Reducing Risk and Building Capacity

Transcription

1 Reducing Risk and Building Capacity The Cybersecurity Capacity Maturity Model (CMM) for Nations Prof Michael Goldsmith Global Cyber Security Capacity Centre (GCSCC) April 2017

2 Delivering Effective Cybersecurity Both Within The UK And Internationally The Global Cyber Security Capacity Centre (GCSCC) is a leading international centre for research on efficient and effective cybersecurity capacity-building, promoting an increase in the scale, pace, quality and impact of cybersecurity capacity-building initiatives across the world. It brings together international expertise across multiple sectors to contribute to Centre s outputs.

3 Cybersecurity Capacity Maturity Model for Nations (CMM)

4 5 Dimensions of Cybersecurity Maturity D 1 Cyber Policy and Strategy D 2 Cyber Culture and Society D 5 Organisations, Technologies and Standards Human, financial and technical resources D 4 Cyber Legislation and Regulation D 3 Cyber Education, Training and Skills

5 Structure of the CMM Dimension Factor Aspect Start-up stage Formative stage Established stage Strategic stage Dynamic stage Indicators Indicators Indicators Indicators Indicators

6 Stages of Maturity Formative Established Strategic Dynamic Start-up

7 Example: 1.1: National cybersecurity strategy 1.2: Incident response Identification Dimension 1 Cyber Policy and Strategy 1.3: Critical Infrastructure (CI) Protection 1.4: Crisis Management Organisation Risk Management and Response 1.5: Cyber Defence Consideration 1.6: Communications Redundancy

8 CMM Reviews

9 Stakeholder Clusters Criminal Justice Critical Infrastructure Defense/ Intelligence CERT and IT Academia/ Civil Society Legislators Government

10 Strategic Partners

11 Partners Ministry of Foreign Affairs of the Netherlands Ministry of Foreign Affairs of Norway UK Cabinet Office

12 17 Reviews of National Cybersecurity Capacity since 2015 Armenia Iceland (planned) Kosovo Kyrgyzstan Lithuania Montenegro UK Bhutan Fiji Indonesia Thailand Colombia Jamaica Madagascar Senegal Sierra Leone Uganda Zambia

13 Underpinned a Regional Study by the OAS Antigua and Barbuda Argentina The Bahamas Barbados Belize Bolivia Brazil Chile Colombia Costa Rica Dominica Dominican Republic Ecuador El Salvador Grenada Guatemala Guyana Haiti Honduras Jamaica Mexico Nicaragua Panama Paraguay Peru Saint Kitts and Nevis Saint Lucia Saint Vincent and the Grenadines Suriname Trinidad and Tobago Uruguay Venezuela

14 What Are The Benefits Of The CMM? Ownership of review lies with country Review of global cybersecurity capacity in 5 dimensions Self-assessment to point out needs and next steps Qualitative and quantitative benchmarking Review report with recommendations

15 Observations From CMM Reviews Generally, countries found the reviews informative and helpful in identifying previously under-considered capacity gaps Diverse stakeholder groups enables comprehensive picture in report development Review itself as capacity-building exercise Various lessons learned across all five dimensions of cybersecurity capacity

16 Lessons Learned (Selection) Policy and Strategy Culture and Society Education, Training and Skills Legislation and Regulation Organisations, Technologies and Standards Overall Misperception of the role of the CSIRT Lack of understanding of the relationship between trust/confidence and security Disconnect between educational offerings and industry needs Question whether new cybercrime/cybersecurity legislation is needed or adapting existing law is sufficient Standards adoption (particularly ISO standards) is mostly ad-hoc Data collection challenges

17 Way Ahead CMM revision Continued deployment & support Development of complementary models Reflect lessons learned Adapt to evolving cybersecurity landscape Regional centres International governance International partners Cyber Harm Model CMM for organisations

18 Incl Inventory of current intl and regional initiatives in cybersecurity capacity building partnership with the Global Forum on Cyber Expertise (GFCE) Visit:

19 National Cybersecurity Reference Guide A project undertaken in partnership with Commonwealth Secretariat Cybercrime Initiative, Commonwealth Telecommunication Organisation, ENISA, GCSP, ITU, Intellium, Microsoft, NATO CCDCOE, OECD, OAS, Potomac Institute, RAN D Europe, UNCTAD and World Bank. - will represent a single resource for any country to gain a clear understanding of the purpose and content of a national cybersecurity strategy and how to develop one - will also outline the existing relevant models and resources as well as offer an overview of the assistance available from various organizations.

20 Thank you! Global Cyber Security Capacity Centre Oxford Martin School, University of Oxford 34 Broad Street, Oxford OX1 3BD, UK Phone: +44(0)