LUXEMBOURGCYBER DEFENCESTRATEGYENGLISH VERSION

Responsible publisher: Ministry of Foreign an European Affairs –Directorate of Defence
6, rue de l’Ancien Athenée
L-1144 Luxembourg
Publication:

Luxembourg | February 2021

LUXEMBOURG CYBER DEFENCE STRATEGYSIP / Yves Kortum

MINISTERIAL FOREWORD

Luxembourg has enjoyed many years ofpeace, prosperity and progress as a result of
stability of the global world order. Digitalisationand new technologies have given Luxembourg
and the rest of the world great opportunity
for development and progress but have also
increased our exposure to factors undermining
our democratic values, our way of life and thestability of the international rules-based order.
We are facing new challenges throughconstant and pervasive activities below thethreshold of conflict that require a broader
view of security and defence policy,
encompassing global environmental change
and hybrid threats.
Therefore, it is with great pleasure that I
present the inaugural Cyber Defence Strategy
for Luxembourg. This 10-year long-term
strategy is nested within the National
Cybersecurity Strategy and aims to enhance
the resilience of Luxembourg Defence byprotecting its assets and capabilities frommalicious cyber activities. The strategy lays
the foundation for the development of cyberdefence capabilities that can be used in anational and international context. A periodic
review confers sufficient flexibility andadaptability to this long-term strategy in adomain that is in constant evolution.

Luxembourg
has
madeconcretecommitments
towards
strengthening
European defence, including cyber defence
within both the European Union (EU) and theNorth Atlantic Treaty Organization (NATO).
Luxembourg will honour these commitments
and has defined its contribution to common
defence in accordance with its own interestsand objectives. Emphasis will be placed on
upskilling our workforce, enhancing national
resilience in cyberspace, supporting private
sector capability and on strengthening our
engagement with Allies and partners. This will
ensure a sustainably resourced approach tointegrating cyber defence across Luxembourg
Defence and will set the conditions for
Luxembourg to develop expertise andcapabilities which can also be offered to Allies
and partners.
As Minister of Defence, I am determined tosee this strategy implemented in full. I will
work closely with colleagues acrossGovernment, the wider public sector andacademia to ensure we achieve this ambition.

François BAUSCH
Deputy Prime Minister and Ministerof Defence, Mobility and Public Works

3

LUXEMBOURG CYBER DEFENCE STRATEGYCONTENTSMINISTERIAL FOREWORD

3

1 INTRODUCTION

7

2 LUXEMBOURG CYBER DEFENCE LONG-TERM OBJECTIVE

93 STRATEGIC GOALS

11

3.1 Strategic Goal 1 – A skilled and motivated workforce
Capability 1: Knowledgeable and experienced defence
personnel

12

Capability 2: Increased positive public perception of
Luxembourg Cyber Defence, including as an
employer

12

Capability 3: Established and strengthened key cyber defence
bodies12

Capability 4: Enhanced national non-military/non-defence
cyber expertise12

3.2 Strategic Goal 2 – Strong national and international cyber cooperation

4

12

13

Capability 1: Mutual needs and capacities and enabling
factors identified

13

Capability 2: Continuous exchange of expertise and resources

13

Capability 3: Strengthened cooperation with national actors

13

LUXEMBOURG CYBER DEFENCE STRATEGY

3.3 Strategic Goal 3 – Cyber Defence integrated in all Luxembourg Defence activities,
assets and culture

14

Capability 1: Cybersecurity anchored in organisational culture

14

Capability 2: Governance, implementation and execution

14

3.4 Strategic Goal 4 – “CyberFutures” Landscape mapped, priorities identified andresearch programmes underway

15

Capability 1: Continuous mapping of future challenges andopportunities, defined research, development
and technology priorities (medium term)

15

Capability 2: Cyber defence assets and capabilities alignment(short term)

15

Capability 3: Cyber integrated into Luxembourg Defence R&D

15

4 MONITORING AND EVALUATION

17

4.1 Activities and Programmes

17

4.2 Strategic Goals and Capabilities

17

GLOSSARY AND DEFINITIONS

185LUXEMBOURG CYBER DEFENCE STRATEGY6

LUXEMBOURG CYBER DEFENCE STRATEGY

1

INTRODUCTION

The Luxembourg Defence Guidelines for2025 and beyond highlight that threats to
Luxembourg’s vital interests do not stop at thephysical border. Cyberspace is vital for
Luxembourg’s security and essential for theproper functioning and resilience of thecountry’s dynamic and knowledge-based
services economy that is open to the world.
Resilience encompasses the full range ofmeasures needed to ensure that institutions
and public services continue to function in all
circumstances and that populations andcritical infrastructure are safeguarded. This
broad concept of resilience naturally extends
towards the cyberspace domain.

Luxembourg Defence is responsible for
ensuring EU and NATO-defined cyber defence
commitments and policies are upheld. On anational level, the Directorate of Defence ispart of the Interministerial Coordination
Committee for Cyber Prevention andCybersecurity and thereby contributes to the
National Cybersecurity Strategy as well as
jointly ensuring that subsequent initiatives arecoherent and coordinated. This inaugural
Cyber Defence Strategy will allow Luxembourg
Defence to mature its capabilities, tocontribute further to national cybersecurity
initiatives and to strengthen resilience ofnational infrastructure.

The Defence Guidelines outline thecontinued development of cyber defence
expertise and capabilities in order to enhancecybersecurity of Luxembourg Defence andsecurity of military personnel, particularly on
deployments. A national strategy for cyberdefence will underpin the “defence”
component of the current and forthcoming
national cybersecurity strategies. The longterm objective of this strategy is for
Luxembourg to have one of NATO and EU’s
most cyber secure Defences, and to develop
expertise and capabilities which can be offered
to Allies and partners. The strategy focuses onfour strategic goals which will be reviewed
periodically in order to convey sufficient
flexibility and adaptability in a fast-changing
environment.

Cyber defence is not a new concept, with
NATO having already released its first Cyber
Defence Policy in 2008 and the EU’s publicationof their inaugural Cyber Defence Policy
Framework in 2014. Neither is cyber defence
new to Luxembourg where steps have alreadybeen taken to secure Luxembourg’s assets. To
continue asserting Luxembourg’s interests, tohave its voice heard and to enjoy the collective
security assured in particular by NATO,
this strategy incorporates Luxembourg’scommitments
towards
internationalorganisations, ensuring that Luxembourg
bears its share of responsibility in efforts andrisks inherent in collective and common
defence, and be recognised as a partner
making relevant contributions.

78

LUXEMBOURG CYBER DEFENCE STRATEGY2

LUXEMBOURG CYBER DEFENCE
LONG-TERM OBJECTIVE

By 2030, Luxembourg will have one of NATO/EU’s most cyber secure Defences, throughmaximisation of its cyber defence capabilities.
By developing cyber defence capabilities and contributing to national cyberspace
resilience, Luxembourg Defence aims to strengthen its reputation as a reliable partner forinternational organisations such as NATO and the EU, as well as a reference point for relevant
national actors in the cyberspace domain. Through investment in people, technology, as wellas in research and development, Luxembourg will develop expertise and capabilities which
can also be offered to Allies and partners.

9

LUXEMBOURG CYBER DEFENCE STRATEGY10LUXEMBOURG CYBER DEFENCE STRATEGY

3
Luxembourg’s cyber defence is young andneeds to mature. It must establish its place inthe Luxembourg Armed Forces andLuxembourgish cybersecurity landscape whileat the same time building up core cyberdefence capabilities. Hence, the Strategic
Goals (SG) to implement this strategy cover awide area of aspects:• SG1 A skilled and motivated workforce• SG2 Strong national and international
cyber cooperation

STRATEGIC GOALS
The aim is to develop the right capabilities,
govern and use them appropriately, embedcyber defence in Luxembourg Defence andestablish Luxembourg Cyber Defence as a
reputable partner both internationally anddomestically.
The achievement of the Strategic Goals
depends on the implementation of different
capabilities. The following sections define
these Strategic Goals and the capabilities
underlying them.

• SG3 Cyber defence integrated in all
Luxembourg Defence activities, assets
and culture• SG4 “CyberFutures” landscape mapped,priorities identified and research
programmes underway

11

LUXEMBOURG CYBER DEFENCE STRATEGY

3.1 STRATEGIC GOAL 1 –A skilled and motivated workforce

The first prerequisite for the long-term
objective is a cyber-literate, qualified andmotivated workforce. Existing Luxembourg
Defence workforce will be upskilled and new
cyber talent will be attracted by raising thevisibility of Luxembourg Cyber Defence.
Furthermore, Luxembourg Defence willcontribute to enhancing national cybercompetence in order to increase national
cyberspace resilience across private andpublic sectors.

CAPABILITY 1:
Knowledgeable and experienced
defence personnel
Luxembourg Defence will establish andpromote internal cybersecurity training andraise awareness of the importance ofintegrating cybersecurity in existing processes.
Luxembourg Defence will send personnel toparticipate in national and international cyber
exercises and courses. Cyber aspects will be
integrated into military exercises and taken
into account in operations.

CAPABILITY 2:
Increased positive public perception of
Luxembourg Cyber Defence, including
as an employer
Through presence at national cybersecurity
conferences and job fairs, promotion of
Luxembourg Cyber Defence initiatives via

12social media and public diplomacy andcooperation with the Luxembourg education
sector, public perception of Luxembourg
Defence as an employer will be improved.

CAPABILITY 3:
Established and strengthened key
cyber defence bodies
Cyber defence is a growing area andrequires capacity building of existing and new
structures. Human resources will be increased,
dedicated MilCERT capabilities will be put inplace and Luxembourg Defence is in favour ofthe creation of a national cyber reserve,
supporting its establishment.

CAPABILITY 4:
Enhanced national non-military/
non-defence cyber expertise
Cyber defence is an integral part of the
posture of Luxembourg Defence which will
provide training and exercises for relevant
personnel, e.g. using the Luxembourg Cyber
Range platform.

LUXEMBOURG CYBER DEFENCE STRATEGY

3.2 STRATEGIC GOAL 2 –Strong national and international
cyber cooperation

Given that cyberspace has no borders,
Luxembourg will work nationally andinternationally in order to uphold theinternational rules-based order, to fulfil
commitments made, inter alia, under the
auspices of NATO and EU.

CAPABILITY 1:
Mutual needs and capacities andenabling factors identified
Luxembourg Defence will undertake factfinding missions and commission regularbench marking, as well as a cataloguing of
Luxembourg cyber defence industry capability
in order to identify future needs. This work
will also help Luxembourgish companies
access the international cyber defence market.

international threat intelligence sharing toenhance situational awareness with andbetween NATO Allies and Partners, and EU
Member States.

CAPABILITY 3:
Strengthened cooperation withnational actors
Luxembourg Defence will continue toparticipate in the Interministerial Coordination
Committee for Cyber Prevention andCybersecurity, enhance collaboration withnational actors and take part in cybersecurityrelated national projects.

CAPABILITY 2:
Continuous exchange of expertise andresources
Luxembourg Defence will promote
Luxembourgish expertise and exchange ofbest practice by building national andinternational networks, becoming a memberof NATO’s Cooperative Cyber Defence Centreof Excellence (CCDCOE) and participation ofother relevant activities, such as in international
exercises. Luxembourg will also participate in13

LUXEMBOURG CYBER DEFENCE STRATEGY

3.3 STRATEGIC GOAL 3 –Cyber Defence integrated in all Luxembourg
Defence activities, assets and culture

Digitalisation of modern societies has given
great opportunity but also increased exposure
to risk and Defence is no exception. Cyber
awareness and literacy in Luxembourg Defence
activities, assets and culture will bemainstreamed. Resilience of Defence andLuxembourg Armed Forces in cyberspace inparticular will be increased, both domesticallyand in operations.

CAPABILITY 1:
Cybersecurity anchored inorganisational culture
Luxembourg Defence will implement
leading industry and international organisation
best practice and guidelines to mainstream
cybersecurity in organisational culture.
Luxembourg Defence will also introduce a
Cyber Defence visual identity.

14

CAPABILITY 2:
Governance, implementation andexecution
Through a governance, implementationand evaluation framework, Luxembourg
Defence will ensure mainstreaming ofcybersecurity best practice through theimplementationofaprocess-based
Information Security Management Systemframework.
Furthermore,
Luxembourg
Defence will implement projects such as the
Cyber Range, training exercises and contributeto cyberspace operations. Luxembourg Armed
Forces will continuously seek to improvecyberspace resilience of its personnel,
infrastructures, capabilities and systems.

LUXEMBOURG CYBER DEFENCE STRATEGY

3.4 STRATEGIC GOAL 4 –“Cyberfutures” Landscape mapped, priorities
identified and research programmes underway

Luxembourg Defence will map emerging
and future challenges in order to identify
threats and to make best use of technologicaldevelopments for improving cyber defence.
This should particularly benefit Luxembourg
Armed Forces in their operational role.

CAPABILITY 1:
Continuous mapping of futurechallenges and opportunities, defined
research, development and technology
priorities (medium term)
Regular horizon scanning will be undertaken
to identify challenges and opportunities,
which will likely influence Luxembourg’s
cybersecurity and cyber defence posture in
the years to come. Using the results of thisrecurring exercise, the “CyberFutures” most
relevant to Luxembourg Defence will beidentified.

innovation takes place in the private sector,
appropriate Luxembourg expertise andpotential will be used to assist in the required
development and procurement programmes.
Regular reviews will take place in order toensurethat
previously
identified“CyberFutures” are still relevant for
Luxembourg Defence.

CAPABILITY 3:
Cyber integrated into Luxembourg
Defence R&D
Relevant results of the cyber domain
horizon scanning will be prioritised to direct
nationally supported research.

CAPABILITY 2:
Cyber defence assets and capabilitiesalignment (short term)
Using these horizon scanning results(“CyberFutures”), Luxembourg Defence willalign its assets and capabilities to futurechallenges. Given that most cutting-edge

15

LUXEMBOURG CYBER DEFENCE STRATEGY16

LUXEMBOURG CYBER DEFENCE STRATEGY

4

MONITORING AND
EVALUATION

4.1 Activities and programmes

4.2 Strategic Goals and capabilities

The activities and programmes underpinning
the Strategic Goals and capabilities will be
subject to annual review against pre-agreed
Key Performance Indicators (KPIs), after which
there may be adjustment of KPIs, content orobjectives.

In light of review and adjustment ofunderlying activities and programmes,
Strategic Goals and capabilities will be
reviewed periodically.

17

LUXEMBOURG CYBER DEFENCE STRATEGYGLOSSARY AND DEFINITIONS

18

CIS

Communications and Information Systems

CyberFutures

Emerging and future challenges and opportunities in cyber defenceof potential relevance to Luxembourg Defence

EU

European Union

Luxembourg Defence

The Luxembourg Armed Forces and the Directorate of Defence of the
Ministry of Foreign and European Affairs

Luxembourg Cyber
Defence

The entities responsible for cyber defence in Luxembourg Armed Forces
and the Directorate of Defence of the Ministry of Foreign and European
Affairs

KPI

Key Performance Indicator

MilCERT

Military Computer Emergency Response Team (CERT)

NATO

North Atlantic Treaty Organization

R&D

Research and development

SG

Strategic Goal

LUXEMBOURG CYBER DEFENCE STRATEGY

Cyber defence1

The means to achieve and execute defensive measures to counter cyberthreats and mitigate their effects, and thus preserve and restore thesecurity of communication, information or other electronic systems, orthe information that is stored, processed or transmitted in these systems

Cybersecurity1

The application of security measures for the protection of communication,
information and other electronic systems, as well as the information thatis stored, processed or transmitted in these systems with respect
to confidentiality, integrity, availability, authentication and nonrepudiation.
According to the NATO publications “Technical and Implementation
Directive for CIS Security” (page 1-7) and “Allied Joint Doctrine for
Cyberspace Operations” (page 4), an equivalency of terms CIS(Communication and Information System) security and cybersecurity
has been established. Therefore, this strategy uses the term cybersecurity
which also encompasses CIS security.

Cyberspace resilience1

The overall technical and procedural ability of systems, organizations
and operations to withstand cyber incidents and, where harm is caused,
recover from them with no or acceptable impact on mission assurance
or continuity.

Cyber operation2

Actions in or through cyberspace intended to preserve friendly freedomof action in cyberspace and/or to create effects to achieve commanders’objectives.

1 NATO Definition according to AAP-06 (2019)2 NATO Definition according to AJP 3.20

19

VERSION FRANCAISE 

https://gd.lu/6Bn6xL