challenges for Developing Countries was held 15-16 September 2014 in Geneva led by ITU-T Study Group 17. (http://www.itu.int/en/ITU-T/Workshops-and-Seminars/ict-sec-chaldc/Pages/default.aspx).

Country: Oman (Sultanate of)

Document: 2/342

Title: Oman Public Key Infrastructure (PKI)

Summary: As most of the population in Oman tend increasingly to use mobile phones intensely every day, the need of meeting this tendency has become more obvious. Thus, and as a part of the eGovernment Transformation Plan that has been effective since 2013, the mGovernment approach is adopted as a channel of delivering the government services. It became necessary to support the mobility and usability of the user and get a quick effective access to the government services. Therefore, the government represented by Information Technology Authority (ITA) established projects like Oman Public Key Infrastructure, to provide the foundation for the other public, private entities to provide services to the public through secured channel.

Introduction

As most of the population in Oman tend increasingly to use mobile phones intensely every day, the need of meeting this tendency has become more obvious. Thus, and as a part of the eGovernment Transformation Plan that has been effective since 2013, the mGovernment approach is adopted as a channel of delivering the government services. It became necessary to support the mobility and usability of the user and get a quick effective access to the government services. Therefore, the government represented by Information Technology Authority (ITA) established projects like Oman Public Key Infrastructure, to provide the foundation for the other public, private entities to provide services to the public through secured channel.

Mobile PKI

Oman Public Key Infrastructure (PKI) is a national initiative that sets the infrastructure needed for all government entities to provide eServices in Oman. It is employed in order to enable online transactions for citizens and to raise the level of security and authenticity of electronic paperwork. It allows exchanging information securely as it provides a high level of confidentiality by using eID, mobile ID or USB Token.

Oman PKI aims at providing a secure technology for information documentation, electronic credibility and identification and authentication of users as well as signing all transactions online by using electronic ID.

PKI is responsible for:

– Delivering certification services on behalf of ITA in accordance with ITA approved policies, requirements and agreements.

– Providing the possibility to join Oman National PKI at Registration Authority (RA) or Sub Certificate Authority (Sub CA).

– Securing the communications between servers to servers or clients to servers by utilizing server/client.

PKI provides five main services:

1) Authentication: The traditional way of authenticating on websites was to sign in by entering the user name and the password. However, this way is not secure as anyone can hack them and use them illegally. Whereas, PKI uses an alternative method whereby an electronic ID, mobile ID or Token is required to authenticate the identity of the user.

2) Electronic Signature: Any citizen can use this feature to sign any certificate online at any time without the need to go to the concerned premises. S/he can use eID, mobile ID or Token to do so.

3) Encryption: It is the process of encoding information in such a way that only authorized parties can read it. PKI activated this feature so that information is saved securely.

4) Email Encryption: By utilizing PKI, persons can send files through emails safely in which USB Token is used only.

5) Email signature: another way of ensuring the confidentiality of data sent by emails is through signature which can be obtained from using USB Token only.

Why Mobile PKI?

– Convenience to use.

– High level of security.

– Relay on the SIM type not the Mobile type.

– Easley integrated with services providers.

– Mobile Apps utilization for service delivery.

– Utilization of Mobile’s subscriptions penetrations

HR department at ITA was the first governmental body to use PKI for all ITA’s employment documents such as job contracts, offer letters, signatures of all concerned parties, etc. Any entity in the Sultanate can set up its own PKI so that it facilitates signing, authenticating and encrypting certificates electronically.

It is worth mentioning that Ministry of Commerce and Industry, Ministry of Manpower, Public Prosecution and Muscat Municipality have started using this service. Whereas, other entities such as al Rrafd Fund and the Public Authority for Social Insurance will work on it in the coming few years.

Oman National PKI center will set up a “Registration Authority” accreditation for CBO (Central Bank of Oman). It will also be working on “The Internet Web Trust Accreditation” project which will make the SSL “Secure Socket Layer” Certificate recognized by Web Trust and can be part of any web browser. A Number of government entities as well are currently working to integrate with identity management portal to utilize the eID certificate for authentication and signing services.

Services

ITA PKI has the following services options which varies from providing different types of digital certificates either to Devices or Government and Commercial end user subscribers, or for individuals. OR providing the possibility to join Oman National PKI as Registration Authority (RA) or Sub Certificate Authority (Sub CA). The following are brief tables highlighting the different services options.

Table 4A: Different types of services options to be provided to Government and commercial entities

Options

Services/Certificate Type

Targeting

Gov&Com Device

Gov&Com Subscriber

Option 1

Authentication Certificates

X

Signing Certificates

X

Encryption Certificates

X

Secure Email Signature Certificates

X

Secure Email Encryption Certificates

X

SSL Certificates (Server)

X

SSL Certificates (Client)

X

IPSec/VPN Certificates

X

Server signature Certificates

X

Option 2

Joining PKI Oman as RA (Registration Authority)

X

X

Option 3

Joining PKI Oman as Sub CA

X

X

Joining PKI Oman as TSA (Time Stamp Authority)

X

Table 5A: Different types of services options to be provided to individuals

Services/Certificate Type

Targeting

Individuals

Authentication Certificates (eID/Mobile)

X

Signing Certificates (eID/Mobile)

X

Figure 6A: Oman PKI

Country: Iran (Islamic Republic of)

Document: SG2RGQ/47

Title: National cybersecurity measures

Summary: A framework of best practices on identifying and use of measures and measurement is required for assessing the effectiveness of the information security management system at the national level. This contribution, which is fully inspired from ISO 27004, present a customized template for national cybersecurity measures.

A template and sample for national cybersecurity measures

Fully inspired from ISO 27004[58], a customized template for national cybersecurity measures is presented below. In each row, an example is also provided. As a future work, we intend to augment this set and provide a comprehensive set of national cybersecurity measures for the low-level (base measures) as well as the high-level (derived measures or indicators), for the 5 domains of national cybersecurity, and for different phases of development of national ICT infrastructure and national cyberspace security management system.

Table 6A: Customized template for national cybersecurity measures

Measurement identification

Measurement name

Measurement name (e.g., information security incident management effectiveness).

Numerical identifier

Unique nation-specific numerical identifier.

Purpose of measurement

Describes the reasons for the measurement (e.g., assessing the effectiveness of the national Information security incident management).

Related security control

Measure type

Effectiveness/efficiency, implementation-compliance, or impact (e.g. effectiveness).

Object of measurement and attributes

Object of measurement

Object (entity) that is characterised through the measurement of its attributes. An object may include processes, plans, projects, resources, and systems, or system components (e.g. the national cybersecurity management system).

Attribute

Property or characteristic of an object of measurement that can be distinguished quantitatively or qualitatively by human or automated means (individual incident).

Base measure specification (for each base measure [1...n])

Base measure

A base measure is defined in terms of an attribute and the specified measurement method for quantifying it (e.g. number of trained personnel, number of sites, cumulative cost to date). As data is collected, a value is assigned to a base measure (e.g. a pre-determined threshold number).

Measurement method (formula)

Logical sequence of operations used in quantifying an attribute with respect to a specified scale (e.g. count occurrences of information security incidents reported by the date).

Measurement method

Depending on the nature of the operations used to quantify an attribute, two types of method may be distinguished:

- Subjective: quantification involving human judgment.

- Objective: quantification based on numerical rules such as counting (e.g. objective).

Scale

Ordered set of values or categories to which the base measure’s attribute is mapped (e.g. numeric).

Type of scale

Depending on the nature of the relationship between values on the scale, four types of scale are commonly defined: nominal, ordinal, interval, and ratio (e.g. ordinal).

Unit of measurement

Particular quantity, defined and adopted by convention, with which any other quantity of the same kind can be compared to express the ratio of the two quantities as a number (e.g. incident).

Data source

The security incident reported by all national organization such national security operating system.

Derived measure specification

Derived measure

A measure that is derived as a function of two or more base measures (e.g. incidents exceeding threshold).

Measurement function

Algorithm or calculation performed to combine two or more base measures. The scale and unit of the derived measure depend on the scales and units of the base measures from which it is composed of as well as how they are combined by the function (e.g. comparing the number of total incidents with the threshold).

Indicator specification

Indicator

Measure that provides an estimate or evaluation of specified attributes (e.g. line chart that depicts the constant horizontal line illustrating the threshold number(s) against the total number of incidents over several reporting periods.).

Analytical model

Algorithm or calculation combining one or more base and/or derived measures with associated decision criteria. It is based on an understanding of, or assumptions about, the expected relationship between the base and/or the derived measure and/or their behaviour over time. An analytical model produces estimates or evaluations relevant to a defined information need (e.g. red when total number of incidents exceeds the threshold (goes over the line); yellow when total number of incidents is within 10% of the threshold; green when total number of incidents is below the threshold by 10% or more).

Decision criteria specification

Decision criteria

Thresholds, targets, or patterns used to determine the need for action or further investigation, or to describe the level of confidence in a given result. Decision criteria help to interpret the results of measurement (e.g. red – immediate investigation into causes of increase in number of incidents is required. Yellow – numbers need to be closely monitored and investigation should be started if numbers are not improving. Green – no action is required).

Measurement results

Indicator interpretation

A description of how the sample indicator (see sample figure in indicator description) should be interpreted (e.g. if red is observed in two reporting cycles, a review of the incident management procedures is required to correct existing procedures or to identify additional procedures. If the trend is not reversed during the next two reporting periods corrective action is required, such as proposing an extension to the ISMS scope).

Reporting formats

Reporting formats should be identified and documented. Describe the observations that the organization or owner of the information may want on record. Reporting formats will visually depict the measures and provide a verbal explanation of the indicators. Reporting formats should be customized to the information customer (e.g. line chart).

Stakeholders

Client for measurement

Management or other interested parties requesting or requiring information about the effectiveness of the national cybersecurity management system controls or group of controls (e.g. NCMS committee, managers responsible for the NCMS, security management, incident management).

Reviewer for measurement

Person or organizational unit that validates the appropriateness of measurement constructs for assessing the effectiveness of NCMS controls or group of controls (e.g. managers responsible for the national cybersecurity management system).

Information owner

Person or organizational unit that owns the information about an object of measurement and attributes and is responsible for the measurement (e.g. managers responsible for the national cybersecurity management system).

Information collector

Person or organizational unit responsible for collecting, recording and storing the data (e.g. incident manager).

Information communicator

Person or organizational unit responsible for analysing data and communicating measurement results (e.g. NCMS Committee).

Frequency/Period

Frequency of data collection

How often data is collected (e.g. monthly).

Frequency of data analysis

How often data is analysed (e.g. monthly).

Frequency of reporting measurement results

How often measurement results are reported (this may be less frequent than data collection).

Measurement revision

Date of measurement revision (expiry or renovation of measurement validity) (e.g. six months).

Period of measurement

Defines the period being measured (e.g. monthly).

Country: Iran (Islamic Republic of)

Document: SG2RGQ/46

Title: National cybersecurity measures and measurements

Summary: This contribution is an attempt to develop a framework for “national cybersecurity measurement program (NCMP)” with emphasis on identifying and using appropriate metrics for evaluating and/or enhancing the planned or implemented “national cybersecurity management system (NCMS)”. Once adequately designed and successfully implemented, the NCMP can be regarded as a major component of the NCMS, which provides the means to quantitatively present a picture of national security posture, monitor the effectiveness of the implemented NCMS, and the extent of compliance with laws, rules and regulations. It can also indicate deviations from the expected security requirements and objectives, and increase the accountability by helping to identify either incorrectly or ineffectively implemented security controls or the ones that have not been implemented. All of the above provide important quantifiable inputs for proper decision making for enhancing cybersecurity at the national level and for allocating the required resources. This contribution also discusses the necessity and importance of developing security metrics and measurement at the national level. Developing a comprehensive set of metrics for national cybersecurity is vital for achieving the aforementioned objectives of NCMP at the national level. Inspired from the state-of-the art security metrics already developed for organizations, we will introduce a set of metrics that can be used by institutions at the national level for developing their NCMPs.

Introduction

Assessment of cybersecurity at the national level requires continuous measurement of cybersecurity indicators. In order to plan and implement an effective national cybersecurity management system (NCMS) [1], there is an urgent need to develop an appropriate national cybersecurity measurement program (NCMP). NCMP facilitates decision-making and improves the performance and accountability at the national level.

A framework of best practices for identifying and using a set of measures and measurement is needed to assess the effectiveness of an information security management system at the national level. Similar to the NCSec framework in [1], which was fully inspired from ISO/IEC 27001 [2] for the ISMS at the organizational level, we propose a “national cybersecurity measurement” which is inspired from ISO/IEC 27004 [3] and NIST-800-55-R1 [4], both of which were developed for assessing cybersecurity at the organizational level. Also, similar to the case that was inspired from ISO/IEC 27001, there is a need to “define how to measure the effectiveness of the selected controls or groups of controls and specify how these measures are to be used to assess the effectiveness of controls to produce comparable and reproducible results” at the national level.

This contribution is an attempt to develop a framework for “national cybersecurity measurement program (NCMP)” with emphasis on identifying and using appropriate metrics for evaluating and/or enhancing the planned or implemented “national cybersecurity management system (NCMS)”. Once adequately designed and successfully implemented, the NCMP can be regarded as a major component of the NCMS, which provides the means to quantitatively present a picture of national security posture, monitor the effectiveness of the implemented NCMS, and the extent of compliance with laws, rules and regulations. It can also indicate deviations from the expected security requirements and objectives, and increase the accountability by helping to identify either incorrectly or ineffectively implemented security controls or the ones that have not been implemented. All of the above provide important quantifiable inputs for proper decision making for the improvement of national cybersecurity and allocation of required resources.

In what follows, we first introduce the concepts related to security measures and then present our proposed general framework for the NCMP.

Security measures

a. Base measures, derived measures and indicators

ISO/IEC 27004 identifies the derived measures, each of which is a function of two or more base measures; and the indicators, each of which is a function of two or more base/derived measures combined with a predefined decision criteria (i.e., targets) for measurement. All three layers can collectively be referred to as measures. The terms metrics and measures interchangeably.

b. Types of security metrics

NIST [4] categorizes performance metrics in three categories:

– Implementation or compliance metrics,

– Effectiveness/efficiency metrics, and

– Impact metrics.

Implementation or compliance measures are used to demonstrate progress in implementing programs, specific security controls, and associated policies and procedures [4]. Implementation measures related to information security programs include the percentage of national information systems with approved system security plans, and the percentage of national information systems that require password policies. Implementation measures can also examine system-level areas—for example, servers within a system with a standard configuration. Implementation measures assess the implementation progress of NCMP, security controls, and the national security policies and procedures (both programme- and system-level).

Effectiveness/efficiency measures are used to monitor if the program-level processes and the system-level security controls are correctly implemented, are operating as intended, and the expected outcome is met [4]. Implementation metrics indicate if specific security controls, and their associated policies and procedures are implemented, regardless of how effective or efficient they may be, while effectiveness/efficiency measures indicate how effective/efficient the implemented controls and associated policies and procedures are. Impact measures are used to articulate the impact of information security on mission [4] at national level.

NIST SP 800-55 [4] emphasizes the relation between the maturity of information security programme and the types of measures that can be obtained. It proposes three types of security measures at both system and programme levels, namely, the implementation, the effectiveness/efficiency, and the business impact measures. The results of implementation measures may be less than 100 percent at the beginning, but as NCMS and its associated policies and procedures mature, results should reach and remain at 100 percent. When the implementation measure remains at 100 percent, it can be concluded that the national information systems are utilizing the security controls that are relevant to this measure, but measurement controls need improvement. After most of the implementation measures reach and remain at 100 percent, the organization should begin to focus its measurement efforts on effectiveness/efficiency and impact measures. Organizations should never fully retire the implementation measures because they identify specific areas that are in need of improvement. As the national cybersecurity system matures, the emphasis and resources of the measurement programme should shift away from implementation towards the effectiveness/efficiency and the impact measures [3].

Figure 7A: General framework of NCMP major processes that collectively comprise a NCMP

A general framework for NCMP

Inspired from ISO/IEC 27004, major processes that collectively comprise a NCMP are (see Figure 7A):

– Measures and measurement development;

– National cybersecurity measurement operation;

– Data analysis and measurement results reporting, and using them for proper decision making;

– NCMP evaluation and improvement.

Using information security metrics in the NCMP can provide the following benefits:

– A quantitative picture of national security posture;

– Monitoring the effectiveness of NCMS and the extent of compliance with applicable laws, rules and regulations;

– Determining the deviation from the expected results (predetermined security requirements and objectives);

– Increasing the accountability by identifying either incorrectly or ineffectively implemented security controls or those that have not been implemented, and their corresponding stakeholders;

– Providing important quantifiable input to facilitate proper decision making for enhancing national cybersecurity and allocating the required resources;

– Providing management reports on the impact of past and current activities;

– Assessing security products or services from third parties and providing means to compare different products, services, policies and procedures.

Figure 8A: General scope for national cybersecurity measures

The scope of NCMP determines the types of security measures, at both low-level (base measures) and high-level (derived measures or indicators), for the 5 domains of national cybersecurity, and during different phases of national ICT infrastructure and NCMS (see Figure 27). A total of 34 processes comprise these domains, which are strategy and policies, implementation and organization, awareness and communication, compliance and coordination, and evaluation and monitoring [1]. Collecting, analysing and reporting appropriate security measures during different phases of system development causes integration of security considerations into the national ICT infrastructure and NCMS development. This would ensure that system security requirements are built-in from the design phase to the implementation and operation phases, rather than as an add-on at a later stage [3], which is complicated and costly. The scope of NCMP depends on each specific stakeholder needs, strategic goals and objectives, operating environments, risk priorities, and maturity of the national cybersecurity programme.

Conclusions and directions for future works

National cybersecurity measurement can play an important role in improving the global cybersecurity. The challenges include identifying a set of well-defined and comprehensive security measures, and implementing an effective NCMP via active cooperation and information sharing between governments, industry, international organizations and other relevant stakeholders.

References

[1] ITU-D Study Group 1, Final Report, Question 22-1/1, Best Practice for Securing Information and Communication Networks: Best Practices for Developing a Culture of Cybersecurity, 2014.

[2] ISO/IEC 27001, Information Technology -- Security Techniques -- Information Security Management Systems – Requirements, 2005.

[3] ISO/IEC 27004, Information Technology -- Security Techniques -- Information Security Management – Measurement, 2009.

[4] NIST Special Publication 800-55 Revision 1, Performance Measurement Guide for Information Security, 2008.

Country: Korea (Republic of)

Document: 2/234

Title: Korea’s K-ICT security development strategy

Summary: As voluntary investments for the expansion of information security systems and reinforcement of manpower are insufficient, and the security infrastructure of non-ICT sectors or SMEs is inadequate, there are many blind spots. To cope with these obstacles, the Korean government announced the “K-ICT Security Development Strategy” in April 2015. This contribution introduces the overall contents and its expected benefits.

Background

As the age of super connection and ICT convergence in which everything is connected to the Internet, and the ICT convergence with existing industries is accelerating, cyberspace has become a secondary sphere of life. Security threats in the cyberspace, however, are becoming more intelligent and covert and cause enormous economic damages and social confusion, which directly affects the life of citizens and national security. Moreover, cyber-attacks keep evolving and grow into a more intelligent, covert and bigger cyber-warfare even targeting national infrastructure. Korea, which is recognized as one of the most connected countries in the world, still lacks voluntary efforts in the private sector, public awareness concerning information security, and the fundamentals such as related industry infrastructure, professional manpower, and technology. As voluntary investments for the expansion of information security systems and reinforcement of manpower are still insufficient, and the security infrastructure of non-ICT sectors or SMEs is inadequate, there are many blind spots.

To cope with these problems, aside from the IoT security roadmap that was presented in the last rapporteur meeting, the Ministry of Science, ICT & Future Planning (MSIP) of Korea announced the “K-ICT Security Development Strategy” to reinforce the competitiveness of the information security industry, technology, and manpower in April 2015.

This strategy includes four projects. The first is to create a future growth engine by reinforcing the infrastructure of the information security industry. The second is to develop source security technologies and the third is to foster top-notch security manpower as well as create a culture conducive to information security. Last but not least is to increase investments to enhance the resilience of cyber security.

Creating a future growth engine by reinforcing the infrastructure of the information security industry

The Ministry is planning to improve the structure of the information security industry by switching the existing price competition-based market to a performance-based one, and to introduce a proper system for paying fair prices for information security services. Also, the Ministry will prepare and provide “the Information Security Service Price Assessment Guideline” to introduce a system for assessing the fair price of information security continuity service, which ensures appropriate security performance of related products.

In addition, the Ministry is planning to provide information security investment incentives, such as giving preferences in participation in the government and public procurement and R&D, to induce corporations to voluntarily invest in security and take active measures. The Ministry will also review and push ahead with the public announcement of corporate information security status that includes the status of related manpower, organization, education, etc. of a business to encourage autonomous security competition among corporations and help users choose better products and services. In particular, the Ministry is planning to reinforce the evaluation for the level of information security investments to enhance the security level of key private enterprises such as mobile communication services and Critical Information Infrastructures (CIIs).

The Ministry is also planning to identify and foster information security startups by providing support such as sharing security vulnerabilities, test beds and international certification support so that excellent security ideas can lead to successful startups. In addition, the Ministry is seeking to identify best security models of new industries like drones, next-generation CCTVs, and biometric products and turn them into new economic growth engines.

Developing source security technologies

The Ministry is planning to encourage national R&D centers and private enterprises to develop world-class information security products and technologies by 2019 by intensively studying innovative, intelligent and invisible technologies with the goal of leading the global cybersecurity market and securing technology competitiveness.

These research communities and related businesses are expected to lead innovative technologies that respond to new threats in the ICBM (IoT, cloud, big data, mobile) environment, key infrastructure control network security and intelligent cyberattacks such as Advanced Persistent Threats (APT). They will also develop smart security technologies to reduce cyber threat response time, such as cyber threat detection technologies and forensic technologies for attack source traceback. In addition, they will intensively develop convenient security (usable security) technologies including the fraud detection system (FDS) for users.

Another plan of the Ministry is to build a global cyber open R&D system by allowing more outstanding overseas researchers to participate in domestic R&D activities, and making them to conduct joint studies with leading institutes and universities in cyber security related areas.

Fostering top-notch security manpower and creating a culture conducive to information security

The Ministry will continuously increase the number of information security schools so that potential security manpower can enter colleges without worries about the college scholastic ability test, and recruit military and police cyber security specialists to prevent career interruption caused by mandatory military service.

The Ministry is also planning to foster security coordinators to reinforce the security competence of field workers in different industries, such as the financial and manufacturing industries, and bring up top-notch manpower in different areas such as finance and national defense.

The Ministry is going to turn and expand the Korea Internet & Security Agency (KISA) Academy into an institution dedicated to fostering top-notch security manpower (cyber security manpower center), and build a cybersecurity training center (Security-GYM) to strengthen cyber response capabilities. In addition, the Ministry will carry out the nationwide information security culture movement (Security All Wave) to turn the awareness of the importance of information security into action by transforming information security into a social culture. The Ministry is also planning to induce voluntary compliance with security rules by developing and disseminating customized security rules for different information security agents, which include individuals, enterprises and Chief Executive Officers, etc.

Increasing investments to enhance the resilience of cyber security

With close cooperation with the Korea Internet & Security Agency, the Ministry will diagnose the current status of cyber safety to reinforce the security of key infrastructures of the private sector (ISP, infrastructure, etc.) and services used by many people such as online storages, routers, portals, etc., and build an in-depth cyber detection system to quickly detect cyberattacks and expand the response range.

The Ministry is also planning to build 100,000 cyber traps to lure hackers as a way to reinforce responses to electronic financial frauds, such as pharming and smishing, and ensure the security of devices including smartphones, routers and CCTVs, and to improve the cyber threat response systems by implementing Chief Information Security Officer (CISO) hotlines between the government and key enterprises (mobile carriers, portals, IDC, etc.).

The Ministry will reinforce security throughout the supply chain of Critical Information Infrastructures, including external management manpower, consignment and outsourcing, purchasing and procurement, and will also actively support the implementation of Information Sharing and Analysis Centers (ISACs).

To provide customized information security services for SMEs, the Ministry is planning to reinforce technical and site support for quick emergency response and system recovery in case of infringement accidents, and establish more information security support centers.

Way forward

The Korean government is expected to increase the size of the domestic information security market by improving the structure of the information security industry, to expand investments in information security and to create new demands for convergence security and physical security.

To become one of the most powerful countries in cyber security in the world, the fundamentals of the information security industry should be very strong and resilient, and the Korea government expects that this strategy will serve as a turning point in innovating the information security industry, technology and expertise of Korea. Moreover, a large number of new jobs are expected to be created by promoting the convergence security and physical security industry and internalizing information security across all industries including communication, finance, manufacturing, and energy.

Country: Odessa National Academy of Telecommunications n.a. A.S. Popov (Ukraine)

Document: 2/156

Title: Multimedia distance-learning course on the safe use of Internet resources

Summary: ITU’s Telecommunication Development Bureau as part of the CIS regional initiative on “creating a child on line protection centre for the CIS region”, adopted at WTDC-14 (Dubai, UAE), with the support of the Odessa National Academy of Telecommunications n.a. A.S. Popov (Ukraine).

The course is divided into three parts: basic (for pre-school and junior school children); intermediate (for children in classes 5 to 9); and advanced (for senior pupils, students, parents and teachers). Each course is based on thematic modules with tests after each module.

Introduction

The CIS region had already begun to consider the issue of protecting children on line at the end of the 1990s. Approaches to the problem differed among the countries of the region, however, reflecting the range of views in different countries on issues of public morals, pornography, privacy and data protection.

All countries in the region without exception have acceded to the Convention on the Rights of the Child, without any declarations or reservations regarding Articles 16, 17 and 34(c). All countries in the region have also acceded to, signed and/or ratified the Optional Protocol to the Convention on the Rights of the Child on the Sale of Children, Child Prostitution and Child Pornography, without any declarations or reservations regarding Articles 2 and 3 of that instrument.

In many countries in the region, software producers, telecommunication operators and educational establishments are actively developing child on line protection programmes of their own. Notable examples might be two Ukrainian projects: “Safety of Children on line”, which is being implemented by the Coalition for the Safety of Children on line; and “System for restricting access to inappropriate Internet resources”, a project being developed by the Odessa National Academy of Telecommunications n.a. A.S. Popov (Ukraine). In May 2012 the project “Building safer internet for educational institutions”, which formed the framework for the presentation of the system for restricting access to inappropriate Internet content, was recognized as the best project in the category “C5. Building confidence and security in the use of ICTs” in a competition organized as part of the WSIS Forum 2012 event (Geneva, 14-18 May 2012), and acknowledged by the Secretary-General of ITU as one of the major achievements in creating connectivity worldwide.

With their common political, economic, environmental, humanitarian and cultural history, the countries of the Commonwealth of Independent States (CIS) share a number of characteristics with regard to Internet use, and this has an impact on users’ interests and resources. The key factors here include: a close linguistic environment (most of the peoples in the CIS countries are fluent in Russian); a more or less identical level of ICT development and broadband penetration; common problems in the applications of ICTs (a sharp contrast in terms of teacher training in the towns and rural areas, a common “post-soviet” model of education, an absence of trained system administrators in rural schools, and so on); and a roughly similar level of Internet regulation.

The international seminar on integrated aspects of child protection on the Internet, held in Odessa, Ukraine, in April 2011, and the Interregional seminar for Europe, the Asia and Pacific region and the Commonwealth of Independent States on “Current methods for combating cybercrime” (March 2012), identified the main obstacles to strengthening confidence and child on line protection in developing countries. Participants noted in particular the importance of international cooperation as a means of exchanging experience and improving child on line protection.

A natural progression from this idea was the adoption at the World Telecommunication Development Conference 2014 (Dubai, UAE) of the CIS initiative on “creating a child on line protection centre for the CIS region”. One of the expected outcomes of that initiative is the creation of distance-learning courses on safe use of Internet resources involving testing of children, parents, teachers, and so on.

It should be noted that existing training materials (including multimedia clips and courses) do not cover the entire range of issues pertaining to Internet safety and as a rule do not include systems for testing and certification. In the light of this, the Odessa National Academy of Telecommunications n.a. A.S. Popov (Ukraine) proposed to develop a course on the safe use of Internet resources along the lines of the UN course on “Security in the Field”, which could then be followed by children, parents and educational staff.

It was proposed that the course should be divided into three parts: basic (for children of pre-school and junior school age); intermediate (for children in classes 5 to 9); and advanced (for senior school pupils, students, parents and teachers), each part being based on thematic modules with testing on completion of each module.

The Academy proposed the structure and basic features of the courses, which were presented at the fourth meeting of ITU-D Study Group 1 (document 1/265, study period 2010-2014) and at the seventh meeting of the Council Working Group on Child on line Protection (document WG-CP/7/5).

By September 2015, a Russian-language demonstration version of the course is to be available on line at http://www.onlinesafety.info . Final development and testing are planned for November 2015. The course interface is adapted for use on line using a variety of operating systems and web browsers (including mobile devices based on iOS and Android operating systems).

Basic course

The basic course is structured in three modules: “general information on security in the Internet”; “rules for communication on line”; and “useful and harmful on line games”. To begin with, children choose a hero (boy or girl) to help them follow the course. All slides and navigation moves effected with the cursor are also voiced by the chosen hero.

During the course the child studies such topics as “what is the Internet and how is it organized?”; “what useful things can I get from the Internet?”; “the main dangers on line”; “virus programmes that harm a computer”; “virus programmes for spying on users or gathering personal data held on the computer”; “Illegal, unethical and harmful content”; “misleading content”; “Cyber-bullying and cyber-grooming”; “benefits and harm from social networks”; “what can I tell other people on line and what must I not tell them?” “rules of ‘netiquette’”; “how do I create my on line profile”; “how and what to play on line”; “possible harmful effects of computer games (including the influence of Internet slang on colloquial speech)”, and so on.

The course includes 52 slides of between 10 and 20 seconds’ duration, depending on the density of their multimedia content. Each slide is based on a white background. Colour series are formed in accordance with the Itten principles, and each module has its own colour frame (dark blue, yellow or green). The rate of progress though the course is shown by an animated figure moving in a straight line at the bottom of the screen to indicate the progress made.

The basic part of the course contains five multimedia clips, four interactive games and 50 cartoon-style graphics. For example, in one slide the child is asked to play a game “Get the virus!”. A target in the form of a “virus” moves around the screen. The aim is to strike at it with a special on line “hand”, but the game is designed to ensure that the child cannot succeed in hitting the virus target. After several attempts a voice explains that a computer virus cannot be eliminated in that way and instead, an antivirus programme has to be used.

Throughout the course, the child periodically has to answer test questions involving animated figures. This helps to consolidate the knowledge acquired. A separate test is not envisaged in the basic course and a certificate is issued automatically on completion.

Intermediate course

The intermediate course comprises five modules: “general information on security in the Internet”; “safe entertainment on line”; “rules for communicating with others on line”; “what can you believe on the Internet?”; and “how to protect oneself on line”.

In the first slide, the child learns about the purpose of the course and its format. During the course the child studies topics such as “what is the Internet and how is it organized”; “the main dangers on line”; “Illegal, unethical and harmful content”; “misleading content”; “cyberbullying and cyber grooming”; “Internet fraud”; “basic rules for using the Internet”; “how not to be a victim of virtual reality”; “the influence of Internet slang on colloquial speech”; “antivirus software”; “basic precepts of “netiquette”; “what can I write about (and save) on line?”; “anonymity on line”; “how to verify information on line”; “copyright on line (music, video, images, presentations, dissertations, etc.)”; “working via public networks (WiFi zones, Internet clubs, etc.) or using someone else’s computer”; “rules for working safely with e-mail”; and “who can help if there is a problem on line?”.

The course includes 122 slides of between 10 and 20 seconds’ duration each, depending on the density of their multimedia content. For each sequence there is voice-over accompaniment. Each sequence is based on a white background. Colour series are formed in accordance with the Itten principles and each module has its own colour frame. The rate of progress though the course is shown by “road blocks” indicated by white screens which change to green once a module has been completed The intermediate part of the course contains five cartoon clips (different from the basic course), two interactive games, 77 cartoon-style figures and 12 infographic figures.

On completing the course the child takes a test comprising ten questions which contain possible answers. The test set is based on random selection from 40 questions (eight for each module).

Advanced course

The advanced course comprises seven modules: “general information on security in the Internet”; “rules for communicating with others on line”; “safe entertainment on line”; “what can you believe in the Internet?”; “confidentiality and working via public networks”; “risk assessment and behaviour in difficult situations”; and “methods of filtering content and child protection on line”.

The advanced course interface is designed to be as similar as possible to that of the UN advanced “Security in the Field” course. Information is presented with the aid of a number of different types of slide and additional elements which make it possible to create small interactive scenarios using a range of multimedia content. Participants study such topics as “basic information on Internet architecture”; “existing threats (viruses, fraudsters, criminals and so on)”; “how to remain literate when communicating with others on line”, “what can you write about and what should you not write about on line?”; “ensuring that children do not view undesirable content”; “copyright and how you can break the law without knowing it”; “how much time may I spend on line?”; “the influence of Internet slang on colloquial speech”; “typical forms of Internet fraud”; “data protection”; “monitoring children’s behaviour on line”; “threats to life and health on line”; “basic content filtering techniques”; “advice on choosing content filtering systems (for homes, schools and institutions)”, and other aspects. The course includes 57 slides of 30-40 seconds’ duration each, depending on the density of their multimedia content. Each sequence is provided with a partial audio accompaniment.

The advanced part of the course comprises three cartoon clips (different from the basic and intermediate courses), five interactive games, 23 photo images, and 19 infographic-style figures. An example of an interactive game at the advanced level could be a dialogue between the user and an imaginary character of the opposite sex. Following the lead-in, a conversation develops and is led by the imaginary character. The user selects responses from a set of ready-made models from a list. The list includes various options containing Internet slang and/or stylistic and spelling errors, as well as replies that are stylistically and grammatically sound and do not include slang. The aim of this dialogue is to induce the interlocutor to engage in further discussion, create a positive impression, and so forth; this is not achieved if too much use is made of Internet slang, or if the chosen responses contain stylistic and spelling mistakes. When the dialogue is finished, feedback is given to the user on the use of Internet slang during the interactive discussion.

Conclusion

The Odessa National Academy of Telecommunications n.a. A.S. Popov (Ukraine) invites all interested parties to collaborate in testing and disseminating the course that has been developed and to translate it into the official languages of ITU.

Country: Togo (Republic of)

Document: 2/153

Title: Security of electronic transactions

Summary: The Public Key Infrastructures commonly used to secure electronic communication services contribute to establishing confidence in the use of ICTs. Economic models stemming from their value chain can bring growth in the digital economy of the States that implement them. The ever-increasing development of electronic commerce and transactions, the progressive and large-scale deployment of new protocols and network services based on Public Key Infrastructures, and the security of the Internet of Things are, inter alia, reasons that should encourage the creation of root certification authorities in developing countries on the one hand, and the rethinking of a model of organization for the trust chain of the national-level root certification authority in a global way, on the other hand.

The objective of this contribution is to invite ITU-D Study Group 2 and ITU-T Study Group 17 to study the impact and potential benefits of establishing root certification authorities in developing countries in order to elaborate a programme to implement such root certification authorities, if appropriate. This study should enable estimation of developing countries' preparation for having a national root certification authority, and allow streamlining of the assistance that BDT is already providing, for instance on CIRT implementation.

Introduction

The development of electronic commerce and transactions, including online purchases and payments, execution of stock market orders, online administrative tax filing (VAT, income tax, electronic medical care sheet), exchanges of e-mails and electronic documents; the implementation of new network security protocols based on public key infrastructures and their progressive large-scale deployment, in particular, DNSSEC, RPKI (Resources Public Key Infrastructure); and the security of the Internet of Things are crucial elements which should incite developing countries to work towards the establishment of institutions at national or regional level in charge of the management of their public key infrastructures. The creation of these institutions, if properly supervised, can contribute to strengthening the security of electronic communications in general, and that of electronic transactions in particular. They can also allow the emergence and development of digital economies in developing countries.

Statements

Electronic commerce and transactions are developing rapidly in developing countries. These transactions typically use insecure channels. However, when they are secured, they are based on self-signed certificates or on certificates purchased using certification authorities generally based in developed countries. In some cases, however, these certificates are not necessarily in accordance with the legislation of developing countries.

The lack of enthusiasm and the delays noted in the deployment of secure protocols, such as DNSSEC and RPKI, in developing countries are due to misunderstanding either of these protocols or the standards that allow their implementation, or to the insufficiently trained human resources involved in their deployment, or to a non-mastered grasp related to chains value.

All these inadequacies can be improved with the implementation of a root certification authority in each country. Indeed, the authorities, besides their traditional roles, will also be tasked with the broadcast, validation, and revocation of certificates to promote a culture of secure electronic transactions, as well as the organization of trust chains to national and international levels.

To assure this situation, some developing countries have set up root certification authorities. However, the functioning of these certification authorities does not necessarily reflect the state of the art in the field. It is advisable to improve the functioning of certification authorities, in particular, by implementing clear procedures based on best practices as well as accepted standards on the subject. This will have the advantage of ensuring the security of transactions and consumers in those developing countries that have already set up their certification authority on the one hand, and on the other hand, will promote the implementation of these certification authorities in those countries that do not have such capability.

Thus, in the context of the emergence of new digital economies in developing countries, the establishment of root certification authorities can be an important link and a social and economic development lever.

Proposal

This contribution aims at asking Question 3/2 to undertake a study on the impact of the implementation of root certification authorities in developing countries. The study should possibly lead to a proposal for the establishment of such root certification authorities in Member States, along the lines of what is currently being done with the setting up of CIRTs.

The objectives of the study include:

– Assessing the readiness of developing countries for setting up root certification authorities at a national level;

– Identifying requirements in terms of the skillset necessary to set up and run certification authorities at a national level;

– Performing a gap analysis on the current national legal frameworks to better identify the actions required to improve national legislations on cryptography, digital certification and digital signature;

– Reflecting on business models and operational plans to support the viability of the activities of the national root certification authority while taking into account regional specificities;

– Assessing the possible evolution of national root certification authorities toward a chain of trust between them.

Furthermore it is requested that Question 3/2 coordinate with ITU-T Study Group 17 to investigate the opportunity to:

– Set up a human capacity-building programme for developing countries based on standards and the implementation of standards related to electronic certification, in particular the X.500 series standards;

– Develop kits of best practices on the implementation and use of standards related to electronic certification.

Conclusion

The security of electronic transactions is fundamental in building confidence in the use of ICTs. The establishment of institutions whose operation should achieve this goal is essential for developing countries. However, it should be referenced by politically, technically and organizationally based frameworks that enable the creation and smooth organization of these institutions.

Country: United States of America; Netherlands (Kingdom of the)

Document: 2/332

Title: The Global Forum on Cyber Expertise (GFCE)

Summary: This contribution provides a background and explanation of the Global Forum on Cyber Expertise (GFCE), a global initiative that was launched by the Netherlands in April 2015 at the Global Conference on Cyberspace in The Hague. The GFCE currently has 52 members and is open to all governments, intergovernmental organizations, and private companies who sign on The Hague Declaration on the GFCE. The GFCE is a platform for sharing of best practices, identifying gaps in global cyber capacities, and complementing existing capacity building efforts. The United States is proud to be one of the founding members of the GFCE.

This contribution is related to the following issues for study from the Question 3/2 Terms of Reference: c) Continue to gather national experiences from Member States relating to cybersecurity, and to identify common themes within those experiences. e) Provide a compendium of relevant, ongoing cybersecurity activities being conducted by Member States, organizations, the private sector and civil society at the national, regional and international levels, in which developing countries and all sectors may participate, including information gathered under c) above.

Introduction: What is the GFCE?

Societies worldwide have a growing demand for cyber capacity in order to reap the full economic and social benefits of cyber technology. Everyone should be able to profit from the potential an open, free and secure internet has to offer. To answer to the growing global demand for cyber capacity, The Netherlands Government launched the Global Forum on Cyber Expertise initiative (GFCE) during the Global Conference on Cyberspace, in April 2015. The GFCE is a key multi-stakeholder voluntary initiative for fostering international solidarity and providing political, technical and financial support for efforts to strengthen international cooperation among all stakeholders on cyber issues. The GFCE promotes cyber capacity building in a vision where the interests for security, economy and human rights go hand in hand.

What does the GFCE do?

The GFCE was established to strengthen cyber capacity and expertise to make the existing international cooperative efforts more effective.

GFCE Goals:

– Exchanging expertise: The GFCE offers a broad, informal platform for countries, international organizations and private companies to exchange experiences, expertise, best practices and assessments on four themes of cyber capacity building: cybersecurity, cybercrime, data protection and e-governance.

– Development of practical initiatives: The GFCE functions as an incubator for the development of practical initiatives on these four themes (together with experts from NGOs, academia and the tech community).

– Agenda setting of cyber capacity building: The GFCE sets cyber capacity building as a strategic issue on the global agenda and takes the lead in streamlining and escalating cyber capacity building efforts on a global level.

What is the structure of the GFCE?

The GFCE is comprised of the Secretariat, Members, Partners and the Advisory Board.

GFCE Secretariat

The GFCE has a permanent Secretariat that is located in The Hague and gives logistical and administrative support to GFCE members and partners.

GFCE Members

GFCE Members are countries, intergovernmental organizations, and private companies committed to building cyber capacity worldwide. The GFCE has 52 members including the following:

Countries

Intergovernmental organizations

Corporations

Argentina

Mexico

African Union

Hewlett Packard

Australia

Morocco

Council of Europe

IBM

Bangladesh

The Netherlands

Economic Community of Western African States

Huawei

Belgium

New Zealand

Europol

Microsoft

Canada

Norway

International Chamber of Commerce

NRD CS

Chile

Peru

International Telecommunication Union

Symantec

Estonia

ROK

Organization of American States

Vodafone

European Union

Romania

Finland

Rwanda

France

Senegal

Germany

Spain

Hungary

Sweden

India

Switzerland

Israel

Tanzania

Japan

Turkey

Kenya

USA

Latvia

UK

Vietnam

GFCE Partners

GFCE Partners are organizations with specific cyber expertise which are invited by GFCE members to participate in a GFCE initiative. GFCE Partners include: The Global Cyber Security Capacity Centre (GCSCC), Meridian Community, and the United Nations Office on Drugs and Crime.

GFCE Advisory Board

The GFCE Advisory Board consists of two Co-chairs and 9 representatives from civil society, the technical community and academia. Members serve voluntarily on the Advisory Board for a period of two years, and applications are gathered through an open call published on the GFCE website. The composition of the Advisory Board aims to reflect the geographic, gender and stakeholder balance of the GFCE. Members strive to provide substantive and strategic guidance to the GFCE members on the forum’s strategic objectives, activities and initiatives, and are committed to the principles as set out in The Hague Declaration and the GFCE Framework Document.

How can a country become a member of the GFCE?

The GFCE aims to be a platform for the development of initiatives that could benefit parties beyond the GFCE membership. The GFCE is open to new members. Countries, intergovernmental organizations and private companies are eligible for full GFCE membership. (Membership is done at the national level, therefore government agencies or departments cannot become members on their own accord). If an organization/country would like to submit a request for membership, it is necessary to officially endorse The Hague Declaration on the GFCE and the Framework Document. For additional information on membership, contact the GFCE Secretariat at: contact@thegfce.com. For additional information on the GFCE and different initiatives check out the GFCE website at http://www.theGFCE.com.

What are the GFCE initiatives?

Since the launch of the GFCE in 2015, GFCE members and partners have actively developed a number of cybersecurity and cybercrime initiatives in different regions of the world. At the annual GFCE meetings members and partners disseminate the results, lessons learned and best practices of an Initiative amongst GFCE members. New initiatives can be submitted to the GFCE Secretariat at any time.

Below is a listing of the current GFCE initiatives and their members. Additional details can be found on the GFCE website (http://www.thegfce.com/initiatives). Participation for each initiative is open to all GFCE members.

a. Promoting Cybersecurity Due Diligence across Africa: This U.S. and African Union Commission initiative, in partnership with the Economic Community of West African States (ECOWAS), the Southern African Development Community (SADC), the East African Community (EAC), the Economic Community of Central African States (ECCAS), the Common Market for Eastern and Southern Africa (COMESA), helps African Member States draft national cybersecurity frameworks for national and international engagements on cyber policy. These efforts include creating a culture of cybersecurity, developing national cyber strategies, enacting and enforcing comprehensive legal frameworks related to cybersecurity and cybercrime, and building organizational structures to improve cyber incident management capabilities on the continent. GFCE Members include: The United States and the African Union.

b. A Global Campaign to Raise Cybersecurity Awareness: Through this initiative, the United States, in partnership partnerships with Canada and the OAS, aims to raise awareness of cyber-related threats and best practices worldwide and empower citizens with the knowledge and a sense of shared responsibility to practice safe and informed behaviours on the Internet. By leveraging expertise from international partners in the government, academic, non-profit and private sectors, this cybersecurity awareness campaign initiative will work broadly with stakeholders to ensure a safer and more secure Internet for all. A primary resource for this initiative is the U.S. Department of Homeland Security Stop.Think.Connect.™ Cyber Awareness Campaign. GFCE Members include: The United States, Canada and the OAS.

c. Preventing and Combating Cybercrime in Southeast Asia: This initiative builds on cybercrime programs the United Nations Office on Drugs and Crime (UNODC) delivered in East Africa and Central America with a focus on a new region - Southeast Asia. The U.S., Japan, and Australia, in partnership with the UNODC will develop and execute basic cybercrime training for prosecutors and investigators from the region, conduct assessments of current cybercrime response capabilities, and train judicial staff on cybercrime related issues. GFCE Members and Partners include: The United States, Australia, Japan, and the United Nations Office on Drugs and Crime (UNODC).

d. Cybersecurity Trends in Africa: The United States Government and the AUC have partnered with Symantec (along with participation the Council of Europe and the Organization of American States) in this initiative is to develop a report that collects and presents detailed technical data on cybersecurity threats and trends in Africa. The Report will serve as a comprehensive document on cybersecurity matters in Africa, from which Member States of the African Union, and stakeholders worldwide, can draw useful conclusions and gain a fuller understanding of the major cyber trends in Africa, as well as the current capacity to deal with those threats. GFCE Members include: The United States, the African Union, and Symantec.

e. Cybersecurity Initiative in OAS Member States: This initiative recognizes the importance of having a comprehensive approach to addressing cybersecurity issues and aims to support countries in developing an effective response to cyber threats through an integrated approach. The activity areas are amongst others: national cyber security strategy development; cyber security trainings and workshops; development of an OAS Hemispheric Network; cybersecurity exercises; cyber security and e-government for effective public management; and identification and adoption of technical standards for a secure internet architecture. GFCE Member participants: The OAS, Argentina, Chile, Estonia, Mexico, Spain.

f. Assessing and Developing Cybersecurity Capability: This Initiative is based on the Model developed by the Global Cyber Security Capacity Centre (GCSCC) at the University of Oxford, with the support of international experts and partners. It aims to assist countries in understanding their priorities for investment and development by outlining the key elements necessary to respond to cyber incidents using five dimensions. The UK Government has provided funding to the GCSCC to develop a Capability Maturity Model to provide a framework for benchmarking progress. International Organizations such as the OAS, has seen value in the expertise that the GCSCC can provide, and have created formal frameworks and agreements of collaboration in this regard. The Governments of the UK and Norway are now keen to promote the GCSCC, and its tools to be utilized more widely. GFCE Members and Partners include: The United Kingdom, OAS, Norway, and the Global Cyber Security Capacity Centre (GCSCC).

g. Critical Information Infrastructure Protection Initiative: This initiative aims to support policy makers with responsibility for Critical Information Infrastructure Protection (CIIP) to understand the implications and consequences of cybersecurity issues and to maintain an awareness of current developments. By working together in a global initiative the initiators leverage their CIIP expertise for the benefit of a broader audience to help develop CIIP capabilities, particularly in developing countries. This initiative is run by the Meridian Community, a large group of countries organizing CIIP related International Conferences since 2005. GFCE Members and Partners include: The Meridian Community, Spain, Switzerland, Norway, and the Netherlands.

h. CSIRT Maturity Initiative: The goal of this initiative is to provide a platform for GFCE members to help emerging and existing CSIRTs to increase their maturity level. Through this initiative experts provide emerging and existing CSIRTs tools and instruments including best practices, guidelines, template documents that when applied, will improve cyber security CSIRT maturity. GFCE Members include: The Netherlands, ITU, OAS, and Microsoft.

i. Coordinated Vulnerability Disclosure: This initiative provides a platform to GFCE members to share experiences and lessons learned in cyber security mechanisms for responsible disclosure or coordinated vulnerability disclosure policies and discussions on the broader topic of ethical hacking. GFCE Members include: The Netherlands, Hungary, Romania and Hewlett Packard.

j. Internet Infrastructure Initiative: The aim of this initiative is to help build a robust, transparent and resilient internet infrastructure. Following the experience in the Netherlands in testing and monitoring compliance with international internet standards, this Initiative seeks to broaden this know-how. Key elements include national internet infrastructure, internet exchange points, country domain registries, open source software and routing security. GFCE Members and Partners include: The Netherlands, Poland, Public/Private Platform Internet Standards - The Netherlands, the Kosciuszko Institute, the Netherlands Institute of International Relations ‘Clingendael’.

k. Progressing Cybersecurity in Senegal and West Africa: Senegal and the Netherlands have teamed up to exchange practical steps and expertise to address cybersecurity issues in Senegal and the broader West African region. A secure digital environment will permit the region to fully take advantage of the opportunities for growth that technology offers. GFCE Members and Partners include: The Netherlands, Senegal, and the United Nations Office on Drugs and Crime (UNODC).

l. CyberGreen: The initiative supports CSIRTs worldwide with metrics to measure the health of cyber eco systems. There is a need for a common understanding of cyber health and risks through a widely accepted way of measuring national, service provider, and enterprise cyber health and risks. A common understanding and insight will enable global policy development and capacity building. CyberGreen is different from other assessments because rather than study the vulnerabilities of a system it quantifies the threat an unsecure system poses to others. GFCE Members include: The United Kingdom and Japan.

Annex 1 to contribution 2/332

The Hague Declaration at the GFCE

1. Today, we, governments, intergovernmental organisations and private companies, meet to launch the Global Forum on Cyber Expertise. We recognise and welcome that societies are becoming increasingly digitized, interconnected and dependent on the cyber domain for communication, innovation and sustainable social development and economic growth. We acknowledge that this creates opportunities that should be accessible for every individual worldwide.

2. To fully reap the benefits of information and communication technology, further investments are needed to ensure a free, open and secure cyberspace. As a consequence, inclusive and greater collaboration in the area of capacity building and exchange of expertise within the cyber domain is rapidly becoming one of the most important topics on the international cyber agenda, as was also noted in the 2013 Seoul Framework for and Commitment to Open and Secure Cyberspace.

3. As societies need to rapidly develop their capacity to take full advantage of cyberspace and need to overcome evolving challenges presented in this field, we all face financial and human resource constraints. We need to find better and smarter ways to work together by fostering existing and building new partnerships, establishing best practices and providing assistance to one another.

4. We stand committed to strengthening this cooperation on cyber by creating more opportunities for governments, the private sector, civil society, the technical community and academia from various regions of the world to engage and develop innovative solutions to this truly global challenge. We recognise the growing number of players in the field with relevant cyber experience and expertise, and we seek to make best use of these assets through closer cooperation.

5. We emphasise the need to strengthen and reinforce the existing framework of international cooperation and build new partnerships, enhance institutional capacity where it is most needed. We seek to develop a mutually reinforcing relationship with relevant multilateral institutions and develop practitioner networks that will have an enduring impact on global cyber capacity.

6. As a concrete sign of our unified and firm commitment to strengthen cyber capacity and expertise and to make the existing international cooperative efforts in this field more effective, we hereby establish the Global Forum on Cyber Expertise (hereinafter: GFCE).

Objectives

7. The GFCE will create a pragmatic, action-oriented and flexible forum. It will be consistent with, complement and reinforce existing bilateral, multilateral, multi-party, regional and international efforts to build cyber capacity and expertise and avoid duplication and overlap. The efforts undertaken within the framework of the GFCE will be consistent with international law, in particular the Charter of the United Nations, and respect the Universal Declaration of Human Rights, the International Covenant on Civil and Political Rights and the UN Guiding Principles on Business and Human Rights, where appropriate.

8. The GFCE’s overarching and long term goal is to strengthen cyber capacity and expertise globally.

9. To this end, the GFCE’s primary objective is to provide a dedicated, informal platform for policymakers, practitioners and experts from different countries and regions to facilitate:

a. Sharing experience, expertise, best practices and assessments on key regional and thematic cyber issues. The initial focus areas for capacity and expertise building are cyber security, cybercrime, data protection and e-governance;

b. Identifying gaps in global cyber capacity and develop innovative solutions to challenges;

c. Contributing to existing efforts and mobilise additional resources and expertise to build global cyber capacity in partnership with and according to the particular needs of interested countries, upon their request.

10. Acknowledging that our participation in the GFCE is voluntary and not a legally binding commitment, we have established a framework document that will allow the GFCE to operate in a flexible, transparent and inclusive manner.

11. We plan to hold a high level meeting every year, in which we will discuss the achievements within the GFCE, including Initiatives taken, share experiences and lessons learned, and decide upon the way forward, preferably within the margins of the Global Conferences on Cyberspace. Nonmembers are welcome to take part in the discussions during these meetings. Civil society, the technical community and academia will be encouraged to participate and contribute to these discussions.

12. A small administrative unit will provide secretarial, communications and logistical support, and will prepare, in coordination with future hosts of the Global Conferences on Cyberspace, the annual high level meeting. This secretariat will initially be hosted and financed by the Netherlands.

Annex 2 to contribution 2/332

Launch of the Global Forum on Cyber Expertise

16 April 2015

Framework Document

Purpose

1. This Framework Document outlines the structure and operation of the Global Forum on Cyber Expertise (hereinafter: “GFCE”). It reflects the shared understanding of its members that the GFCE should be structured in a way that is voluntary, complementary, inclusive and resource driven. Activities are focused on identifying and addressing key geographic and thematic cyber issues.

2. Furthermore, it ensures the GFCE will remain a flexible, action-oriented and consultative forum that can evolve to meet contemporary challenges in cyberspace. It will complement the efforts already being undertaken in the field of cyber capacity and expertise building on a bilateral, multilateral, multi-party, regional and international level and avoid duplication and overlap. The GFCE seeks to develop a mutually reinforcing relationship with relevant multilateral institutions. This Framework Document should be seen in junction with The Hague Declaration on the GFCE, which outlines the objectives and values upon which the GFCE is based.

Members

3. Participation in the GFCE is voluntary. The GFCE is an informal forum, with no authority to take legally binding decisions. Neither this Framework Document nor participation in the GFCE more generally imposes any legal obligations on members.

4. The GFCE is founded by an initial group of countries, companies and intergovernmental organisations that are willing to actively contribute to the GFCE.

5. The GFCE aims to be a platform for the development of initiatives that could benefit parties beyond the GFCE membership. The GFCE is open to new members, provided they subscribe to The Hague Declaration on the GFCE, accompanying the official launch of the Global Forum on Cyber Expertise. GFCE members will be consulted on requests for membership.

Structure and functions

6. The structure and operations of the GFCE are based on four components:

I. An inventory of current efforts undertaken in the field of cyber capacity and expertise building;

II. An umbrella framework for the promotion of new initiatives, as well as enhancing and expanding existing ones;

III. A platform for high level discussions;

IV. An Administrative Unit.

Inventory of current efforts of cyber capacity building

7. Through the GFCE an inventory of current efforts in the field of cyber capacity building will be made available and kept up to date. This overview will allow GFCE members to identify and fill gaps in existing bilateral, multilateral, multi-party, regional and international capacity building activities and coordinate their efforts and contribute to bridging the digital divide.

Umbrella framework for initiatives

8. GFCE-members take new concrete initiatives or enhance and expand existing ones to strengthen capacity in cyber, through sharing experiences and best practices or other in-kind assistance, funding for capacity building projects, or a combination thereof (hereinafter: “Initiatives”). The Initiatives focus on a specific cyber area where there is a need for assistance or sharing of expertise and taken under the umbrella of the GFCE by two or more GFCE members (hereinafter: “Initiators”). The Initiators formulate the needs and assistance that a particular Initiative will contain. In addition to government entities, intergovernmental organisations or companies offering their own expertise, civil society, think tanks, academia, and in some instances international organisations, that possess expertise in certain cyber areas, could also play a role in an Initiative when invited to do so by the initiators.

9. New Initiatives can have a geographic or thematic focus, or can have both. The preliminary focus areas identified for capacity and expertise building within the GFCE are:

– Cybersecurity;

– Cybercrime;

– Data protection;

– E-Governance.

10. The focus areas will be evaluated on a yearly basis and may be amended by consensus of the members of the GFCE.

11. The setting up of an Initiative within the GFCE will generally consist of the following four phases. These phases should be seen as guidelines.

Phase one: Set-up

12. The Initiators take the lead in setting up an Initiative. Of these Initiators, at least one party has knowledge and/or expertise in one of the above-mentioned cyber areas, while at least one other party has a specific need for building up capacity in that particular field. Civil society may contribute by making suggestions for new initiatives.

Phase two: Identification

13. These Initiators formulate the specific assistance that is needed in the Initiative, and the means and ways of conveying the assistance or sharing the experience (so-called terms of reference). The assistance can be in the form of financial donations and/or in-kind expertise, for example sending experts to give trainings, or by sharing reports, best practices and lessons learned. Formulating the needs can either be done by the Initiators bilaterally or in a multi-party and multi-stakeholder setting (i.e. a regional or thematic seminar). Civil society, the technical community, think tanks and academia can also be involved in the formulation of specific assistance at the discretion of the Initiators.

Phase three: Recruitment

14. The Initiators recruit participants for the Initiative amongst GFCE members. This gives other members of the GFCE the opportunity to either contribute to the Initiative (with financial means or with in-kind expertise) or to indicate that they need the same assistance in building capacity. The setting up and the coordination of the Initiative remains the responsibility of the original Initiators.

Phase four: Implementation

15. When a clear need for capacity building has been established and adequate (financial or in-kind) resources have been found, coordinated by the Initiators, the Initiative will start its implementation phase. It is at the discretion of the Initiators to involve civil society, think tanks and academia, or use expertise within regional organisations, as implementing partners within an Initiative. Non-GFCE members could benefit from the results of specific Initiatives taken by GFCE members by associating themselves with these initiatives.

16. The Initiators will disseminate the results, lessons learned and best practices of an Initiative amongst GFCE members upon its completion to maximize the effectiveness of other Initiatives.

Platform for high level discussion

17. An annual high level meeting amongst members of the GFCE to evaluate progress made will take place, preferably in the margins of future Global Conferences on Cyberspace. The dialogue will provide the opportunity to discuss and (re)formulate requirements as well as best practices on cyber capacity building in the focus areas. The development of best practices will promote a continuous policy discussion about ways and means to respond to emerging challenges in the cyber domain, while preserving each member’s -internal decision making processes on implementation of specific measures. Civil society, the technical community, think tanks and academia will also be encouraged to be involved in the discussion, contributing to the development of best practices and advising on the formulation of requirements.

Administrative unit

18. The Administrative Unit will, inter alia, provide the necessary administrative and logistical support to GFCE members. It will maintain an overview of ongoing Initiatives and circulate the results of Initiatives among the GFCE members. It will facilitate and manage the sharing of information by GFCE members and, as appropriate, other relevant stakeholders of their relevant national practices and programmes, documents, and information regarding Initiatives taken under the umbrella of the GFCE.

19. The Unit will support and assist with logistical planning for the annual high level policy meeting, preferably to be held in the margins of future Global Conferences on Cyberspace. It will, inter alia, assist in the production of an overview of results of the GFCE and its initiatives to present to the GFCE members.

20. The Netherlands will initially host and finance the Unit for a period of four years after the launch of the GFCE. Consistent with the informal format of the GFCE, there will be no assessed contributions from GFCE members to finance this Unit. The Unit is expected to include four persons and will seek to include, where possible, individuals from other GFCE members. 21. At the first annual high level policy meeting on cyber capacity and expertise building, preferably in the margins of the next Global Conference on Cyberspace, the structure and operation of the Unit will be assessed and reviewed. The most appropriate structure, operation, financing, and location of the Unit over the longer term will be seen in conjunction with the development of the GFCE and its long term requirements.

Annex 3: Cybersecurity activities being conducted by organizations, private sector, and civil society

Details about cybersecurity workshops that have been conducted in conjunction with the ITU-D Study Group 2 Question 3/2 meetings.

ITU Cybersecurity Workshop: Global Cybersecurity Challenges

Collaborating for effective enhancement of cybersecurity in developing countries

8 September 2015, 14:30-17:30, ITU Tower, Popov Room

http://www.itu.int/en/ITU-D/Study-Groups/2014-2018/Pages/side-events/2015/cybersecurity-workshop.aspx.

Agenda

14:30-14:40

Welcome remarks
Mr Brahima Sanou (BDT Director) and Mr Chaesub Lee (TSB Director)

14:40-15:40

Session 1 (Panel discussion)

Best practices for a multi-layered strategic approach to effective cybersecurity enhancement in developing countries

Data breaches are reported to be on the rise globally. Increasingly, with wearable technology, Internet of Things and embedded Information and Communication Technologies (ICTs) everywhere, cyber incidents will have greater effects in the physical world. It is no longer just about money and data – however important these are –, now it is also about lives. Cybersecurity is an essential component of human activity. Its high level of complexity requires action at different levels (both virtual and physical) and by different actors (governments, private sector, civil society, intergovernmental organizations, etc.).

• What are the key success factors to developing and implementing a national cybersecurity strategy?

• What are the best practices?

• What will be the future elements to be included in national cybersecurity strategies?

Presentations:

1) Japanese Government’s Cybersecurity Strategy

Mr Kunihiro Tsutsui

Ministry of Internal Affairs and Communications, Japan

2) Public-Private partnerships and Cyber Risk Management

Mr Stephen Farole

United States Department of Homeland Security, United States of America

Cyber Security: OCERT Prospective

Ms Aziza Al-Rashdi (Information Technology Authority, Sultanate of Oman)

Moderator:

Mr Mohamed M.K. Elhaj (Republic of the Sudan)

Panelists:

Mr Albert Kamga (Republic of Cameroon)

Ms Aziza Al-Rashdi (Sultanate of Oman)

Mr Jean-David Rodney (Republic of Haiti)

Mr Kunihiro Tsutsui (Japan)

Mr Stephen Farole (United States of America)

16:10-17:10

Session 2 (Panel discussion)

Challenges facing developing countries; international collaboration to promote cybersecurity initiatives

With the constant expansion of broadband to unconnected parts of the world, most of the growth in the adoption of ICTs is expected to come from developing countries in the years to come. Newly connected countries have the opportunity to leverage the potential of ICTs to generate wealth and boost their socio-economic development and to achieve this they need robust, reliable, and trustworthy systems that would create a solid foundation for their businesses to operate and evolve.

• What are the three key challenges faced by developing countries in achieving an effective level of cybersecurity?

• How can existing regional and international collaboration be enhanced to promote cybersecurity initiatives?

• Are there innovative vehicles of collaboration that can be considered?

Presentations;

1. Mobile security issues

Mr Christopher Boyer, AT&T Inc.

2. Challenges facing developing countries

Mr Damir Rajnovic, Forum for Incident Response and Security Teams (FIRST)

International collaboration to promote cybersecurity initiatives – Good practices in cybersecurity development based on findings of the Global Cybersecurity Index
Mr Tymoteusz Kurpeta, ABI Research

Moderator:

Mr Patrick Mwesigwa (Republic of Uganda)

Panelists:

Mr Arkadiy Kremer (ITU-T SG17)

Mr Christopher Boyer (AT&T Inc.)

Mr Damir Rajnovic (FIRST)

Mr Damnam Kanlanfei Bagolibe (Togolese Republic)

Mr Tymoteusz Kurpeta (ABI research)

17:10-17:20

Workshop wrap up

Ms Miho Naganuma (NEC Corporation)

17:20-17:30

Closing remarks

Mr Ahmad Sharafat (ITU-D SG2 Chairman) and Mr Arkadiy Kremer (ITU-T SG17 Chairman)

18:00-20:00

Welcome reception

Note:

– Workshop moderator: Ms Miho Naganuma (NEC Corporation)

– Interpretation in the six official UN languages is provided.

ITU Cybersecurity Workshop

Day 1: Monday, 18 April 2016, 14:30- 17:30

Day 2: Tuesday, 19 April 2016, 09:30-12:30

ITU Montbrillant building, Room H

http://www.itu.int/en/ITU-D/Study-Groups/2014-2018/Pages/side-events/2016/cybersecurity-workshop.aspx

Agenda

DAY 1: National Cyberdrills

Timing

Presentations

14:30-14:40

Welcoming remarks

by ITU/BDT official

14:40-15:50

Enhancing National Cyberdrills through experience sharing

A national cyberdrill enhances the communication and incident response capabilities of all participants at the national level, thus helping ensure an efficient and coordinated effort in mitigating cyber threats and responding to major cyber incidents. A national cyberdrill is typically structured around a fictitious yet realistic geo-political scenario as the background for a set of simulated actions by threat actor(s) to which the participants must respond in accordance with their roles and responsibilities in a coordinated and timely fashion. This panel will highlight recent experiences in conducting such national cyberdrills.

Presentations (10 minutes each):

1) General overview by Mr Luc Dandurand, Head of ICT Applications and Cybersecurity Division, ITU/BDT

2) Pan European Cyber Exercises by Dr Panagiotis Trimintzios, Programme Manager, European Union Agency for Network and Information Security (ENISA)

3) A detailed view into a real case by Mr Michael Bartsch, Cybersecurity Management Consulting & Training, Deutor

4) Korea’s National Cyberdrill Experience by Mr Jaesuk Yun, Senior Researcher, Korea Internet & Security Agency

5) Malaysia’s National Cyberdrill Experience by Dr Amirudin Bin Abdul Wahab, Chief Executive Officer, Cybersecurity Malaysia

6) Cyber Storm V Overview by Mr Tim McCabe, Deputy NCEPP, NCCIC, US Department of Homeland Security

7) Practice makes Perfect by Mr Erka Koivunen, Cybersecurity Advisor, F-Secure

15:50-16:10

Coffee break

16:10-17:10

Panel Discussion after presentations

Following the previous sharing of experiences, lessons learned for the efficient and effective planning and conduct of national cyberdrills will be discussed in the context of ITU/BDT’s activities to support Member States in conducting such exercises.

Moderator:

Mr Luc Dandurand, Head of ICT Applications and Cybersecurity Division, ITU/BDT

Panelists: All speakers from the first half of the session

17:10-17:30

Workshop wrap up

by Mr Luc Dandurand, Head ICT Applications and Cybersecurity Division, ITU/BDT

End of Day 1 of Workshop

DAY 2: National Cybersecurity Strategies

Timing

Presentations

09:30-10:40

Session 1: The key ingredients for preparing a comprehensive National Cybersecurity Strategy

Some nations have vested responsibility for cyber security in existing or new agencies and have established national Computer Emergency Response Teams (CERTs). Some nations have begun rolling-out cyber-security awareness campaigns and developed action plans on Critical infrastructure protection

Whilst these are vital tactical actions towards improving national cybersecurity, to manage risks associated with the digital assets of a nation, a strategy is needed to combine all efforts into a coherent, comprehensive and sustainable nation-wide approach. In this session, panellists will share their expertise on how to develop a National Cybersecurity Strategy

Presentations (10 minutes each):

1) NCS cybersecurity partnership by Mr Luc Dandurand, Head of ICT Applications and Cybersecurity Division, ITU/BDT

2) ENISA’s work on strategies by Ms Dimitra Liveri, European Union Agency for Network and Information Security (ENISA)

3) Trust frameworks by Dr Bilel Jamoussi, Chief, Study Groups Department, ITU/TSB

4) How Switzerland deals with cyber threats by Dr. Stefanie Frey, MELANI, Switzerland

Moderator:

Mr Eliot Lear, Co-Rapporteur, ITU-D SG2 Q3/2

Panelists: All speakers from the session

11:10-12:10

Session 2: Effective implementation of a National Cybersecurity Strategy

A strategy is of use only when it is aptly translated into an actionable plan which is reviewed and adjusted in line with temporal and situational changes. This process aspect of strategy implementation must be done effectively so that a nation can close the cybersecurity gap identified for remediation in its national cybersecurity strategy. The possible ways to measure this effectiveness and assess progress need to be highlighted and understood.

Presentations (10 minutes each):

1) Estonia’s experience by Mr Raul Rikk, Head of National Cyber Security Domain, e-Governance Academy, Estonia

2) Paradigm Change as Part of a Cybersecurity Strategy by Mr Ammar Alkassar, CEO, Rohde & Schwarz Cybersecurity

3) How to create the National Cyber Security Strategy by Dr Martti Lehto, University of Jyväskylä, Finland

4) Research conducted in Cybersecurity Strategies by Mr Erik Silfversten, Analyst, Rand Europe

Moderator:

Mr Luc Dandurand, Head of ICT Applications and Cybersecurity Division, ITU/BDT

Panelists: All speakers from the session

12:10-12:20

Workshop wrap up

by Mr Luc Dandurand, Head of ICT Applications and Cybersecurity Division, ITU/BDT

12:20-12:30

Closing remarks

by Mr Ahmad Sharafat, ITU-D Study Group 2 Chairman

End of workshop

ITU Cybersecurity Workshop :

Cybersecurity and Risk Assessments in Practice

Thursday, 26 January 2017, 14:30- 17:30

https://www.itu.int/en/ITU-D/Study-Groups/2014-2018/Pages/side-events/2017/cybersecurity-workshop.aspx.

1. Introduction

In many ways, cybersecurity is about risk management. A key element of risk management is the assessment of risk. For the cyber domain, and despite much scientific and technical work in this area, assessing risks remains an art, particularly at the highest levels. This is due to the very complex nature of cyberspace, the difficulty in assessing vulnerabilities in very large “systems” composed of continually-evolving technology and human processes, the difficulty in assessing the value of digital assets and reputation, and the dynamic nature of cyber threats.

2. Objective of the workshop

This workshop will bring together world experts who will share their knowledge and experience on the practical assessment of cyber risks at the national level, in very large organizations, and in critical infrastructure sectors. The workshop will also discuss supply chain risks and role of standards for managing cyber risks in organizations.

3. Agenda

Time

Description

14:30-14:40

Opening by Workshop Chair, Ms. Miho Naganuma

Welcoming remarks by ITU/BDT official

14:40-15:45

Presentations by invited speakers (20 min each)

1) Top cyber security threats in 2017 and beyond

Dr. Bader Al Manthari (Information Technology Authority (ITA), Sultanate of Oman)

2) Methodologies and tools used in the private sector to assess cyber risks in large organizations

Mr. Ryan Spanier (Kudelski Security)

3) Cyber risk assessments in critical infrastructure sectors

Dr. Stefanie Frey (MELANI)

15:45-16:15

Break

16:15-17:00

Presentation by invited speakers

1) Supply Chain Risks

Mr. Andy Purdy (Huawei Technologies) and Ms. Kaja Ciglic (Microsoft)

2) Role of standards and ISO/IEC 27000 series update

Ms. Miho Naganuma (NEC Corporation)

17:00-17:20

Q&A from the audiences and discussion by moderator , Ms. Miho Naganuma

17:20-17:30

Workshop wrap- up by Workshop chair, Ms. Miho Naganuma

Organization: Internet Society (ISOC)

Document: SG2RGQ/162 + Annex

Title: Collaborative security

Summary: During the April 2016 Rapporteur Group meeting, Ms Christine Runnegar from the Internet Society made a presentation to the group on Collaborative security. This presentation provided an overview of the Internet Society as well as explained the Internet Society’s Collaborative Security Approach.

People are what ultimately hold the Internet together. The Internet’s development has been based on voluntary cooperation and collaboration. Cooperation and collaboration remain the essential factors for the Internet’s prosperity and potential.

This contribution contains a presentation introducing the Internet Society’s Collaborative Security approach, which is characterized by five key elements:

– Fostering confidence and protecting opportunities: The objective of security is to foster confidence in the Internet and to ensure the continued success of the Internet as a driver for economic and social innovation.

– Collective Responsibility: Internet participants share a responsibility towards the system as a whole.

– Fundamental Properties and Values: Security solutions should be compatible with fundamental human rights and preserve the fundamental properties of the Internet — the Internet Invariants.

– Evolution and Consensus: Effective security relies on agile evolutionary steps based on the expertise of a broad set of stakeholders.

– Think Globally, act Locally: It is through voluntary bottom-up self-organization that the most impactful solutions are likely to reached.

and discusses the principles in the context of botnets. It also contains some information regarding some of the Internet Society’s activities with the community to address spam.

Organization: London Action Plan (LAP)

Title: Introduction to the London Action Plan

Summary: During the April 2016 Rapporteur Group meeting, Mr Adam Stevens from the London Action Plan (www.londonactionplan.org) made a presentation to the group.

Organization: Nuix Technology UK (United Kingdom of Great Britain and Northern Ireland)

Title: A cybersecurity framework for all

Document: SG2RGQ/35

Summary: Across all fields and international boundaries cybercrime and cybersecurity requirements have never been greater or more complex. There is too much data, too much noise in the data, and no good way to pull together all of the different data sources to give analysts a contextual 360-degree view spanning digital, physical and human intelligence. A combination of technology and people provides us an unparalleled opportunity to address the emerging problem that is cybercrime. By harnessing advanced technology, scalability, and deep experience in data forensics and investigation we are in a unique position to change the way we tackle cybersecurity incidents.

This document puts in place a cybersecurity framework suitable for any ITU member state, which by design can dramatically reduce the gap between incident detection and remediation, and provide deep and rapid insights into the scope of a breach, the information that has been compromised and the path to resolution. Across all fields and international boundaries cybercrime and cybersecurity requirements have never been greater or more complex. There is too much data, too much noise in the data, and no good way to pull together all of the different data sources to give analysts a contextual 360-degree view spanning digital, physical and human intelligence. A combination of technology and people provides us an unparalleled opportunity to address the emerging problem that is cybercrime. By harnessing advanced technology, scalability, and deep experience in data forensics and investigation we are in a unique position to change the way we tackle cybersecurity incidents.

Introduction

Issues of building confidence and security in the use of ICT in the CIS region are in charge of the Information Security Commission of the Regional Commonwealth in the fields of Communications (RCC). Acknowledging that the relevance and ensuring technological independence and information security of the state are the strategic objective, the heads of the CIS states in October 2008 approved the Concept of cooperation of the States - participants of the CIS in the sphere of information security and a Comprehensive action plan for its implementation. Enactment of these documents promoted further forming and enhancement of the legal basis for an interstate cooperation in this sphere and the establishment of a secure information environment in the CIS.

Information Security Commission has prepared a draft Agreement on cooperation of states - participants of the CIS in the field of information security and the Regulation on the basic organization of CIS member states, which provide methodological, organizational and technical support for the work in the field of information security and the training of specialists in this field.

At the same time there was an inquiry of administrations, regulators and the CIS region’s business to determine common requirements for training of specialists in information security. They should take the form of requirements for appropriate educational standards and are embodied in these standards. According of such factors as historical community of the educational systems of the CIS countries and their current compliance with the terms of the Bologna agreement, allows a large extent unify and make regional standards of training, including such specialties as "Information Security Specialist of Information and Communication Systems" "The system administrator of information and communication systems"; "Specialist in Administration of network devices of information and communication systems"; "The system programmer"; "Specialist in design and graphic user interfaces"; "Technical support specialist of information and communication systems." The corresponding functional cards of labor activity types, the characteristics of the generalized labor functions, necessary knowledge and skills form a basis for training of specialists, in one way or another responsible for building confidence and security in the region.

Competence-based approach in educational activity and its interface to inquiries of employers

The modern needs of the labor market for specialists of a certain qualification are increasingly placed at the forefront in reforming the educational systems of countries in various regions. These requirements directly affect the modular structure and the flexibility of education in the 48 countries that joined the Bologna Declaration (1999). This process is active in the CIS region. In different countries the professional ICT community formulates its requests in the form of the direct order both to system of professional training, and subsystems of retraining and advanced training. This social order is a list of specific competencies that form the ability to apply knowledge, skills and personal qualities to be successful in a particular field. Competencies and learning outcomes are seen as the main target setting in the implementation of vocational training programs as the integrating beginnings of a graduate’s “model”.

The competence-based model of the graduate, on the one hand, covers the qualification linking his future activities with the subjects and objects of labor, on the other hand, reflects the interdisciplinary requirements to the result of education.

As a result of discussions in the professional community, the features of key professional competencies have been formulated, they:

– Allow to solve complex tasks (non-algorithmic);

– Are multifunctional (allow to solve different problems from one field);

– Transferable to different social fields (different activities);

– Require complex mental organization (the inclusion of intellectual and emotional qualities);

– Are complicated to implement and require a set of skills (skills of cooperation, understanding, reasoning, planning...); and,

– Should be implemented on different levels (from elementary to profound).

Advantages of competence-based approach are in the fact that at the same time:

– The goals and objectives of training programs conforming to requirements of employers are formulated;

– Flexibility of training programs increases;

– Efficiency and quality of professional training, level of professional competences increases;

– Standard, objective and independent conditions of a training quality evaluation are created;

– Level of interaction and the mutual responsibility of students, teachers and employers increases;

– Preparation for professional activity is carried out taking into account the real production conditions, due to which accelerated adaptation of professionals in the workplace; and,

– Formed organizational culture, including the field of information security.

Competences of experts in information security as basis for creation of the corresponding human potential

Focusing on the labor market needs in the field of training and retraining in the application of ICT security experts, the required competences can be divided into several blocks:

1) The general professional competence of providing including the ability to:

• Undertake the operation of infocommunication systems (ICS) with the use of methods and means to ensure their safety;

• Administer software and hardware protection of information in the ICS;

• Carry out the work on assessing the safety of ICS; and,

• Build distributed protected ICS.

2) Competence in the ICS operation using software methods and tools for their safety, providing including the ability to:

• Provide the information security (IS) in ICS with software and hardware;

• Provide the information security (IS) in the ICS using technical means; and,

• Provide information security (IS) in ICS with a complex application software, hardware and technical resources.

3) Competence in the field of management software and hardware protection of information in the ICS, including providing skill to:

• Configure software and hardware ICS protection;

• Perform maintenance regulations and current repair of software and hardware tools of information protection; and,

• Carry out the analysis of the violations allowed by users in ICS and to hinder with their repetition.

4) Competence in the field of the assessment ICS security:

• The monitoring of the efficiency and effectiveness of hardware-software means of information protection;

• The application of methods and techniques for ICS safety assessment under protection system control analysis;

• Carrying out experimental and research works in case of objects certification taking into account requirements to ensuring ICS protection;

• Instrumental monitoring of the ICS protection; and,

• Expertise in the investigation of security incidents.

5) Competences in the area of distributed protected ICS design:

• Development of requirements for distributed secure ICS and remedies for them, taking into account existing regulations and guidance documents;

• Design of the distributed protected ICS; and,

• Commissioning and maintenance of distributed ICS with the protection of information resources, organizational and technical measures for information security.

Each of these competencies is accompanied by a list of actions committed by labor and the necessary knowledge, abilities and skills.

Conclusion

Human capacity building to enhance confidence and security in the use of ICT is an urgent task, which requires the business partnership as the customer, the educational system as a contractor and the state as regulator of the entire process. Business priority in the formulation of requirements for specialists guarantees the success.

As a result of the project for the implementation of the Regional Initiative 5 in the CIS region has developed standard professional competencies, which are put at the forefront in the creation of educational programs in the field of training and retraining of information security specialists.

These competencies are complemented by a specific list of employment action, knowledge and skills that allows both carrying out examination of educational programs and creating new programs of training and retraining for building confidence and security in the use of ICT in the region. Dissemination of results in the region will be implemented within the framework of the ITU project “Centre of Excellence” in the CIS region in the area of “Cyber security”, which is a priority for the region and assigned to the main contractor of the Regional initiative 5 – Moscow Technical University of Communications and Informatics, a member of ITU-D.

The obtained results should be used to enhance the use of ICT awareness activities to build confidence and security in different countries, particularly developing countries, as they have a number of valuable qualities: relevance trends of infocommunications, compliance with modern educational trends and international standards of construction of educational process, scalability and reproducibility.

Annex 4: Contributions mapping

Reports

Web

Received

Source

Title

2/REP/35 (Rev.1)

2017-04-03

Rapporteurs for
Question 3/2

Report of the Rapporteur Group meeting on
Question 3/2 (Geneva, Thursday 6 April 2017, 14:30 - 17:30 hours)

RGQ/REP/22

2017-01-18

Rapporteurs for
Question 3/2

Report for the Rapporteur Group meeting on
Question 3/2 (Geneva, Friday, 27 January 2017, 09:00 -12:00 and 14:30-17:30 hours)

2/REP/24 (Rev.1)

2016-09-26

Rapporteurs for
Question 3/2

Report of the Rapporteur Group Meeting on
Question 3/2 (Geneva, Thursday 29 September 2016, 14:30 - 17:30 hours)

RGQ/REP/
12

2016-04-29

Rapporteurs for
Question 3/2

Report of the Rapporteur Group meeting on
Question 3/2 (Geneva, Friday, 29 April 2016, 09:30 -12:30 and 14:30 - 17:30 hours)

2/REP/13 (Rev.1)

2015-09-09

Rapporteurs for
Question 3/2

Report of the Rapporteur Group Meeting on
Question 3/2 (Geneva, Wednesday 9 September 2015, 09:30 - 12:30 hours)

RGQ/REP/3

2015-04-29

Rapporteurs for
Question 3/2

Report of the Rapporteur Group Meeting on
Question 3/2 (Geneva, Wednesday, 29 April 2015, 09:30 -12:30 and 14:30 - 17:30 hours)

2/REP/3 (Rev.1)

2014-09-24

Rapporteurs for
Question 3/2

Report of the Rapporteur Group Meeting on
Question 3/2 (Geneva, Wednesday 24 September 2014, 09:30 - 12:30 hours)

Question 3/2 contributions for Rapporteur Group and Study Group meetings

Web

Received

Source

Title

Mapping in final report

2/458

2017-03-21

Korea (Republic of)

Study topics for Question 3/2 for the next study period

2/422

2017-02-17

Togolese Republic

Fraudulent SIM box card practices

2/415
[OR]

2017-02-20

Rapporteurs for Q3/2

Final Report for Question 3/2

2/402

2017-01-31

République
démocratique du
Congo

Securing information and
communication networks: Good practice for developing a good culture of cybersecurity

RGQ/242

2017-01-06

NEC Corporation

Updated Section 6 (Report of Cybersecurity workshops) of Q3/2 report

RGQ/230

2016-12-08

BDT Focal Point for Question 3/2

An update on cybersecurity
initiatives for Member States

RGQ/221

2016-11-28

Senegal (Republic of)

Overview of the Digital Senegal 2025 (Sénégal Numérique 2025) Strategy validated and adopted in 2016

RGQ/213

[OR]

2016-11-25

Rapporteur for
Question 3/2

Draft Final Report for Question 3/2

RGQ/209

2016-11-24

Democratic Republic
of the Congo

Context of ICT infrastructure security

RGQ/207

2016-11-17

Democratic Republic
of the Congo

Security of communication infrastructures

RGQ/204

2016-11-14

Norway

Creating a metric for cyber
security culture

2/369

2016-09-13

Russian Federation

The experience of the CIS countries in the field of experts’ professional competences formation on data protection and information security in information and communication systems

Section 4 + Compendium Annex 2

2/364

2016-09-13

United Kingdom of Great Britain and Northern Ireland

Common criteria as a tool for giving assurance about the security characteristics of IT products

Section 8

2/362

2016-09-13

Korea (Republic of)

Proposed text for inclusion in Chapter 6 (Child Online Protection) of the Final Report

Section 5

2/361

2016-09-13

Korea (Republic of)

Korea’s Information Security Industry Promotion Plan

Currently
Section 4.2 or section 7

2/342

2016-08-24

Oman Telecommunications Regulatory Authority (TRA)

Oman Public Key Infrastructure (PKI)

Section 7 and Compendium Annex 2

2/334

2016-08-12

BDT Focal Point for
Question 3/2

An update on cybersecurity
initiatives for Member States

-

2/332

2016-08-12

United States of
America, Netherlands (Kingdom of the)

The Global Forum on Cyber Expertise (GFCE)

Section 7 and Compendium Annex 2

2/322

2016-08-05

Odessa National Academy of Telecommunications n.a. A.S. Popov

A database with data on
existing technical solutions for child online protection (http://www.Contentfiltering.info)

Section 5

2/317

2016-08-05

Côte d’Ivoire (Republic of)

Experience of Côte d’Ivoire in developing a national cybersecurity culture

Referenced in Section 4 and Compendium Annex 2

2/314

2016-08-05

Japan

ACTIVE(Advanced Cyber Threats response InitiatiVE) project in Japan

Section 3

2/295

[OR]

2016-08-12

Co-Rapporteurs for Question 3/2

Draft Report on Question 3/2

-

RGQ/145

2016-04-04

BDT Focal Point for Question 3/2

An update on cybersecurity initiatives for Member States

-

RGQ/144

2016-04-04

Russian Federation

Proposals from the Russian Federation for modification of GCI Questionnaire

Referenced in Annex 1 and will be mentioned in section 9

RGQ/143

2016-04-04

Russian Federation

Cyberwellness Profile of the Russian Federation for the Global Cybersecurity Index (GCI) Report 2016

Referenced in Annex 1 and will be mentioned in section 9

RGQ/142
+Ann.1

2016-04-04

Korea (Republic of)

Safe Use of the Internet for Children and Youth in Korea

Section 5

RGQ/141

2016-04-04

Korea (Republic of)

Fintech and security in Korea

Section 4 or section 7

RGQ/120

2016-03-16

Rapporteurs for
Question 3/2

Initial Draft Report on
Question 3/2

-

RGQ/104

2016-02-17

Gambia (Republic of the)

A case to adopt child online protection initiatives across LDCs

Section 5

2/234

2015-08-27

Korea (Republic of)

Korea’s K-ICT Security Development Strategy

Compendium Annex 2 + in section 4 or7

2/228

2015-08-21

United Kingdom of Great Britain and Northern Ireland

Cybersecurity in government and industry

Section 4 Compendium Annex 2

2/203

2015-07-31

China (People’s Republic of)

Proposal for a new work item on Framework of Detection, Tracking and Response of Mobile Botnets

Section 3

2/202
(Rev.1)

2015-07-29

Australia, Papua New Guinea, Samoa (Independent State of), United Kingdom of Great Britain and Northern Ireland, Vanuatu (Republic of)

Proposed questions on child online protection

Section 5

2/198

2015-07-26

United States of America

Partnering with the Private Sector to Manage Cyber Risk

Section 7 and Annex 2

2/175

2015-07-23

BDT Focal Point for
Question 3/2

An update on cybersecurity
initiatives for Member States

-

2/174

2015-07-23

China (People’s Republic of)

Best practices for developing a culture of cybersecurity: Promoting awareness of cybersecurity and enhancing its management

Section 4 and Annex 2

2/165

2015-07-22

BDT Focal Point for
Question 3/2

Global Cybersecurity Index -
Partnership Model

Mention in Section 1 or 2

2/164

2015-07-22

BDT Focal Point for
Question 3/2

Global Cybersecurity Index - Reference Model

Mention in Section 1 or 2

2/163
+Ann.1

2015-07-22

Oman Telecommunications Regulatory Authority (TRA)

Survey on measures taken to raise awareness on cybersecurity/revised GCI questionnaire

Mention in Section 1 or 2

2/157

2015-07-04

ITU-T Study Group 15

Liaison Statement from ITU-T SG15 to ITU-D SGs on ITU-T SG15 OTNT standardization work plan

2/156

2015-07-08

Odessa National Academy of Telecommunications n.a. A.S. Popov

Multimedia distance-learning course on the safe use of Internet resources

Section 4 and Annex 2

2/155
+Ann.1

2015-07-10

ABI Research (United States of America)

Cybersecurity Index of Indices

Mention in section 2 or Annex 1

2/154

2015-07-16

Gambia (Republic of the)

A case to adopt Child Online Protection initiatives across LDCs

Section 5

2/153

2015-07-08

Togolese Republic

Security of electronic transactions

Section 7 and Annex 2

RGQ/64

2015-04-13

Korea (Republic of)

Korea’s Internet of things security roadmap

Annex 2 Compendium

RGQ/59

2015-04-09

Japan

Proposal for the security workshop to be held in September 2015

-

RGQ/56

2015-03-31

Australia, Samoa (Independent State of), United Kingdom of Great Britain and Northern Ireland, Vanuatu (Republic of)

Proposed questions on child online protection

Section 5

RGQ/47

2015-03-12

Iran (Islamic Republic of)

National cybersecurity measures

Section 4 or 7 Compendium Annex 2

RGQ/46
+Ann.1

2015-03-12

Iran (Islamic Republic of)

National cybersecurity measures and measurement

Section 4 or 7 Compendium Annex 2

RGQ/44

2015-03-12

Oman (Sultanate of)

Survey on measures taken to raise the awareness on cybersecurity

Section 2

RGQ/42

2015-03-12

United States of America

Best practices for establishing a cybersecurity awareness campaign

Section 4 and Compendiun Annex 2

RGQ/40

2015-03-11

BDT Focal Point for
Question 3/2

An update on cybersecurity initiatives for Member States

-

RGQ/36
+Ann.1

2015-03-10

ABI Research (United States of America)

Global cybersecurity index

Annex 1

RGQ/35
(Rev.1)

2015-03-09

Nuix Technology UK, United Kingdom

A cybersecurity framework for all

Section 7

RGQ/32

2015-03-02

Cisco Systems

Perspectives on spam and cybersecurity

Section 3

RGQ/30

2015-02-26

Cameroon (Republic of)

Main cybersecurity activities in Cameroon

Section 4 Annex 2 compendium

RGQ/25

2015-02-18

Rapporteurs for
Question 3/2

Report Table of Contents

-

RGQ/7

2014-12-15

Rapporteurs for
Question 3/2

Draft work plan for Question 3/2

-

2/93
+Ann.1

2014-09-09

BDT Focal Point for
Question 3/2

Cybersecurity initiatives for Member States

-

2/90

2014-09-09

Japan

Sharing knowledge, information and best practice for developing a culture of cybersecurity

Section 4 Annex 2

2/89

2014-09-09

General Secretariat

WSIS Stocktaking: Success stories

-

2/87

2014-09-08

General Secretariat

Report on WSIS Stocktaking 2014

-

2/78

2014-09-04

Australia, United
Kingdom of Great Britain and Northern Ireland, Vanuatu (Republic of)

Support of the Resolution on child online protection

Section 5

2/77

2014-09-02

Symantec Corporation

Cyber-security’s role and best practices to ensure Smart Cities’ service continuity and resilience

Section 7

2/75

2014-09-01

Cisco Systems

Proposed work plan for the current study period

-

2/67

2014-08-29

China (People’s Republic of)

Proposal for a new work item on framework of detection, tracking and response of mobile botnets

Section 3 and Annex 2

2/65

2014-08-28

Korea (Republic of)

Personal information breaches and countermeasures of the Government of Republic of Korea

Section 7 Annex 2 compendium tor b)

2/64

2014-08-28

Korea (Republic of)

Experiences and international cooperation in preventing internet addiction in the Republic of Korea

Annex 2 and section 7

2/37

2014-08-06

AT&T Corp.

Spam best practices update

Section 3

2/30

2014-08-04

Telecommunication
Standardization Bureau

Draft technical Report on ICT infrastructure for cyber-security, data protection and resilience

2/17

2014-08-08

Nuix Technology UK
(United Kingdom)

The good shepherd model for cybersecurity – Minimizing the potential for, and damage suffered from, data breach

Section 3

Contributions for QAll for Rapporteur Group and Study Group meetings

Web

Received

Source

Title

Mapping

2/355

2016-09-07

Telecommunication Development Bureau

Update on innovation activities to ITU-D Study Groups

2/320

2016-08-05

General Secretariat

WSIS Stocktaking 2014-2016 Regional Reports of ICT Projects and Activities

2/319

2016-08-05

General Secretariat

WSIS Prizes 2016-2017

2/318

2016-08-05

General Secretariat

WSIS Stocktaking 2016-2017

2/312

2016-08-04

General Secretariat

WSIS Action Line Roadmaps C2, C5 and C6

2/311

2016-08-04

General Secretariat

ITU’s Contribution to the Implementation of the WSIS Outcomes 2016

2/309

2016-08-04

General Secretariat

WSIS Forum 2016 and SDG Matrix

2/308

2016-08-04

General Secretariat

WSIS Action Lines Supporting Implementation of the SDGs

2/307

2016-08-04

General Secretariat

WSIS Forum 2016: High Level Track Outcomes and Executive Brief

2/306

2016-08-04

General Secretariat

WSIS Forum 2016 Outcome Document - Forum Track

2/305

2016-08-04

General Secretariat

WSIS Forum 2017 - Open Consultation Process

2/274

2016-06-24

Chairman, ITU-D Study Group 2

Compendium of Draft Outlines for expected outputs to be produced by ITU-D Study Group 2 Questions (September 2016)

RGQ/124

2016-03-18

BDT Focal Point for
Question 8/1 and Resolution 9

Outcomes of RA-15,WRC-15 and CPM19-1 related to ITU-D

RGQ/107

2016-02-18

Kazakhstan (Republic of)

Contribution from Kazakhstan to Questions 1/1, 2/1, 3/1, 4/1, 5/1, 6/1, 7/1, 8/1 and 5/2

2/249

2015-09-24

Telecommunication Development Bureau

Final list of participants to the second meeting of ITU-D Study Group 2, Geneva, 7 - 11 September 2015

2/247

2015-08-28

Telecommunication Development Bureau

List of information documents

2/229

2015-08-25

Telecommunication Development Bureau

ITU-D Study Groups Innovation Update

2/213

2015-08-07

Telecommunication Development Bureau

1st ITU-D Academia Network Meeting

2/190

2015-07-24

General Secretariat

WSIS Forum 2015: High level policy statements, Outcome document, Reports on WSIS Stocktaking

2/150

2015-07-06

Uganda (Republic of)

Increasing women’s participation in ITU Study Groups’ work

2/149

2015-06-29

BDT Focal Point for
Question 1/1

ITU GSR15 discussion papers and best practice guidelines

2/100
Rev.1

2014-09-24

Chairman, ITU-D Study Group 2

Appointed Rapporteurs and Vice-Rapporteurs of ITU-D Study Group 2 Questions for the 2014-2018 period

2/99

2014-09-19

Intel Corporation

New Question for ITU-D Study Group 1 (2014-2018): Assistance to developing countries for the implementation of ICT programs in education

2/97

2014-09-11

Telecommunication Development Bureau

List of information documents

2/96

2014-09-15

Chairman, ITU-D Study Group 2

Establishment of working parties for ITU-D Study Group 2

2/95

2014-09-11

Telecommunication
Standardization Bureau

ITU Workshop on Digital financial services and financial inclusion, and First Meeting of Focus Group Digital Financial Services: 4-5 December 2014, ITU, Geneva

2/92

2014-09-09

General Secretariat

WSIS Action Lines Executive Summaries (Achievements, Challenges and Recommendations)

2/88

2014-09-09

General Secretariat

WSIS+10 High level event: High level policy statements, Forum track outcome document, reports

2/86

2014-09-08

General Secretariat

WSIS+10 High level event: Outcome documents

2/51

2014-08-23

Nepal (Republic of)

Need for developing detailed table of contents for each Question under both the ITU-D Study Groups at the beginning

2/5

Rev.1-2

2014-09-08

Telecommunication Development Bureau

Candidates for Rapporteurs and Vice-Rapporteurs of ITU-D Study Group 1 and 2 study Questions for the 2014-2018 period

2/4

2014-09-01

Telecommunication Development Bureau

List of WTDC Resolutions and ITU-D Recommendations relevant to the work of the ITU-D Study Groups

2/2
+Ann.1

2014-08-20

Telecommunication Development Bureau

Resolution 2 (Rev. Dubai, 2014): Establishment of study groups + Full text of all ITU-D Study Group 1 and 2 Questions in Annex 1

2/1

2014-08-20

Telecommunication Development Bureau

Resolution 1 (Rev. Dubai, 2014): Rules of procedure of the ITU Telecommunication Development Sector

Information Documents

Web

Received

Source

Title

Mapping

2/INF/4

2014-09-03

UR College of Science and Technology (Rwanda)

Intelligent agents as a useful tool for intrusion detection

2/INF/2

2014-07-09

Democratic Republic of the Congo

Création d’équipes de Centre de Cybersécurité (CIRT/Nationales) dans les pays en développement

Tor j) annex 3

2/INF/1

2014-07-09

Democratic Republic of the Congo

Sécurité numérique en République démocratique du Congo

Tor j) annex 3

Liaison Statements

Web

Received

Source

Title

2/365

2016-09-13

ITU-T Study Group 17

Liaison Statement from ITU-T SG17 to ITU-D SG2 Q3/2 on Collaboration on countering and combating spam

2/289

2016-08-01

ITU-T JCA-COP

Liaison statement from ITU-T JCA-COP to ITU-D SG2 Question 3/2 on Child Online Protection Initiatives

2/276
+Ann.1-11

2016-06-29

International Organization for Standardization (ISO)

Liaison Statement from ISO/IEC JTC 1/SC 27/WG 5 to ITU-D SG2 Q3/2 on Identity Management, Privacy Technology, and Biometrics

RGQ/130

2016-03-29

ITU-T Study Group 17

Liaison Statement from ITU-T SG17 to ITU-D SG2 on PKIs and RPKIs for developing countries (reply to Document 2/252)

RGQ/108

2016-02-24

Internet Society

Liaison Statement from Internet society to ITU-D SG2 Q3/2 on Establishing New Certification Authorities

RGQ/100

2016-01-12

RIPE NCC

Liaison Statement from RIPE NCC to ITU-D SG2 on Information on Resource Public Key Infrastructure (RPKI)

RGQ/99

2016-11-17

ISO

Liaison statement from ISO/IEC JTC 1/SC 27 to ITU-D SG2 Question 3/2 on National Cybersecurity Measurement System (NCMS)

RGQ/98

2015-12-12

Internet Corporation for Assigned Names and Number

Liaison Statement from SSAC to ITU-D Study Group 2, Question 3/2 on Establishing New Certification Authorities

RGQ/92

2015-12-21

ITU-T Study Group 11

Liaison Statement from ITU-T SG11 to ITU-D SG2 on the progress of standardization work to combat counterfeit ICT devices

RGQ/85

2015-09-03

GSM Association

Liaison statement from GSMA to ITU-D SG 2 on Framework to address mobile botnets

2/123

2015-04-20

ITU-T Study Group 17

Liaison Statement from ITU-T Study Group 17 to ITU-D Study Group 2 Question 3/2 on Request for information sharing on cybersecurity

2/122

2015-04-20

ITU-T Study Group 17

Liaison Statement from ITU-T Study Group 17 to ITU-D Study Group 2 Question 3/2 on Cooperation with ITU-D Q3/2

2/157

2015-07-04

ITU-T Study Group 15

Liaison Statement from ITU-T SG15 to ITU-D SGs on ITU-T SG15 OTNT standardization work plan

RGQ/17

2015-01-29

ITU-T Study Group 17

Liaison Statement from ITU-T Study Group 17 to ITU-D Study Group 2 Question 3/2 on the Development of a framework to address mobile botnets

RGQ/3
(Rev.1)

2014-11-18

ITU-T Focus Group on SSC

Liaison Statement from ITU-T Focus Group on Smart Sustainable Cities (FG-SSC) on Activities of the Focus Group on Smart Sustainable Cities

RGQ/1

2014-10-02

ITU-T Study Group 17

Liaison Statement from ITU-T Study Group 17 to ITU-D Study Group 2 Question 3/2 on proposed Correspondence Group Terms of Reference for joint working between ITU-T SG17 and ITU-D Q3/2

2/15

2014-02-06

ITU-T Study Group 17

Liaison Statement from ITU-T Study Group 17 to ITU-D Study Group 1 Question 22-1/1 on CYBEX

Liaison Statements for QAll

Web

Received

Source

Title

2/371

2016-09-13

Inter Sector Rapporteur Group

Liaison Statement from Inter Sector Rapporteur Group to ITU-D SG2 on requirements for the application of the UNCRPD for media services for all

2/288

2016-07-29

TSAG

Liaison Statement from TSAG to ITU-D Study Groups on ITU inter-sector coordination

2/281

2016-06-28

ITU-T Study Group 12

Liaison Statement from ITU-T SG12 to ITU-D SG1 and SG2 on revised definition of Quality of Experience (QoE) and new terms in Rec. P.10/G.100

2/280

2016-06-28

ITU-T Study Group 12

Liaison Statement from ITU-T SG12 to ITU-D SG1 and SG2 on ITU inter-Sector coordination (reply to TSAG LS17)

2/271

2016-04-28

ITU-T Study Group 5

Liaison Statement from ITU-T Study Group 5 to ITU-D SG2 on Information about work that is being carried out within work under study in ITU-T Q7/5

RGQ/117

2016-03-07

ITU-T Study Group 15

Liaison statement from ITU-T SG15 to ITU-D SG1 and 2 on the latest version of the Access Network Transport (ANT), Smart Grid and Home Network Transport (HNT) Standards Overviews and Work Plans

RGQ/111

2016-03-03

ITU-D Study Group 15

Liaison statement from ITU-T Study Group 15 to ITU-D SG 1 and 2 on ITU-T SG15 OTNT standardization work plan

RGQ/110

2016-03-03

ITU-T Study Group 15

Liaison statement from ITU-T Study Group 15 to ITU-D SG 1 and 2 on new technical classification and numbering of ITU-T L-Series Recommendations

RGQ/103

2016-02-08

TSAG

Liaison statement from TSAG to ITU-D study groups 1 and 2 on ITU inter-Sector coordination

RGQ/94

2015-11-18

ITU-R Study Group Department

Liaison statement from ITU-R Study Group Department to ITU-D SG 1 and 2 on Resolutions approved at the Radiocommunication Assembly (RA-15)

RGQ/82

2015-09-29

Asia-Pacific
Telecommunity (APT)

Liaison statement from the APT Standardization Program Forum (ASTAP) to ITU-D Study Group 1 and 2 on NGN activities

2/230

2015-08-24

ITU-T JCA-AHF

Liaison Statement from ITU-T JCA-AHF, Chairman to ITU-D SGs on Draft meeting report of Joint Coordination Activity on Accessibility and Human Factors (JCA-AHF) in Geneva on 17 June 2015

2/158

2015-07-10

ITU-T Study Group 15

Liaison Statement from ITU-T SG15 to ITU-D SGs on the latest versions of the Access Network Transport (ANT), Smart Grid and Home Network Transport (HNT) Standards Overviews and Work Plans

2/157

2015-07-04

ITU-T Study Group 15

Liaison Statement from ITU-T SG15 to ITU-D SGs on ITU-T SG15 OTNT standardization work plan

2/148

2015-07-12

TSAG

Liaison Statement from TSAG to ITU-D Study Groups on ITU inter-sector coordination

2/144

2015-05-19

ITU-T Focus Group on SSC

Liaison Statement from ITU-T FG-SSC to ITU-D SGs on Final deliverables of the Focus Group on Smart Sustainable Cities (FG-SSC) and proposal of a new Study Group

2/143

2015-05-12

ITU-T Study Group 13

Liaison Statement from ITU-T SG13 to ITU-D SGs on Development of the Roadmap on IMT

2/129

2015-04-30

ITU-T Study Group 11

Liaison Statement from ITU-T SG11 to ITU-D Study Groups on the progress on standardization work to combat Counterfeit ICT devices

2/128

2015-04-29

ITU-T Study Group 16

Liaison Statement from ITU-T SG16 to ITU-D SGs on ITU-D SG1 and SG2 Questions of interest to ITU-T Study Groups

2/127

2015-04-29

ITU-T Focus Group on Digital Financial Services

Liaison Statement from ITU-T Focus Group on Digital Financial Services (DFS) to ITU-D Study Groups on BDT’s work on ITU m-Powering Development

2/126

2015-04-29

ITU-T Focus Group on Digital Financial Services

Liaison Statement from ITU-T Focus Group on Digital Financial Services (DFS) to ITU-D Study Groups concerning its work

RGQ/34

2015-03-03

ITU-T Study Group 16

Liaison Statement from ITU-T SG16 to ITU-D SGs on ITU-D SG1 and SG2 Questions of interest to ITU-T Study Groups

RGQ/20

2015-02-10

ITU-R Study Groups - Working Party 5D

Liaison Statement from ITU Radiocommunication Study Groups WP5D to ITU-D Study Groups concerning the Handbook on "Global Trends in IMT"

RGQ/19

2015-02-10

ITU-R Study Groups - Working Party 5D

Liaison Statement from ITU Radiocommunication Study Groups WP5D to ITU-D Study Groups concerning the Handbook on “Global Trends in IMT’

RGQ/16

2015-01-23

ITU-T FG DFS

Liaison Statement from ITU-T Focus Group on Digital Financial Services (DFS) to ITU-D Study Groups on BDT’s work on ITU m-Powering Development

RGQ/15

2015-01-22

ITU-T FG DFS

Liaison Statement from ITU-T Focus Group on Digital Financial Services (DFS) to ITU-D Study Groups concerning its work

2/22

2014-05-23

ITU-T JCA-AHF

Liaison Statement from ITU-T Joint Coordination Activity on Accessibility and Human Factors (JCA-AHF) on Assistive Listening Devices (ALD) and the allocation of Mobile Phone Services in the 2.3-2.4 GHz band

2/19

2014-03-10

ITU-T Study Group 11

Liaison Statement from ITU-T Study Group 11 to ITU-D SG1 and SG2 on Request for status update from GSMA and ITU on proposed studies on the issue of mobile theft, grey market and counterfeit devices

2/18
(Rev.1)

2014-03-10

ITU-T Study Group 11

Liaison Statement from ITU-T Study Group 11 to ITU-D SG1 and SG2 on Technical report on
counterfeit equipment

2/16

2014-02-10

ITU-T Focus Group on Innovation

Liaison Statement from the ITU-T FG on Innovation to ITU-D SG1 and SG2 on New Standardization Activities for ITU-T study groups and ICT
Innovation Panel

2/9

2013-10-22

ITU-T Focus Group on Innovation

Liaison Statement from the ITU-T FG on Innovation to ITU-D SG1 and SG2 on inputs on ICT innovation panel

Annex 5: Survey questions

Raising awareness as a key element of cybersecurity regime

The first part contains a number of questions that attempt to identify the educational role played by the Member States to achieve cybersecurity, in particular whether these states have given a special attention to raising awareness or only dealt minimally with it. What were the means adopted to educate the targeted groups namely the persons with disabilities, children or elderly people? The questions addressed by the Questionnaire in its first part are highlighted as follows:

1

In your opinion, how important is raising awareness on cybersecurity as a basic step to
achieving security in cyberspace?

a. Not important

b. Somewhat important

c. Important

d. Very Important

2

Are public awareness campaigns in cybersecurity developed and implemented?

For organizations?

For civil society?

For adults (>18 yrs)?

For youth (12-17 yrs)?

For children (<12yrs)?

3

Which groups are targeted by cybersecurity awareness campaigns in your country?

a. Children

b. Youth

c. Students

d. Elderly people

e. Persons with disabilities

f. Private institutions

g. Government agencies

h. Others

4

Which one of the groups identified below is more targeted? Please arrange in order of 1 to
6 from the most highly targeted to the least targeted?

a. Children

b. Youth

c. Students

d. Elderly people

e. Persons with disabilities

f. Private institutions

g. Government agencies

h. Others

5

What are the cybersecurity issues that are addressed by existing awareness campaigns?
(Replies to more than one item possible)

a. Internet safety

b. Privacy

c. Fraud

d. Phishing

e. Malware

f. Child Online Protection

g. Others

6

What is the degree of importance of each issue? Please arrange in order of the most
important to the least important and give reasons for such order.

a. Internet safety

b. Privacy

c. Fraud

d. Phishing

e. Malware

f. Child Online Protection

g. Others

7

Are certain tools and technical measures related to providing cybersecurity, such as anti-virus
or anti-spam software, made available to persons with disabilities?

a. Yes b. No

8

Is the public encouraged to use the different tools and technical measures for cybersecurity,
such as anti-virus or anti-spam software?

a. Yes b. No

9

If the answer to the previous question is ‘yes’, are there different types of tools and
technical measures made available to the public and how is this achieved?

Child Online Protection as a key element of cybersecurity regime

This part intends to identify the national status of Child Online Protection (COP) in terms of raising awareness, legislations, the necessary tools to provide such protection and the competent authorities in charge of overseeing the implementation of such legislations and invoking the required tools to reach the desired goals. This part also examines whether there are government or civil agencies engaged in educating and providing the required tools and knowledge to those who are concerned with COP.

1

Do you have measures for protecting Children Online?

2

Is there legislation related to child online protection?

3

Is there an agency/entity responsible for Child Online Protection?

4

Is there an established public mechanism for reporting issues associated with children
online protection?

5

Are there any technical mechanisms and capabilities deployed to help protect children
online?

6

Has there been any activity by government or non-government institutions to provide
knowledge and support to stakeholders on how to protect children online?

7

Are there any child online protection education programs?

8

Are there any child online protection education programs for educators?

9

Are there any child online protection education programs for parents?

10

Are there any child online protection education programs for children?

11

Is there a national strategy for child online protection?

12

Are there public awareness campaigns on child online protection?

13

Are there public awareness campaigns on child online protection for children?

14

Are there public awareness campaigns on child online protection for adults?

Annex 6: Information on ACTIVE

This annex includes the basic operation flow for the ACTIVE project which is composed of four steps a) prevention of malware infection, b) Damage prevention of malware infection, c) Removal of malware, and d) Removal of malware.

Basic operation flow of ACTIVE (Advanced Cyber Threats response InitiatiVE) project

a) Prevention of malware infection; cooperation with ISPs

In recent years, the most frequent malware infection route is through malware-embedded sites. Some of these sites are counterfeits of famous websites, or tampered ones. These sites are difficult for Internet users to distinguish, and therefore users may not be aware that they have malware infection.

This is why ACTIVE was launched. In the ACTIVE project, decoy machines, or patrolling honeypots, access many different websites to confirm malware-embedded websites create a list of these sites. Referring to the list, ISPs send warning statement to users who agreed in advance that they may have warning statements when they are accessing malware-embedded websites. Also, ACTIVE tries to contact the administrators of these sites to request removal of malware from their sites.

Figure 9A outlines the flow for this action.

Figure 9A: Prevention of malware infection

(1) Discovery of malware-embedded websites: A decoy machine -the patrolling honeypot- is connected to the Internet. The machine accesses a number of websites every day, collecting information on any malware-embedded websites to be listed.

(2) Sharing of malware-embedded websites information with ISPs: Information on malware-embedded websites is provided to ISPs.

(3) Warning Internet users accessing malware-embedded websites: Having received prior consent, ISPs send warning statements to Internet users when they are accessing malware-embedded websites.

(4) Warning administrators of malware-embedded websites: ISPs send warning statements to the administrators of websites discovered to have embedded malware to request removal of malware from their sites.

b) Damage prevention of malware infection; cooperation with ISPs

ACTIVE leverages a list provided by our partners to prevent damage by blocking accesses to command and control (C&C) servers attempted by Internet users who agreed in advance that they may receive warning statements.

Figure 10A outlines the flow for this action.

Figure 10A: Damage prevention of malware infection

(1) Sharing of command and control (C&C) servers information: Information on C&C servers is provided to ISPs.

(2) Prevention of attacks against traffic between C&C servers: Having received prior consent, ISPs prevent potential damages on Internet users when they attempt to access C&C servers.

(3) Warning Internet users accessing C&C servers: The ISPs send warning to users who are recognized to have malware infection, with the URL of the instruction site.

(4) Malware removed: The Internet users access the instruction site and get information needed to remove malware. The instruction site provides useful information such as antivirus vendors’ site where antivirus softwares can be downloaded to remove malware.

c) Removal of malware; cooperation with ISPs

Malware-infected PCs are detected based on the malware infection scan data from a certain research institute. In general, any devices sending malware are infected with the malware. ACTIVE works with ISPs to identify and send a warning to such devices to take appropriate actions to remove the malware.

Figure 11A outlines the flow for this action.

Figure 11A: Removal of malware

(1) Detection of malware-infected PCs: Malware-infected PCs are detected, based on the malware infection scan data from a certain research institute.

(2) Identifying malware-infected users: Information on when and from where the detected malware was introduced is provided to ISPs to identify Internet users who are seemingly infected with the malware.

(3) Warning mail sent to users: The ISPs send warning mails to users who are recognized to have malware infection, with the URL of the instruction site.

(4) Malware removed: The Internet users access the instruction site and get information needed to remove malware. The instruction site provides useful information such as antivirus vendors’ site where antivirus software can be downloaded to remove malware.

______________

[1] 全球网络安全指数（GCI）是私营部门和国际组织之间合作伙伴关系的产物，它将网络安全问题提到国家议程的前列。ABI研究机构与国际电信联盟开展了一个合作项目，GCI对主权国家网络安全参与进行洞察。

[2] RFC 6480, https://www.rfc-editor.org/info/rfc6480。

[3] RFC7489, https://www.rfc-editor.org/info/rfc7489。

[4] RFC7960, https://www.rfc-editor.org/info/rfc7060。

[5] http://www.economist.com/news/science-and-technology/21594955-when-internet-things-misbehaves-spam-fridge。

[6] http://email.about.com/od/emailstatistics/f/What_is_the_Average_Size_of_an_Email_Message.htm。

[7] https://www.sandvine.com/downloads/general/global-internet-phenomena/2013/2h-2013-global-internet-
phenomena-report.pdf。

[8] 2016年WSIS论坛“垃圾信息：了解并缓解新兴互联网经济面临的挑战”：https://www.itu.int/net4/wsis/forum/2016/Agenda/Session/152。

[9] 2/369号文件，“独联体国家对专家进行的有关信息通信系统数据保护和信息安全的专业能力培训”，俄罗斯联邦。

[10] SG2RGQ/204号文件，“为网络安全文化建立衡量基准”，挪威。

[11] 2/228号文件，“政府和业界的网络安全”，大不列颠及北爱尔兰联合王国。

[12] 2/198号文件，“与私营部门合作管理网络风险”，美利坚合众国。

[13] 2/90号文件，“为培育网络安全文化分享知识、信息和最佳做法”，日本。

[14] https://www.telecom-isac.jp/。

[15] https://www.itu.int/md/D14-SG02-C-0202/en。

[16] 2/78号文件，“支持有关保护上网儿童的决议”，大不列颠及北爱尔兰联合王国、澳大利亚和瓦努阿图。

[17] SG2RGQ/56号文件，“有关保护上网儿童的拟议课题”，澳大利亚、巴布亚新几内亚、萨摩亚独立国、联合王国和瓦努阿图共和国。

[18] WTDC第67号决议“国际电联电信发展部门在保护上网儿童中的作用”，见https://www.itu.int/pub/D-TDC-WTDC-2014。

[19] 2/322号文件，“有关现有保护上网儿童技术解决方案数据的数据库”，敖德萨波波夫国立通讯科学院（乌克兰）。

[20] 2/156号文件，“有关安全使用互联网资源的多媒体远程学习课程”，敖德萨波波夫国立通讯科学院（乌克兰）。

[21] 2/362号文件，“拟议纳入最终报告第6章（保护上网儿童）的案文”，韩国。

[22] SG2RGQ/104号文件，“在最不发达国家通过保护上网儿童举措的案例”，冈比亚共和国。

[23] 2/289号文件，ITU-T JCA-COP。

[24] http://www.itu.int/en/ITU-D/Study-Groups/2014-2018/Pages/side-events/2015/cybersecurity-workshop.aspx。

[25] http://www.itu.int/en/ITU-D/Study-Groups/2014-2018/Pages/side-events/2016/cybersecurity-workshop.aspx。

[26] https://www.itu.int/en/ITU-D/Study-Groups/2014-2018/Pages/side-events/2017/cybersecurity-workshop.aspx。

[27] SG2RGQ/64号文件，“韩国的物联网安全路线图”，韩国。

[28] http://www.iapc.or.kr。

[29] SG2RGQ/153号文件，“电子交易的安全性”，多哥共和国。

[30] 有关此类方案的更多信息，请访问以下网址：资源认证（RPKI）网络研讨会：
https://www.ripe.net/support/training/learn-online/webinars/certification-webinar
BGP操作和安全培训课程：https://www.ripe.net/support/training/courses/bgp。

[31] 2/332号文件，“全球网络专业知识论坛（GFCE）”美利坚合众国和荷兰。

[32] SG2RGQ/141号文件，“Fintech与韩国的安全”，韩国。

[33] SG2/77号文件，“网络安全在确保智慧城市服务延续性和抵御能力中的作用和最佳做法”，赛门铁克公司。

[34] 2/364号文件，“作为担保IT产品安全特性工具的通用标准”大不列颠及北爱尔兰联合王国。

[35] SG2RGQ/46号文件，“国家网络安全措施和测量”，伊朗伊斯兰共和国。

[36] ITU-D第1研究组，最终报告，第22-1/1号课题，保证信息通信网络安全的最佳做法：培育网络安全文化的最佳做法，2014年，见https://www.itu.int/pub/D-STG-SG01.22.1-2014。

[37] ISO/IEC 27001，信息技术 – 安全技术 – 信息安全管理系统 – 要求，2013年。

[38] SG2RGQ/47号文件，国家网络安全措施，伊朗伊斯兰共和国。

[39] ISO/IEC 27004，信息技术 – 安全技术 – 信息安全管理 – 监测、测量、分析和评估，2016年。

[40] NIST特刊800-55修订版1，信息安全的性能测量指南，2008。

[41] https://www.itu.int/pub/T-TUT-SEC-2016。

[42] https://www.itu.int/ITU-T/recommendations/rec.aspx?rec=13072。

[43] http://www.itu.int/en/ITU-D/Cybersecurity/Pages/GCI-2017.aspx.

[44] A Computer Incident Response Team (CIRT), Computer Emergency Response Team (CERT), or Computer Security Incident Response Team (CSIRT) is a team of IT security experts whose main business is to respond to computer security incidents. It provides the necessary services to handle them and support their constituents to recover from breaches. Source: A step by step approach on how to set up a CSIRT – ENISA.

[45] Net Losses: Estimating the Global Cost of Cybercrime, McAfee, June 2014.

[46] http://www.norsis.no.

[47] Document SG2RGQ/204, “Creating a metric for cyber security culture”, Norway.

[48] Details of the scheme are available at: http://www.gov.uk/government/publications/cyber-essentials-scheme-overview.

[49] See ITU-D Question 22-1/1, Securing Information and Communication Networks: Best Practices for Developing a Culture of Cybersecurity (Final Report), Chapter 3 and Annex G, found at: http://www.itu.int/pub/D-STG-SG01.22.1-2014.

[50] See the Framework for Improving Critical Infrastructure Cybersecurity at http://www.nist.gov/cyberframework/.

[51] More information on The Cybersecurity Framework in Action: An Intel Use Case can be found at http://www.intel.com/content/www/us/en/government/cybersecurity-framework-in-action-use-case-brief.html.

[52] More information about CSRIC can be found at https://www.fcc.gov/encyclopedia/communications-security-reliability-and-interoperability-council-iv.

[53] Examples can be found @Cyber Twitter handle, the DHS Blog @ Homeland Security, and the DHS Facebook page.

[54] https://www.staysafeonline.org/.

[55] This document is updated annually. Figures are current as of December 2014.

[56] https://www.telecom-isac.jp/.

[57] http://www.soumu.go.jp/main_sosiki/joho_tsusin/eng/Releases/Telecommunications/130307_02.html.

[58] ISO/IEC 27004, Information Technology -- Security Techniques -- Information Security Management – Measurement, 2009.