This chapter will provide a short overview of world views of cyber security broken down by regions of the world. We live in an interconnected world of computer networks, all having the ability to positively and negatively affect those attached to them.
Therefore, the purpose of providing these global views is so the cyber security officer has an overview of what others are thinking and doing to protect parts of the global information infrastructure (GII) and how that may affect the cyber security officer’s responsibilities as they relate to his or her part of the GII, national information infrastructure (NII), and related networks.
As with any subject matter these days, a search of the Internet will find more information than you ever wanted to know on a topic. This topic is no different. Therefore, it is not the intent to provide everything you always wanted to know on what the United Nations and other entities are doing but, as the chapter title says, provide an “overview” of what others are thinking and doing vis-à-vis cyber security.
Remember that in today’s world of global corporations, the cyber security officer may have to follow the cyber security policies and procedures in the various nations where his or her corporation does business. So, as a cyber security officer, it is crucial that you understand such laws, rules, regulations, etc., and work with your corporation’s legal staff to be sure that any issues identified relative to these matters are addressed.
The world is a dangerous place to live; not because of the people who are evil, but because of the people who don’t do anything about it.1
Albert Einstein
Cyber security is one of the greatest issues of our times, and it will continue to grow in importance. It is our collective duty to ensure that ICTs are safe and secure so that the 7 billion people of this planet can reap the benefits of ICTs. Today, everything is dependent on ICTs and we are all vulnerable—cyber security is a global issue that can be solved only with global solutions. Cyber security is an area that affects each and every agency and program of the UN. As we push forward the UN agenda for peace and security, we must remember that cyber security is part of this. The UN system’s collective engagement in addressing cyber threats is critical. The ITU is leading the call for stakeholders to work together to set international policies and standards and to build an international framework for cyber security.
The participants welcomed the landmark consensus of the 2012–2013 Group of Governmental Experts on Developments in the Field of Information and Telecommunications in the Context of International Security, including its affirmation of the applicability of existing international law to cyberspace.
The two sides reiterated that no single entity, company, organisation or government should seek to control the Internet, and expressed their full support for multi-stakeholder governance structures of the Internet that are inclusive, transparent, accountable and technically sound….
… endeavor to enact and implement cyber crime and cyber security laws in accordance with their national conditions and by referring to relevant international instruments and recommendations/guidelines for the prevention, detection, reduction, and mitigation of attacks to which they are a party.
Without much media attention, the heads of state of the African Union (AU) agreed to a landmark convention this summer affecting many aspects of digital life.
In June, leaders in the AU, a group of 54 African governments launched in 2002, met at the 23rd African Union Summit and approved the African Union Convention on Cyber Security and Personal Data Protection.
The Convention covers a very wide range of online activities, including electronic commerce, data protection, and cybercrime, with a special focus on racism, xenophobia, child pornography, and national cybersecurity …
President Obama has identified cyber security as one of the most serious economic and national security challenges we face as a nation, but one that we as a government or as a country are not adequately prepared to counter. Shortly after taking office, the President therefore ordered a thorough review of federal efforts to defend the U.S. information and communications infrastructure and the development of a comprehensive approach to securing America’s digital infrastructure.
In May 2009, the President accepted the recommendations of the resulting Cyberspace Policy Review, including the selection of an Executive Branch Cybersecurity Coordinator, who will have regular access to the President. The Executive Branch was also directed to work closely with all key players in U.S. cyber security, including state and local governments and the private sector, to ensure an organized and unified response to future cyber incidents, strengthen public/private partnerships to find technology solutions that ensure U.S. security and prosperity, invest in the cutting-edge research and development necessary for the innovation and discovery to meet the digital challenges of our time, and begin a campaign to promote cyber security awareness and digital literacy from our boardrooms to our classrooms and begin to build the digital workforce of the twenty-first century. Finally, the President directed that these activities be conducted in a way that is consistent with ensuring the privacy rights and civil liberties guaranteed in the Constitution and cherished by all Americans.
The activities under way to implement the recommendations of the Cyberspace Policy Review build on the Comprehensive National Cybersecurity Initiative (CNCI) launched by President George W. Bush in National Security Presidential Directive 54/Homeland Security Presidential Directive 23 (NSPD-54/HSPD-23) in January 2008. President Obama determined that the CNCI and its associated activities should evolve to become key elements of a broader, updated national U.S. cyber security strategy. These CNCI initiatives will play a key role in supporting the achievement of many of the key recommendations of President Obama’s Cyberspace Policy Review.
The CNCI consists of a number of mutually reinforcing initiatives with the following major goals designed to help secure the United States in cyberspace:
In building the plans for the CNCI, it was quickly realized that these goals could not be achieved without also strengthening certain key strategic foundational capabilities within the government. Therefore, the CNCI includes funding within the federal law enforcement, intelligence, and defense communities to enhance such key functions as criminal investigation; intelligence collection, processing, and analysis; and information assurance critical to enabling national cyber security efforts.
The CNCI was developed with great care and attention to privacy and civil liberties concerns in close consultation with privacy experts across the government. Protecting civil liberties and privacy rights remains a fundamental objective in the implementation of the CNCI.
In accord with President Obama’s declared intent to make transparency a touchstone of his presidency, the Cyberspace Policy Review identified enhanced information sharing as a key component of effective cyber security. To improve public understanding of federal efforts, the Cybersecurity Coordinator has directed the release of the following summary description of the CNCI.
Initiative 1. Manage the Federal Enterprise Network as a single network enterprise with Trusted Internet Connections (TIC). The TIC initiative, headed by the Office of Management and Budget and the DHS, covers the consolidation of the federal government’s external access points (including those to the Internet). This consolidation will result in a common security solution, which includes facilitating the reduction of external access points, establishing baseline security capabilities, and validating agency adherence to those security capabilities. Agencies participate in the TIC initiative either as TIC access providers (a limited number of agencies that operate their own capabilities) or by contracting with commercial Managed Trusted IP Service providers through the GSA-managed Networx contract vehicle.
Initiative 2. Deploy an intrusion detection system of sensors across the federal enterprise. Intrusion detection systems using passive sensors form a vital part of U.S. government network defenses by identifying when unauthorized users attempt to gain access to those networks. The DHS is deploying, as part of its EINSTEIN 2 activities, signature-based sensors capable of inspecting Internet traffic entering federal systems for unauthorized accesses and malicious content. The EINSTEIN 2 capability enables analysis of network flow of information to identify potential malicious activity while conducting automatic full packet inspection of traffic entering or exiting U.S. government networks for malicious activity using signature-based intrusion detection technology. Associated with this investment in technology is a parallel investment in manpower with the expertise required to accomplish the DHS’s expanded network security mission. EINSTEIN 2 is capable of alerting US-CERT in real time to the presence of malicious or potentially harmful activity in federal network traffic and provides correlation and visualization of the derived data. Owing to the capabilities within EINSTEIN 2, US-CERT analysts have a greatly improved understanding of the network environment and an increased ability to address the weaknesses and vulnerabilities in federal network security. As a result, US-CERT has greater situational awareness and can more effectively develop and more readily share security-relevant information with network defenders across the U.S. government, as well as with security professionals in the private sector and the American public. The DHS’s Privacy Office has conducted and published a Privacy Impact Assessment for the EINSTEIN 2 program.
Initiative 3. Pursue deployment of intrusion prevention systems across the federal enterprise. This initiative represents the next evolution of protection for civilian departments and agencies of the federal Executive Branch. This approach, called EINSTEIN 3, will draw on commercial technology and specialized government technology to conduct real-time full packet inspection and threat-based decision-making on network traffic entering or leaving these Executive Branch networks. The goal of EINSTEIN 3 is to identify and characterize malicious network traffic to enhance cyber security analysis, situational awareness, and security response. It will have the ability to automatically detect and respond appropriately to cyber threats before harm is done, providing an intrusion prevention system supporting dynamic defense. EINSTEIN 3 will assist the DHS US-CERT in defending, protecting, and reducing vulnerabilities of federal Executive Branch networks and systems. The EINSTEIN 3 system will also support enhanced information sharing by US-CERT with federal departments and agencies by giving the DHS the ability to automate alerting of detected network intrusion attempts and, when deemed necessary by the DHS, to send alerts that do not contain the content of communications to the National Security Agency (NSA) so that DHS efforts may be supported by NSA exercising its lawfully authorized missions. This initiative makes substantial and long-term investments to increase national intelligence capabilities to discover critical information about foreign cyber threats and use this insight to inform EINSTEIN 3 systems in real time. The DHS will be able to adapt threat signatures determined by the NSA in the course of its foreign intelligence and Department of Defense information assurance missions for use in the EINSTEIN 3 system in support of the DHS’s federal system security mission. Information sharing on cyber intrusions will be conducted in accordance with the laws and oversight for activities related to homeland security, intelligence, and defense to protect the privacy and rights of U.S. citizens.
As of this writing, the DHS is conducting a exercise to pilot the EINSTEIN 3 capabilities described in this initiative based on technology developed by the NSA and to solidify processes for managing and protecting information gleaned from observed cyber intrusions against civilian Executive Branch systems. Government civil liberties and privacy officials are working closely with the DHS and US-CERT to build appropriate and necessary privacy protections into the design and operational deployment of EINSTEIN 3.
Initiative 4. Coordinate and redirect research and development (R&D) efforts. No single individual or organization is aware of all of the cyber-related R&D activities being funded by the government. This initiative is aimed at developing strategies and structures for coordinating all cyber R&D sponsored or conducted by the U.S. government, both classified and unclassified, and redirecting that R&D where needed. This initiative is critical to eliminate redundancies in federally funded cyber security research and to identify research gaps, prioritize R&D efforts, and ensure the taxpayers are getting full value for their money as we shape our strategic investments.
Initiative 5. Connect current cyber operations centers to enhance situational awareness. There is a pressing need to ensure that government information security offices and strategic operations centers share data regarding malicious activities against federal systems, consistent with privacy protections for personally identifiable and other protected information and as legally appropriate, to have a better understanding of the entire threat to government systems and to take maximum advantage of each organization’s unique capabilities to produce the best overall national cyber defense possible. This initiative provides the key means necessary to enable and support shared situational awareness and collaboration across six centers that are responsible for carrying out U.S. cyber activities. This effort focuses on key aspects necessary to enable practical mission bridging across the elements of U.S. cyber activities: foundational capabilities and investments, such as upgraded infrastructure, increased bandwidth, and integrated operational capabilities; enhanced collaboration, including common technology, tools, and procedures; and enhanced shared situational awareness through shared analytic and collaborative technologies.
The National Cybersecurity Center within the DHS will play a key role in securing U.S. government networks and systems under this initiative by coordinating and integrating information from the six centers to provide cross-domain situational awareness, analyzing and reporting on the state of U.S. networks and systems, and fostering interagency collaboration and coordination.
Initiative 6. Develop and implement a government-wide cyber counterintelligence (CI) plan. A government-wide cyber CI plan is necessary to coordinate activities across all federal agencies to detect, deter, and mitigate the foreign-sponsored cyber intelligence threat to U.S. and private sector information systems. To accomplish these goals, the plan establishes and expands cyber CI education and awareness programs and workforce development to integrate CI into all cyber operations and analysis, increase employee awareness of the cyber CI threat, and increase CI collaboration across the government. The Cyber CI Plan is aligned with the National Counterintelligence Strategy of the United States of America (2007) and supports the other programmatic elements of the CNCI.
Initiative 7. Increase the security of our classified networks. Classified networks house the federal government’s most sensitive information and enable crucial war-fighting, diplomatic, counterterrorism, law enforcement, intelligence, and homeland security operations. Successful penetration or disruption of these networks could cause exceptionally grave damage to our national security. We need to exercise due diligence in ensuring the integrity of these networks and the data they contain.
Initiative 8. Expand cyber education. While billions of dollars are being spent on new technologies to secure the U.S. government in cyberspace, it is the people with the right knowledge, skills, and abilities to implement those technologies who will determine success. However, there are not enough cyber security experts within the federal government or private sector to implement the CNCI, nor is there an adequately established federal cyber security career field. Existing cyber security training and personnel development programs, while good, are limited in focus and lack unity of effort. To effectively ensure our continued technical advantage and future cyber security, we must develop a technologically skilled and cyber-savvy workforce and an effective pipeline of future employees. It will take a national strategy, similar to the effort to upgrade science and mathematics education in the 1950s, to meet this challenge.
Initiative 9. Define and develop enduring “leap-ahead” technology, strategies, and programs. One goal of the CNCI is to develop technologies that provide increases in cyber security by orders of magnitude above current systems and that can be deployed within 5–10 years. This initiative seeks to develop strategies and programs to enhance the component of the government R&D portfolio that pursues high-risk/high-payoff solutions to critical cyber security problems. The federal government has begun to outline Grand Challenges for the research community to help solve these difficult problems that require “out-of-the-box” thinking. In dealing with the private sector, the government is identifying and communicating common needs that should drive mutual investment in key research areas.
Initiative 10. Define and develop enduring deterrence strategies and programs. Our nation’s senior policy makers must think through the long-range strategic options available to the United States in a world that depends on ensuring the use of cyberspace. As of this writing, the U.S. government has been implementing traditional approaches to the cyber security problem—and these measures have not achieved the level of security needed. This initiative is aimed at building an approach to cyber defense strategy that deters interference and attack in cyberspace by improving warning capabilities, articulating roles for the private sector and international partners, and developing appropriate responses for both state and nonstate actors.
Initiative 11. Develop a multipronged approach for global supply chain risk management. Globalization of the commercial information and communications technology marketplace provides increased opportunities for those intent on harming the United States by penetrating the supply chain to gain unauthorized access to data, alter data, or interrupt communications. Risks stemming from both the domestic and the globalized supply chain must be managed in a strategic and comprehensive way over the entire life cycle of products, systems, and services. Managing this risk will require a greater awareness of the threats, vulnerabilities, and consequences associated with acquisition decisions; the development and employment of tools and resources to technically and operationally mitigate risk across the life cycle of products (from design through retirement); the development of new acquisition policies and practices that reflect the complex global marketplace; and partnership with industry to develop and adopt supply chain and risk management standards and best practices. This initiative will enhance federal government skills, policies, and processes to provide departments and agencies with a robust tool set to better manage and mitigate supply chain risk at levels commensurate with the criticality of, and risks to, their systems and networks.
Initiative 12. Define the federal role in extending cyber security into critical infrastructure domains. The U.S. government depends on a variety of privately owned and operated critical infrastructures to carry out the public’s business. In turn, these critical infrastructures rely on the efficient operation of information systems and networks that are vulnerable to malicious cyber threats. This initiative builds on the existing and ongoing partnership between the federal government and the public and private sector owners and operators of critical infrastructure and key resources (CIKR). The DHS and its private sector partners have developed a plan of shared action with an aggressive series of milestones and activities. It includes both short-term and long-term recommendations, specifically incorporating and leveraging previous accomplishments and activities that are already under way. It addresses security and information assurance efforts across the cyber infrastructure to increase resiliency and operational capabilities throughout the CIKR sectors. It includes a focus on public–private sharing of information regarding cyber threats and incidents in both government and CIKR.
18.223.106.79