Framework for National Action for Cyber Security and Critical Information Infrastructure Protection (CIIP)Bureau of Political-Military Affairs, Office of Plans, Policy and AnalysisWashington, DC March 16, 2006 Introduction: In resolution 57/239 on the Creation of a global culture of cybersecurity, the United Nations General Assembly, recognized "that, in a manner appropriate to their roles, government, business, other organizations and individual owners and users of information technologies must be aware of relevant cybersecurity risks and preventive measures and must assume responsibility for and take steps to enhance the security of these information technologies." This view was reaffirmed by the World Summit on the Information Society (WSIS) in the Tunis Agenda for the Information Society and in the Geneva Declaration of Principles and Plan of Action. The global interconnectivity of information networks and systems, and the necessity for this interconnectivity if we are to achieve the full promise of these new technologies, means that no single nation can successfully secure itself in isolation. Security is a problem common to all nations and each nation's security is limited by that of the weakest link in the global infrastructure. The nine simple elements for creating a Culture of Cybersecurity promulgated by the OECD in its Guidelines for the Security of Information Systems and Networks" translate into the need for national action by all countries and action by all participants in the information society. Developing this new Culture will require review and modification of national institutions, laws, procedures, cooperative arrangements and attitudes towards the information society. To facilitate this task, the following Framework for National Action (Framework) for Cyber Security and Critical Information Infrastructure Protection (CIIP) was prepared as a guide for national policy makers. It outlines the breadth, depth and interrelations of institutions and functions involved in cyber security. The Framework is composed of five overarching areas for attention by policy makers. It provides the policy objective for each area together with goals for achieving the policy, actions that must be taken to achieve the goals, and information on where to find supporting dialogue and training resources. This Framework is based on the experience of the US both in the development of the US domestic structures and procedures, which continue to evolve, and on our observations from participation with other governments bilaterally and through international organizations in addressing these issues. While the Framework calls for designation of national leadership to oversee the cyber security and CIIP, the plan also recognizes that each area of the plan will have its own leaders and persons in charge of various actions. The Framework thus serves as a template to allow all participants to see how their actions fit into the whole national effort. Because coordination across areas is essential, the plan has some duplication where different participants have complementary roles for achieving related goals, policies, and in turn, the national plan. It is also intended that the outline will be supplemented as new areas become evident and in particular that additional materials, especially training materials, will be added as they are identified. In considering action covered by the Framework, it is important to recall the concluding documents of both sessions of the World Summit on the Information Society and keep in mind that security must be implemented in a manner consistent with other objectives of the information society. In addition, measures adopted to implement a Culture of Security will form part of the economic environment of a nation and impact the ability of the private sector, the primary owner, operator and builder of information systems and networks, to continue the development of the domestic infrastructure. The Framework is outlined below. The outline is also reproduced on two power point slides to facilitate a visualization of the full scope of actions required. Framework for National Action for Cyber Security and Critical Information Infrastructure Protection Part 1: National Strategy and Administration (NS) POLICY: Protection of critical national information infrastructures and cyberspace are essential to national security and a nation's economic well-being. Critical national information infrastructures and cyberspace are interconnected across industry sectors and national borders. The protection of these infrastructures and cyberspace requires coordinated national action related to the prevention, preparation, response, and recovery from an incident on the part of government authorities at the national, state/provincial and local levels; the private sector; and citizens/users; and cooperation and coordination with international partners. 1 - Goals: NS 1.1 Create awareness at policy level of cyber/Critical Information Infrastructure Protection (CIIP) issues and need for national action and international cooperation. NS 1.2 Develop a national strategy to protect national critical information infrastructures and cyberspace from all-hazards (cyber and physical) incidents. NS 1.3 Join international efforts to coordinate activities related to the prevention, preparation, response, and recovery from incidents. 2 - ACTIONS: NS 2.1 Undertake policy level discussions with major players and key decision makers with regard to threats and vulnerabilities and the need for national action. NS 2.2 Identify lead institution for national effort; determine government construct and requirements for placement and stand-up of a computer security incident response team with national responsibility; and identify lead institutions for each aspect of the national strategy. NS 2.3 Identify stakeholders and points of contact within government ministries, state and local government, and the private sector. NS 2.4 Identify roles, responsibilities and cooperative arrangements for and among all participants. NS 2.5 Establish mechanisms for cooperation among government and private sector entities at the national level. NS 2.6 Identify international stakeholders and partners, and join international information efforts to address cyber security and CIIP issues, including information sharing and assistance efforts. NS 2.7 Assess and conduct periodic reassessments of the current state of cyber security and CIIP, and develop program priorities. NS 2.8 Identify training requirements and need for technical exchanges. 3 - Dialogue and Training Resources:(available from the U.S. or internationally) NS 3.1 Awareness raising (Supports NS 2.1, 2.2)
NS 3.3 Assessment and program development (NS 2.4, 2.5, 2.7, 2.8) NS 3.4 International assistance points of contact (NS 2.6) Part 2: Legal Foundation and Regulatory Development (LR) POLICY: The protection of critical national information infrastructures and cyberspace requires the updating criminal law, procedures and policy to address and respond to cybersecurity and cybercrime. Goals: LR 1.1 Enact and enforce a comprehensive set of laws relating to cybersecurity and cybercrime in accordance with the provisions of international legal instruments and the Council of Europe's Cyber Crime Convention (2001). Actions: LR 2.1 Assess the current legal authorities for adequacy. LR 2.2 Draft and adopt substantive, procedural and mutual assistance laws and policies to address computer-related crime. LR 2.3 Establish or identify national cybercrime units. LR 2.4 Develop cooperative relationships with other elements of the national cyber security infrastructure and the private sector. LR 2.5 Develop understanding of cyber crime issues in judiciary and legislative branches of government. LR 2.6 Participate in the 24X7 Cybercrime Point of Contact Network. 3 - Dialogue and Training Resources:(available from the U.S. or internationally) LR 3.1 Executive Branch (Supports LR 2.1, 2.6)
LR 3.2 Legislative Branch (Supports LR 2.2, 2.5)
LR 3.3 Judicial Branch (Supports LR 2.2, 2.5)
Part 3: Incident Response Watch and Warning (IR) POLICY: Maintain an organization to serve as a focal point for securing cyberspace and the protection of critical national information infrastructures, whose mission includes watch, warning, response and recovery efforts and the facilitation of interactions and collaboration between and among government entities at the national, state and local levels; the private sector; academia; and internationally. Goals: IR 1.1 Develop a national cyberspace security response system with effective organizations to prevent, predict, detect, respond to and recover from cyber incidents. IR 1.2 Develop national cyberspace threat and vulnerability reduction program in coordination with the intelligence and law enforcement communities. IR 1.3 Develop national cyberspace security awareness and training program. IR 1.4 Developprocedures and capabilities to secure government computer systems and networks. IR 1.5 Participate in international watch, warning and incident response information sharing mechanisms. Actions: IR 2.1 Identify or establish a national computer security incident response team (CSIRT) capability. (Supports IR 1.1, 1.2, 1.5) IR 2.3 Establish partnerships with the private sector for the prevention and response to cyber incidents. 3 - Dialogue and Training Resources:(available from the U.S. or internationally) IR 3.1 National Response Plan (Supports IR 2.1-2.6)
IR 3.2 National CSIRT (Supports IR 2.1-2.5)
IR 3.3 Cooperation and Information Sharing (Supports IR 2.1-2.5)
Part 4: Industry-Government Partnership (IG) POLICY: The protection of critical information infrastructure and cyberspace is a shared responsibility that requires a coordinated partnership between the government at all levels and the private sector, which owns and operates much of this information infrastructure. Goals: IG 1.1 Develop public-private partnerships for the protection of cyberspace and globally interconnected information infrastructures. IG 1.2 Develop cyber risk management program. Actions: IG 2.1 Include industry perspectives in the development and implementation of security policy and efforts. IG 2.2 Encourage development of industry and non-government (sector) groups to address security around common interests. IG 2.3 Encourage cooperation among sector groups of interdependent industries. IG 2.4 Establish cooperation arrangements between government and industry for watch, warning and incident response systems. (See also IR.) IG 2.5 Support industry awareness raising efforts. IG 2.6 Promote a comprehensive national awareness program to empower all participants - businesses, the general workforce, and the general population - to secure their own parts of cyberspace. IG 2.7 Develop a framework for public-private partnership to address cyber risk based on threats, vulnerabilities and consequences. 3 - Dialogue and Training Resources:(available from the U.S. or internationally) IG 3.1 Structures for Industry-Government Partnership (IG 2.1, 2.2 and 2.7) ISACs & Coordinating Councils
IG 3.2 Cyber security and CIIP information sharing (IG 2.3, 2.4 and 2.7)
Part 5: Culture of Security (CS) POLICY: Ever more powerful personal computers, converging technologies, the widespread use of the Internet; increasing interconnectivity and connections cross national borders require that all participants who develop, own, provide, manage, service and use information systems and networks be aware of and understand security issues and take action appropriate to their role to protect cybersecurity and cyber assets. Government must take a leadership role in bringing about this Culture of Security and supporting the efforts of other participants. 1-Goals: CS 1.1 As part of national strategy, undertake efforts to promote a national Culture of Security consistent with UNGA Resolutions 57/239, Creation of a global culture of cybersecurity, and 58/199, Creation of a global culture of cybersecurity and the protection of critical information infrastructures. 2-Actions: CS 2.1 Implement security plan for government owned and operated systems and networks. CS 2.2 Implement security awareness programs and initiatives for users of government systems and networks. CS 2.3 Develop Culture of Security outreach partnerships with business and industry. CS 2.4 Support outreach to civil society with special attention to the needs of children and individual users. CS 2.5 Enhance S&T and R&D activities. 3 - Dialogue and Training Resources:(available from the U.S. or internationally) CS 3.1 Government systems and networks (CS 2.1, 2.2)
CS 3.2 Business and private sector organizations (CS 2.3, 2.5)
CS 3.3 Individuals and civil society (CS 2.4)
Key U.S. Participants: Government: Department of State Department of Homeland Security Department of Justice Department of Commerce INDUSTRY: Information Technology Association of America (ITAA): About: The Information Technology Association of America (ITAA) provides global public policy, business networking, and national leadership to promote the continued rapid growth of the IT industry. ITAA consists of over 325 corporate members throughout the U.S., and a global network of 70 countries' IT associations. The Association plays the leading role in issues of IT industry concern including information security, taxes and finance policy, digital intellectual property protection, telecommunications competition, workforce and education, immigration, online privacy and consumer protection, government IT procurement, human resources and e-commerce policy. ITAA members range from the smallest IT start-ups to industry leaders in the Internet, software, IT services, digital content, systems integration, telecommunications, and enterprise solution fields. For more information visit www.itaa.org. 1401 Wilson Boulevard, Suite 1100, Arlington, VA 22209 The SANS Institute (www.sans.org): About: SANS is one of the largest sources for information security training and certification in the world. It also develops, maintains, and makes available at no cost, a collection of research documents about various aspects of information security, and operates the Internet's early warning system - Internet Storm Center. The SANS (SysAdmin, Audit, Network, Security) Institute was established in 1989 as a cooperative research and education organization. Many SANS resources, such as the weekly vulnerability digest (@RISK), the weekly news digest (NewsBites), the Internet's early warning system (Internet Storm Center), flash security alerts and more than 1,200 award-winning, original research papers are free to all who ask. |
 | |||
|
