Developing National Cybersecurity Strategies
By: Ensar Seker
Tags: Cybersecurity, Cyber Strategy, National Security

Developing National Cybersecurity Strategies

Security, which is among the primary needs of human in the hierarchy of needs defined by Maslow, will continue to maintain its place as long as human being exists. Today, people demand security not just for themselves but for their data as well since it too valuable.

A lot of data and information are generated and shared over the Internet, and a variety of social media platforms participate. In the dataistic world view, human experience is able to produce data that can be put together to pay tribute to data streams. For data specialists, data and algorithms are infused with superior tools to process data and find meaning.

Security, which is among the primary needs of human in the hierarchy of needs defined by Maslow, will continue to maintain its place as long as human being exists. Today, people demand security not just for themselves but for their data as well since it too valuable.

It is seen that the threats arising in cyberspace are difficult to eliminate with the ability of individual struggle, the society must fight against this threat with all its actors. Civil organizations, academia, public institutions, and organizations, national and international structures have to take part in the matter. Although many countries have established organizations or created legal regulations according to their internal dynamics in order to determine these studies, international criteria have now been set for their defense capabilities against threats.

International Telecommunications Union (ITU) Model

One of the classification studies is the Global Cyber ​​Security Index by International Telecommunications Union (ITU), which makes regional and global cybersecurity rankings by evaluating many issues such as legal regulations, strategies, standards, cybersecurity awareness studies, and training of countries. (GCI). The Global Cybersecurity Index (GCI) is a trusted reference that measures the commitment of countries to cybersecurity at a global level — to raise awareness of the importance and different dimensions of the issue. As cybersecurity has a broad field of application, cutting across many industries and various sectors, each country’s level of development or engagement is assessed along five pillars,

I. Legal Measures,

II. Technical Measures,

III. Organizational Measures,

IV. Capacity Building,

V. Cooperation

As the governance understanding, abilities, and needs of countries change, the processes related to cybersecurity strategies also change. ITU determines how a country will determine its strategy, how it will implement it, and the methods to be followed are determined under the stages.

Phase 0: On purpose or not big and critical data leaks within the scope of national security can lead to the emergence of a cybersecurity strategy. In such cases, national development plans and national security strategies can support the initiation of the cybersecurity process. Strategies consider cyberspace as an environment of great importance in matters such as the national economy and security. As a result, it may require national strategies to take measures against the threats that may arise in cyberspace and to provide security for its citizens. Regardless of the reason for the emergence of the national cybersecurity strategy, it is recommended that all actors be included in the strategy formulation in coordination.

Phase 1: It is the responsibility of the administration to lead the creation of the cybersecurity strategy. The administration can get the support of other actors, emphasizing the benefits of working together. While each country is free to take its own approach, it is recommended that governments cooperate with other actors in setting the agenda and in the work. The agreed strategy reaches a level for national and international joint work.

Phase 2: In this process, the National Cyber ​​Security Strategy is announced. The duties and responsibilities of the organizations and main actors assigned in national cybersecurity are stated.

Phase 3: The vision regarding cybersecurity activities to be implemented within the scope of the national cybersecurity strategy is presented.

Phase 4: In this process, organizations authorized for coordination by state authorities work with other stakeholders and critical infrastructure organizations to put into effective action plans on a sectoral basis.

Phase 5: The authorized cybersecurity organization follows the implementation of the national strategy. This organization evaluates the efficiency of the strategy.

ITU has defined the duties of the national cybersecurity organization.

· Determining national cybersecurity strategies,

· Identifying the primary national cybersecurity initiatives,

· Coordination of cybersecurity actions at the national level,

· Identifying stakeholders and public-private sector linkages to assess cybersecurity issues,

· Ensuring cooperation with local and international organizations gathering around the same purpose,

· Ensuring the implementation of international criteria for cybersecurity,

· Certification of services and actors providing services in information and communication infrastructures,

· Conducting, developing, and managing social identity system activities.

The European Union Agency for Cybersecurity (ENISA) Model

The main task of ENISA is to ensure the security of the information society in Europe, based on the interests of individuals, consumers, businesses, and public institutions.

ENISA recommends the National Cyber ​​Security Strategy (NCSS) life cycle in order to be able to control the execution of national cybersecurity strategies through stages and to monitor the continuous improvement.

Phase 1: Designing and Developing a Strategy

Strategy planning and development activities should be carried out under the authority and coordination of the National Cyber ​​Security Authority. In this phase following is steps need to be taken.

· Determining of vision, scope, goals, and priorities

· Determining and implementing of risk analysis approach

· Gathering existing policies, regulations, and capabilities

· Establishing an open management structure

· Identifying stakeholders and making agreements

· Establishing reliable information-sharing mechanisms

Phase 2: Implementation of the Strategy

In this phase following is steps need to be taken.

· Development of national cyber action plans

· Protection of critical information infrastructure

· Regulation of cybersecurity exercises

· Establishing fundamental security measures

· Establishing incident reporting mechanisms

· Increasing cybersecurity awareness

· Supporting education and training programs

· Establishing incident response teams

· Struggle against cybercrime

· Developing international cooperation

· Establishing a public-private partnership

· Establishing a security balance between privacy and data protection

· Improving cooperation between public institutions

· Supporting R&D studies on cybersecurity

· Encouraging the private sector to invest in security measures.

Phase 3: Evaluation of the Strategy

This phase identifies the elements required for evaluating and adjusting strategies. During the evaluation phase, it focuses on determining how much of the intended actions have been implemented by making a comparison according to the set goals. In this phase following is steps need to be taken.

· An independent auditor should be determined to evaluate the effectiveness of the strategy.

· The roles and responsibilities of the independent authority should be strengthened

· Stakeholders should be encouraged to participate in the evaluation process.

· Besides the strategy, individual responsibilities should also be evaluated.

· A quantitative and qualitative approach should be followed, with emphasis on impacts and consequences.

· Stakeholders’ views should be taken into account

· Consider the opinions of external and affected users.

· Each activity should be evaluated according to the action plan accepted at the beginning.

· A data collection scheme should be established to collect relevant data within the scope of evaluating the strategy and action plan.

· Lessons learned good practices and bad practices should be determined

· Prepare an analytical evaluation report explaining the results achieved and the expectations of the next evaluation.

· Benchmarking studies should be conducted to compare the strategies of different states.

Cited Sources

· https://www.itu.int/en/ITU-D/Cybersecurity/Pages/global-cybersecurity-index.aspx

· https://www.enisa.europa.eu/topics/national-cyber-security-strategies