Cyber Strategy Workshop for African Union Member States July 23-27, 2018 Addis Ababa, Ethiopia

8 Building Blocks of National Cyber Strategies

What is Big and Strong ENOUGH? Foundations must be big enough & strong enough to support the whole structure Size: ALL key stakeholders – Government, Private Sector, Civil Sector, Academia, Partner Governments, Others…? Strength: Depth of stakeholders’ commitment It may have many levels, but it must start with a solid foundation. A National Strategy for Cyber Capacity is like a Building… What is Big and Strong ENOUGH? The size and function of the building determines number and layout of floors Every foundation must reflect what it is designed to support It must be comprised of the right materials

8 Building Blocks - Summary Key Partnerships: Internal, Public-Private, International Cybersecurity Awareness & Culture: Leadership, Workforce Pipeline, Public Awareness Cyber Workforce Development: Education, Training, Pipeline & Progression Incident Response: Detection, Response, and Remediation Processes Resilience: Critical Systems Protection and Incident Response Capabilities Countering Cybercrime & Law: Legal Framework, Cyber- and Cyber-Enabled Crime Prevention, Response, and Prosecution Capabilities Policy, Governance, & Resourcing: Governance and Regulatory Mechanisms and Processes, Resource Sources, Adjudication, and Accountability Strategic Foundations: Risk Management Approach, National Goals, Stakeholder Involvement, Leadership Commitment Enabling Operational Governance Foundational

Strategic Foundations This area addresses a country’s fundamental preparedness for cyber capacity building to develop a national cyber strategy. It focuses on establishing: A Risk Management approach appropriate to the country’s threat landscape for identifying and prioritizing threats and opportunities National goals that reflect the country’s needs and aspirations with regard to cyberspace Leadership commitment toward attaining development goals Key stakeholder (governmental and public/industry/civic) involvement in shaping strategic approaches Is the Foundation Ready to Build on?

Policy, Governance & Resourcing This area is focused on the mechanisms through which a cyber strategy is articulated, implemented, and enforced. It addresses: Governance structures, such as decision-making bodies and processes Policy roles, responsibilities, and oversight The adoption of cybersecurity best practices and standards in key areas like critical industries Resource governance, including processes for prioritizing, allocating, distributing, and tracking resources associated with cyber development

Counter-Cyber Crime & Law Cybercrime (including data theft, identity theft, destruction, or fraud) and cyber-enabled crime (such as extortion or trafficking) can present a serious national problem, undermining trust in government, foreign investment, citizen safety and prosperity, economic security, and national security. This area addresses: The country’s legal framework, which allows it to define, identify and prosecute cyber- and cyber-enabled crimes Awareness, training and capacity of law enforcement in preventing and responding to cyber threats Capabilities required for cyber-crime prosecution, such as electronic evidence handling, cyber-forensics, and judicial training In addressing these capabilities, we draw on but are not limited to the provisions of the Budapest convention.

Cyber Incident Response Incident Response includes detecting, identifying and characterizing, and responding to a cyber incident affecting key systems or services. It includes: Situational awareness Information sharing—both internal and with partners Internal communications processes for coordination, escalation and prioritization Incident Response & Recovery Capabilities CERT & CSIRT capabilities and processes This Photo by Unknown Author is licensed under CC BY

Operational Resilience Resilience addresses how well a country is postured to protect against, withstand, and recover from a cyber incident affecting key systems or services. This area includes: Operational Best Practices, such as access management and routine patching Secure engineering and architectures for key systems, critical infrastructure, and essential digital services Provisions for critical systems protection— such as vulnerability assessments, physical diversity, or back-up The capacity of key stakeholders to assist in recovery, including through partnerships

Key Partnerships This category is focused on both internal and external partnerships that can support a nation’s cyber strategy. It addresses: Internal partnerships (for instance, between ministries or key offices and agencies) Public-private partnerships (such as between government and key industry or civic leadership) International partnerships to facilitate threat sharing, criminal prosecution, and training

Cybersecurity Workforce A nation’s cybersecurity workforce is essential to capacity building in nearly every area: CERTs, protecting critical systems and services, modernizing industry and finance, establishing a digital economy, developing standards and policy, supporting cyber law enforcement. This category considers: Cyber workforce development pipelines Cybersecurity training, evaluation and certification programs University curricula and incentives for students to pursue technical education Relationship with industry in skills development Salaries, retention, and career path progression

Cybersecurity Awareness & Culture Cybersecurity culture, or a “culture of security” is an essential component of a nation’s development in digital capabilities. Cybersecurity culture addresses the degree to which government and citizens understand the risks inherent in cyberspace, and how to manage those risks through good security practices. This category considers the nation’s capacity in: Basic science and technical education Public Cyber Safety awareness Cybersecurity training for non-technical workforce Effectiveness of government security awareness programs Public awareness of the government’s commitment to cybersecurity programs This Photo by Unknown Author is licensed under CC BY-SA

Questions?