Developing and Enhancing Cyber Security Capabilities in the Region. Khaled Gamo Technology Advisor Ministry of communication and informatics

Transcription

1 Developing and Enhancing Cyber Security Capabilities in the Region Khaled Gamo Technology Advisor Ministry of communication and informatics 1

2 Content Cyber Security Strategy and Key Requirement Efforts To Enhance Cyber Security Capabilities Libya Cyber Security Initiative 4 Case Studies 5 Filling The Cyber Security Gap In The Region 2

3 Content Cyber Security Strategy and Key Requirement Efforts To Enhance Cyber Security Capabilities Libya Cyber Security Initiative 4 Case Studies 5 Filling The Cyber Security Gap In The Region 3

4 National Cyber Security Agenda Key Questions Who is steering the national cyber security strategy Framework, and programs? How are government networks and critical information assets and infrastructure protected? How are national cyber security capabilities being developed? How is national cyber security awareness fostered? How are national security/ military cyberspace operations and planned Conducted against cyber attacks? How are cyber law defined and enforced? How is Incident response coordinated among relevant stakeholder? How is national and international collaboration conducted? How are cybersecurity policies and regulations being developed? 4

5 National Cyber Security Strategic Domains Cyber security Governance Critical information infrastructure Protection Cyber Security Operations Cyber Skills & Capability Development National Cybersecurity awareness Cyber law / law enforcement National & International Collaboration Cyber Security Policies & Standards Who is steering the national cybersecurity strategy framework And programs. Accountability for all cybersecurity strategy Programs for identification and protection of critical information and infrastructure Systematic response to the incidents Continue to improving CERT capability General and advanced programs to build specialized workforce Capacity Planning & Management General public and sector-specific programs and activities to foster awareness Formalizing of illegality of cyber crime activities in legal framework Sustaining needed skills to identify and enforce regulations (e.g. forensic cap) Research and information sharing with local and foreign entities Alignment with International Standards. Policy & Standards Development. 5

6 Cyber Security Strategy Key Lessons Learned Cyber security Governance Critical information infrastructure Protection Lead Agency should be found at the highest government level to steward cybersecurity nation-wide Organization should designed based on a comprehensive operating model, roles and automated assessment tools Detailed and resilient architecture with testing and configurations guides for all controls and assets government and critical infrastructure entities need to build up their information assurance capabilities Cyber Security Operations Cyber Skills & Capability Development Cybersecurity awareness 24/7 SOC monitoring of all systems with dedicated CERT response team with expert level training and state of the art tools, National incident response frameworks should integrate into national/sector/entity level context Innovation of security expertise with research and development capabilities. Cyber security awareness is critical to fostering the knowledge Critical information infrastructure Protection Partnerships are formed to promote mainly info. Sharing and incident response coordination Dynamic real-time communications and information sharing 6 Cyber Security Policies & Standards Dynamic policy are regularly reviewed on a periodic basis and have automation of policy dissemination through out the environment

7 Content Cyber Security Strategy and Key Requirement Efforts To Enhance Cyber Security Capabilities Libya Cyber Security Initiative 4 Case Studies 5 Filling The Cyber Security Gap In The Region 7

8 Efforts To Enhance Cyber Security Capabilities ITU Membership endorsed the GCA as the ITU-wide strategy on international cooperation. IMPACT is a capacity building initiatives, joint consultations and more NATO Cooperative Cyber Defense Centre of Excellence is a research and training facility which tries to take a broad look on cyber defense, mixing and matching different areas of research under the cyber umbrella. Results of their work are in a form of research papers, training events and consultations FIRST is a premier organization and recognized global leader in incident response. Membership in FIRST enables incident response teams to more effectively respond to security incidents by providing access to best practices, tools, and trusted communication with member teams. Strengthen the regional cybersecurity posture and increase the number of cybersecurity initiatives and projects. Localize ITU-IMPACT s cybersecurity services to better fit the regional needs and requirements as well as language and cultural requirements. Build and strengthen regional collaboration in cybersecurity issues as well as increase regional information sharing 8

9 Content Cyber Security Strategy and Key Requirement Efforts To Enhance Cyber Security Capabilities Libya Cyber Security Initiative 4 Case Studies 5 Filling The Cyber Security Gap In The Region 9

10 Libya Cyber Security Strategy 2020 NISSA Strategy and Plan 2020 Stage 1 ( ) Stage 2 ( ) Stage 3 ( ) Establish and activate NISSA Create National Cyber security Strategy Preparing Cyber security Regulations and Legislations Create and Establish LY-CERT Bullied NISSA SOC Establish National PKI System Provide Cyber security Awareness program Building capability in cyber security Develop and participate in policy enforcement program Start To Establish Cyber security Training Center to provide training and advisory and Research service in the national Level Provide more Cyber security Awareness program More participating in cyber security in international level Provide more Service in cyber security Help to Develop and Enhance Education program to consider Cyber Security hosted International and Region cyber security conferences and work shop Enhance NISSA cyber security Center to provide service in the Region Establishment Phase Development and Enhancement phase Excellence phase 10

11 Libya Cyber Security Initiative Program Developing Cyber Security Laws & Legislation National Cybersecurity awareness National Cybersecurity awareness Activity Preperaing the draft of Cyber Law Work shop to discuss the Draft First cyber security conference Libyan Cybersecurity Days Child online Protection Study Status The draft has been completed Completed Completed Cyber Security Operations Building Libya-CERT. Project in progress Cyber Security Strategy Cyber Security Skills & Capability Development SANS Training National & International Collaboration Participate in regional conferences and activities COP Arab group, regional cyber security summit, cyber security Mission to USA 11

12 Content Cyber Security Strategy and Key Requirement Efforts To Enhance Cyber Security Capabilities Libya Cyber Security Initiative 4 Case Studies 5 Filling The Cyber Security Gap In The Region 12

13 Case Studies Government Capability Building Programs Research and Innovation Programs Higher Education Programs USA Multi-level training programs targeting IT roles and responsibilities Expand cyber education Cyber Security Challenge and competition programs Coordinate and redirect research and development (R&D) efforts. Cybersecurity and Communication Integration Center (NCCIC) Technical Trainings / Certifications ISACA, ISO/IEC, SANS, ECH. certifications Australia Government IT support staff training Functional training for IT security Cyber Security Challenge program Research Support for National Security Program Undergraduate Degree BSc in Information Security and Assurance Malaysia Provides competency and professional Training programs Develops curriculum in cyber security for colleges, polytechnics and universities in 2020 Target number of 17,026 professionals Collaboration between Cybersecurity Malaysia and Institute of Higher Learning (IHL) in various comprehensive cyber security modules Graduate Degree MSc in Information security UK Trainings covering incidental security aspects; security as primary responsibility Guidance for education programs UK Cyber Security Challenge program Network Security Innovation Platform The Global Cyber Security Capacity Centre Undergraduate Degree Cyber security policy; digital forensics; HW security, asymmetric security, internet and cloud security, etc. 13

14 Content Cyber Security Strategy and Key Requirement Efforts To Enhance Cyber Security Capabilities Libya Cyber Security Initiative 4 Case Studies 5 Filling The Cyber Security Gap In The Region 14

15 Where Do We Stand Cyber security capability is a key factor to enhancing GCI Legal Measures Cooperation Technical Measures Capacity Building Organizational Measures 15

16 Filling The Gap-Building The Competence Develops curriculum in cyber security for colleges and universities to build expertise Developing cyber security curriculum with Arabic content for students in primary and secondary school Provides competency and professional Training programs Developing and encouraging of E-learning, free online training or with affordable price Organize regular Regional cyber security conferences aiming to raise awareness and improve cyber security state 16

17 Online Academies And Universities is a joint venture by MIT and Harvard to offer their courses online to a worldwide audience, for free. The courses are not for credit, but the plan is to eventually award certificates of completion to students. The site launched in the fall of is a free online education platform that features over 200 courses from 33 universities worldwide The site was launched in April 2012 by Andrew Ng and Daphne Koller, who were Stanford University computer science professors. is an online learning platform where experts teach courses on a variety of subjects. Some courses are free, while others are feebased, with prices ranging from $5 to $250.. provides free online education with a wide range of courses. Launched in 2006 by the educator, Salman Khan, the site now contains over 3,400 lectures is a leading online learning company that helps anyone learn business, software, technology and creative skills to achieve personal and professional goals. A free online site offering lessons on how to code. Is a SecurityTube.net initiative aims at revolutionizing the InfoSec training space. People can access to a huge library of InfoSec training 17

18 Filling The Gap-Enhancing The Practice Expansion of national certifications in cyber security Regulatory and policy maker should emphasizing the cyber security standard Improve and increase the number of awareness programs Increase the number of National and Regional Cyber Security Exercises Attracting talented people through running cyber security competition programs national and regional Establish partnerships with the local and international academia to advance cyber security Establish partnerships with the private sector, involving it in building the nation-wide cyber security capability Cover the cyber security needs of the various industries (i.e. financial services, energy, utilities, healthcare, transport, aviation, etc.) 18