SEPTEMBER 2017

ISRAELNATIONALCYBERSECURITYSTRATEGY
IN BRIEF

STATE OF ISRAELPRIME MINISTER’S OFFICENATIONAL CYBER DIRECTORATEPrime Minister’s Office | National Cyber Directorate

Vision and Objective

5

Development of Israel’s national cyber security efforts

6

Concept of Operations

8

First Layer | Aggregate Cyber Robustness

10

Second Layer | Systemic Cyber Resilience:

11

Third Layer | National Cyber Defense:

12

A Complete Solution

13

The National Cyber Security Authority

14

Capacity Building

16

1. Research, development, and implementation

17

2. Establishing of a national scientific and technological cyber foundations 17International Cooperation

18

National Cyber Security Strategy In Brief | 3

Prime Minister’s Office | National Cyber Directorate

4 | National Cyber Security Strategy In Brief

Prime Minister’s Office | National Cyber Directorate

Vision and Objective
The government of Israel has set a vision for Israel to be a leading nationin harnessing cyberspace as an engine of economic growth, social welfareand national security.
Israel national cyber security strategy is, first and foremost, a meansof realizing the Israeli cyber vision by keeping cyberspace safe and by
confronting the various cyber threats, in accordance with the country’s
national interests. In addition, the strategy aims to ensure Israel’s continuingrole in the international arena, as a leader in technological innovation andas an active partner in the global processes of shaping cyberspace.
The national cyber security strategy is the conceptual and practicalfoundation for achieving these goals. Designed to efficiently structure thenational efforts and to ensure a stable, long-term solution, it establishes
new concepts and approaches, adapted to the unique features andchallenges arising from the use of cyberspace.

National Cyber Security Strategy In Brief | 5

Prime Minister’s Office | National Cyber Directorate

Development of Israel’s national cyber security efforts
The first milestone in the development of Israel’s national cybersecurity efforts was laid in 2002, when the Israeli government
authorized the National Information Security Authority (NISA) to instructand protect vital computerized systems of selected public and private
civil organizations.
The next and major milestone level was the establishment, in January
2012, of the Israel National Cyber Bureau (INCB) reporting directly tothe Prime Minister, following a governmental resolution from August
2011. INCB was tasked with: devising the State’s national cyber policy
and strategy, promoting national processes, developing national cybercapabilities and strengthening Israel’s leadership in the field.
On February 15, 2015, the government of Israel adopted two pioneeringresolutions, which reflected the major recommendations of the national
cyber security strategy, developed by the Bureau. These resolutions
included the establishment of the National Cyber Security Authority(NCSA), a dedicated government entity leading the operational cybersecurity efforts of the State of Israel.
Together the INCB and the NCSA constitute the INCD – Israel National
Cyber Directorate.

6 | National Cyber Security Strategy In Brief

Government
Resolution
Securing Critical
Infrastructures (NISA)

2002

Establishmentof the INCB

2012

2016

Operationalizationof the NCSA

Government Resolution
1. “Advancing national
regulation and governmental
leadership”
2. “Advancing The National
Preparedness”

2015

ISRAEL’S JOURNEY IN CYBER SECURITY

2011

Government
Resolution“Advancing theNational Capacity inCyberspace”

National Cyber Security
Authority (NCSA)(Operational efforts)

National Cyber Directorate (INCD)
National Cyber
Bureau (INCB)(Policy, capacity building)CONCEPT OFOPERATIONSPrime Minister’s Office | National Cyber Directorate

GeneralIsrael's cyber security strategy is based on a generic concept ofoperations for national cyber security – a conceptual framework for
all of the state's efforts and functions in the context of national cybersecurity. This framework includes both direct State actions to confront
cyber threats and indirect efforts aimed at encouraging and supporting
security activities in the private sector and collaborating with it.
The concept of operations defines three operational layers: Aggregate
Cyber Robustness, Systemic Cyber Resilience and National CyberDefense. The three-layer approach derives from the unique nature of thecyber threat and the central role of private organizations in achieving
national cyber security. The three layers differ from one another in theirgoals, in the role of the State and in the relations between the State andprivate organizations.

NationalCyber Defense
Systemic Cyber
Resilience

Aggregate CyberRobustness

National Cyber Security Strategy In Brief | 9

Prime Minister’s Office | National Cyber Directorate

First Layer | Aggregate Cyber Robustness
Cyber robustness is the ability of organizations and processes to continue
operating despite a routine of cyber threats by repelling and preventing
most of the attacks.
This is the very basic level of cyber security. The State of Israel has set a
goal to raise the overall level of cyber robustness as a means of preventing
high-level damage and reducing the cumulative risk.
Government Resolution 2443 of February 15, 2015 introduced nation-wide
efforts to enhance the national robustness through the promotion of security
efforts undertaken by organizations (best practice, guidance, regulations,incentives, etc.) and by regulating the cyber security market.
Additional efforts were made to set the bar high for government cybersecurity so as to "lead by example" and to implement technologicalsolutions and processes to raise overall robustness in the market.

REGULATINGTHE CYBERSECURITY MARKET(SUPPLY)
Cyber professionals•
Security productsand services•
Technologicalservices

10 | National Cyber Security Strategy In Brief

GUIDANCE FOR
THE PRIVATE SECTOR(DEMAND)
Specific guidance to criticalinfrastructures•
Mandatory standarts inessential sectors•
Promoting knowledge
and awareness throughthe private sector

Prime Minister’s Office | National Cyber Directorate

Second Layer | Systemic Cyber Resilience:
The second layer in the concept of operations is the systematic ability toconfront cyber-attacks before, during, and after incidents, prevent themfrom spreading and reduce their cumulative damage to the nation. While
the first layer is focused on reducing attacks a priori, regardless of any
specific event, this layer is event-driven by definition.
Systemic resilience can be achieved through state processes encouraging
information sharing, generating and disseminating valuable information,
and assisting organizations during cyber incidents.
This effort is led by the NCSA, with the national CERT at the forefront.
The national CERT works closely with the private sector, both directly andthrough sector-based cyber centers which operate within the CERT.
The CERT strives to engage in global and local cooperation while
supporting innovation and harnessing it for its goals.

Assistancetoorganizations
Generationof valuable
information

Sharing ofnational andsector-relevant
information

National Cyber Security Strategy In Brief | 11Prime Minister’s Office | National Cyber Directorate

Third Layer | National Cyber Defense:
A national-level campaign is required against severe threats bydetermined, resource-rich attackers who pose serious danger to thenation. National defense campaigns incorporate defensive effort, tocontain such attacks and their ramifications together with active efforts
to confront the sources of the threats.

Intelligence•
Prevention•
Enforcementand deterrence

Joint
investigations

CAMPAIGN AGAINSTATTACKERS

12 | National Cyber Security Strategy In Brief

NATIONAL DEFENSIVECAMPAIGNS
Defensive operations•
National incident
response•
Situation assessment

Prime Minister’s Office | National Cyber Directorate

A Complete Solution
The three-layer approach offers a holistic solution, taking into account thedifferences in the level of risk, the nature of the threat and the degree of itsclarity. The following graph illustrates the state's mode of action, according
to the three-layer approach, given the context of the State's action (thehorizontal axis) and the magnitude of the threat to the nation (the vertical axis).
For example, the resilience layer enables a first response to incidents that
do not present an immediate and severe threat, but may cause cumulative
damage over time, or might and severe a national defense response as theunderstanding of the threat evolves.
Level ofNational RiskActive Defense
Dedicated Guidance for
Critical Infrastructure

DefensiveOperations

Guidance inEssential Sectors

SectoralCentersNationalDefense
Law
Enforcement

Incident
Response

Aggregate
Robustness

SystemicResilience
Information
Sharing

Regardlessof an Event

Regarding aSpeciﬁc Threat

EarlyWarninng“Call Center”

Regarding aConcrete Event

Understanding theNature of an Event

National Cyber Security Strategy In Brief | 13

THE NATIONALCYBER SECURITYAUTHORITY

Prime Minister’s Office | National Cyber Directorate

Establishing a Central Cyber Security Authority
To lead the operational cyber security efforts, the government ofIsrael decided, in Government Resolution 2444 of February 15, 2015,
to establish a new government entity – the National Cyber Security
Authority (NCSA). The NCSA is an operational agency, with cybersecurity as its sole concern, but also civilian in its nature, cooperating
mainly and openly with the private-sector.
The NCSA serves as a hub of national knowledge, a primary cyber
regulator and an operational center for managing cyber incidents. TheNCSA also conducts integrated defensive campaigns with national
security and law enforcement agencies.

Functions of the NCSA at the Three Layers:
Aggregate
Robustness

Systemic Resilience

National Defense

Criticalinfrastructure
regulation

Nation-wide
information sharing

Managing defensive
campaigns within
the civilian sector

Securityguidance (mainlythrough sectoralregulators)

Assistance toorganizations underattack

Coordination
between agencies

National
knowledge hub

Identification andinvestigation ofattacks

National situationassessment

Cyber security
market regulation

Support for
sectoral SOCs

National Cyber Security Strategy In Brief | 15

CAPACITY
BUILDING

Prime Minister’s Office | National Cyber Directorate

For several decades, Israel has been at the global forefront of innovationand scientific-technological knowledge in the field of cyber security. Cyber
security is highly dependent on innovation to cope with the attacker's
dynamic approach. Israel's culture of innovation, its unique human capitaland its national security efforts create a perfect environment for cyberinnovation, thus answering this need both locally and globally.
In its Government Resolution 3611 of August 7, 2011, “Advancing
National Cyberspace Capabilities”, the State of Israel made it a priority
to strengthen Israel's scientific and technological cyber capabilities andinnovation processes. This task was assigned to the National Cyber
Bureau, as a crucial component of the national cyber security strategy, inorder to ensure Israel's long term cyber security capability. This includes
two main efforts:
1. Research, development, and implementation of national levelsecurity capabilities and technologies, including: secure and efficient
information sharing platforms; solutions supporting the state’s efforts
to expose, investigate and contain cyber attacks; robust cyberprocesses; and centralized security services.
2.		
Strengthening the national science and technology (S&T) base incyber: promoting industrial innovation, supporting academic research(including the establishment of six research centers in Israel’s leadinguniversities), enhancing the the nation’s human capital in the cyberfield and fostering an ecosystem for mutual enrichment. This includes
the unique CyberSpark project – a concentrated and powerful cybersecurity ecosystem consisting of Israeli startups, global companies,
academia and civilian and military cyber security centers – all within awalking distance of one another.

National Cyber Security Strategy In Brief | 17

Prime Minister’s Office | National Cyber DirectorateINTERNATIONAL COOPERATION
Cyberspace is a global sphere and cyber security is a global challenge.
The State of Israel views international cooperation as a critical element inestablishing cyberspace as a secure, free and global sphere of activity as well
as a complementary component in its own national cyber security efforts.
Israel is also engaged in efforts to assist partner nations in strengthening
their national cyber security, while harnessing Israel's cyber capacities.

Israel invites partners around the world to work together, to shareknowledge, to develop new solutions on the global level and to fulfill ourshared vision of a secure and prosperous cyberspace.

18 | National Cyber Security Strategy In Brief

STATE OF ISRAELPRIME MINISTER’S OFFICENATIONAL CYBER DIRECTORATE