1. GLOBAL CYBERSECURITY INDEX
An initiative under ITU’s
Global Cybersecurity Agenda

2. Content
The importance of Cybersecurity
ITU Actions
GCI 2014
GCI version 2

3. The importance of Cybersecurity
From industrial age to information societies
Increasing dependence on the availability of ICTs
Number of Internet users growing constantly
(now 40% of world’s population)
Statistics and reports show that cyber-threats are on the rise
The likely annual cost to the global economy from Cybercrime is estimated at more than $455 billion (Source: McAfee Report on Economic Impact of Cybercrime, 2013).
Developing countries most at risk as they adopt broader use of ICTs
E.g. Africa leading in Mobile-broadband penetration: almost 20% in up from less than 2% in 2010 (Source: ITU ICT Statistics)
Need for building cybersecurity capacity
Protection is crucial for the socio-economic wellbeing of a country in the adoption of new technologies
Statistics continue to indicate that Cybersecurity threats and attacks are on the rise.
Source: Symantec 2015 Internet Security Threat Report

4. Level of Commitment of Countries…
This heat map indicates the level of commitment of countries to cybersecurity – there is work to be done to enhance global cybersecurity

5. Coordinated Response International Regional National
Need for a multi-level response to the cybersecurity challenges
International Cooperation frameworks and exchange of information
Harmonization of policies, legal frameworks and good practices at regional level
National strategies and policies
National response capabilities
Country level capacity building and training
International
Regional
In doing so, multi level coordinated response is useful.
National

6. Holistic Approach- Five areas of action
Technical/Procedural Measures
Organizational Structures
Legal Measures
Legal Measures Strategy
Government Legal Authority
Adequate and harmonized legal frameworks
National Cybersecurity Goals and Framework
Secure Government Infrastructure
Global Technical Collaboration
Government Coordination
National Focal Point
National CIRT
Public-Private Partnerships
International Cooperation
Capacity Building
Cybersecurity Skills and Training
Culture of Cybersecurity
Cybersecurity Innovation
Enhanced collaboration (multistakeholder, Bi/Multi lateral)
Inter-Agency Collaboration

7. ITU Actions

8. ITU and Cybersecurity 2003 – 2005
WSIS entrusted ITU as sole facilitator for WSIS Action Line C5
“Building Confidence and Security in the use of ICTs”
2007
ITU Secretary-General launched the Global Cybersecurity Agenda (GCA). A framework for international cooperation in cybersecurity
The WSIS happened in two phases: 2003 in Geneva and 2005 in Tunis. During the Tunis phase, WSIS goals and the implementation mechanisms for each action lines were elaborated.
ITU was identified as sole facilitator of the Action Line C5: Building confidence and security in the usage of ICTs, and as such was tasked by world leaders to coordinate Cybersecurity efforts at the global level.
In line with ITU’s role as sole facilitator for WSIS Action Line CS and in accordance with other decisions by ITU Membership, the Global Cybersecurity Agenda (GCA) was launched by the ITU Secretary-General in 2007 as the ITU framework for international multi-stakeholder cooperation in cybersecurity aimed at building synergies with current and future initiatives and partners towards a safer and more secure information society.
ITU Membership endorsed the GCA as the ITU-wide strategy on international cooperation.

9. UN-wide cooperation mechanisms
UN-wide Framework on Cybersecurity and Cybercrime (2013)
Developed by ITU and UNODC along with 33 UN Agencies.
Enables enhanced coordination among UN entities in their response to concerns of Member States regarding cybercrime and cybersecurity
UN System Internal Coordination Plan on Cybersecurity and Cybercrime (2014)
Developed building on the UN-wide Framework on Cybersecurity and Cybercrime upon request by the UN Secretary-General, Mr. Ban Ki-moon
Designed as a guide to improve the internal coordination activities of the UN system organizations on related matters
Building on the UN-wide Framework on Cybersecurity & Cybercrime, endorsed by the UN Chief Executives Board for Coordination (CEB) in November 2013 and following the request of the UN Secretary-General, a UN System Internal Coordination Plan on Cybersecurity and Cybercrime was developed by ITU, UNCTAD, UNDP, UNESCO and UNODC, and with the active contribution of the entire UN System. This plan, which is designed as a guide to the internal coordination activities of the UN system organizations looking into specific topics pertinent to Cybersecurity and Cybercrime, was endorsed at CEB’s Second Regular Session of 2014 on 20 November 2014.

10. National CIRTs are in the first line of cyber-response
Assessments conducted for 67 countries
Implementation completed for 11 countries
Implementation in progress for 4 countries
11 cyber drills conducted with participation of over 100 countries
ITU continues to deploy capabilities to build capacity at regional and international levels. ITU has undertaken technical assessments to evaluate the preparedness for the establishment of Computer Incident Response Teams (CIRTs) in over 60 countries, the latest ones being Angola, Bolivia, Comoros, Fiji, Vanuatu and is continuing with the necessary follow-up actions. National CIRT establishment is currently underway in Barbados, ​Burundi, Gambia and Lebanon​ after the successful completion of eleven countries namely  countries: Burkina Faso, Côte d'Ivoire, Cyprus,​ Ghana, Jamaica, ​Kenya​, Montenegro, Tanzania, Tri​​nidad​​ and Tobago, Uganda, Zambia​.
102 National CIRTs Worldwide
Need to fill the gaps

11. Enhancing Cybersecurity in Least Developed Countries project
We are only as secure as our weakest link
Aims at supporting the 49 Least Developed Countries in strengthening their cybersecurity capabilities.
How
Assessment for selected key government ministries &
subsequent solutions provision
Capacity building through training of trainers, workshops,..
Customised guidelines on legislation, regulation and technologies
End Result
protection of their national infrastructure, including the critical information infrastructure, thereby making the Internet safer and protecting Internet users
serve national priorities and maximize socio-economic benefits in line with the objectives of the World Summit on the Information Society (WSIS) and the Millennium Development Goals (MDGs).
The cybersecurity needs of the least developed countries are the focus of particular attention under ITU’s “Enhancing Cybersecurity in Least Developed Countries” project. This project focuses on assisting the LDCs to enhance their capabilities, capacity, readiness, skills and knowledge in the area of cybersecurity. Apart from human capacity building, the project is also geared towards providing the appropriate enabling technologies and related tools to assist LDCs in carrying out activities with regard to securing their cyberspace.
Implemented in 4 countries
Different stages of planning/implementation in 15 more 11

12. ITU Study Groups
A platform for information exchange between ITU Member States and Sector Members (industry, academia etc.)
ITU-D Study Group 2
Question 3/2: Securing information and Communication networks: Best practices for developing a culture of Cybersecurity
ITU-T Study Group 17 : Security
Standardisation work on cybersecurity

13. Economic Impact of Standardization
ITU-T Study Group 17 – Security
Over 300 standards (ITU-T Recommendations) relevant to security
Rec. ITU-T X.509 for electronic authentication over public networks; a cornerstone in designing applications relating to PKI; is used in a wide range of applications; including providing digital signatures that enable e-commerce transactions to be conducted with the same confidence as in a traditional system
Key areas of current work:
Cybersecurity
Child Online Protection
Security architectures and frameworks
Countering spam
Identity management
Security of applications and services for the Internet of Things, web services, social networks, cloud computing and Big Data
Economic Impact of Standardization
Adds 0.3% - 1% to the GDP
Source: European Commission

14. Child Online Protection Initiative
The COP Initiative aims at bringing together partners from all sectors of the global community to ensure a safe and secure online experience for children everywhere.
Key Objectives:
Identify risks and vulnerabilities to children in cyberspace
Create awareness
Develop practical tools to help minimize risk
Share knowledge and experience
The ITU launched the Child Online Protection (COP) initiative in 2008 within the framework of its Global Cyber Security Agenda.
COP is essentially an international collaborative framework to promote global awareness on the importance of child safety in the online world, and to assist governments, industry, and educators in developing appropriate resources.
The key objectives of COP include identifying the risks and vulnerabilities to children in cyber space, creating global awareness, developing practical tools to minimize risks, and sharing knowledge and experience.
Active members include UNICEF, UNODC, UNICRI, UNIDIR, the European Commission Safer Internet Programme, Interpol, and ENISA, as well as civil society and private sector organizations such as CHI, IMPACT, Save the Children, (ISC)2, GSMA, Microsoft, Telecom Italia, Telefonica, Vodafone, and Trend Micro. ABI Research is also a member of the network.

15. GCI 2014

16. Organizational Measures Capacity Building
Objective
The Global Cybersecurity Index (GCI) measures and ranks each nation state’s level of cybersecurity development in five main areas:
Legal Measures
Technical Measures
Organizational Measures
Capacity Building
National and International Cooperation
The Global Cybersecurity Index (GCI) is an ITU-ABIresearch joint project to rank the cybersecurity capabilities of nation states. Cybersecurity has a wide field of application that cuts across many industries and sectors. Each country’s level of development will therefore be analyzed within five, previously mentioned categories: Legal Measures, Technical Measures, Organizational Measures, Capacity Building and Cooperation – according to five pillars of GCA.
Goals of the project included: Promote cybersecurity strategies at a national level, drive implementation efforts across industries and sectors, integrate security into the core of technological progress, foster a global culture of cybersecurity.

17. Regulation and Compliance 2. Technical CERT/CIRT/CSIRT Standards
Legal
Criminal Legislation
Regulation and Compliance
2. Technical
CERT/CIRT/CSIRT
Standards
Certification
Organizational
Policy
Roadmap for Governance
Responsible Agency
National Benchmarking
Capacity Building
Standardization Development
Manpower Development
Professional Certification
Agency Certification
Cooperation
Intra-state Cooperation
Intra-agency Cooperation
Public-private Partnerships
International C ooperation
The process of cybersecurity development can be analyzed within five important, broad categories. The following indicators and sub-groups have been identified, and nations are ranked against the benchmark provided within each indicator. Cybercrime legislation designates laws on the unauthorized access, interference, and interception of computers, systems, and data. Cybersecurity regulation designates laws dealing with data protection, breach notification, and certification/ standardization requirements. Technical measures can be measured based on the existence and number of institutions and frameworks dealing with cybersecurity that are endorsed or created by the nation state. The organizational structures can be measured based on the existence and number of institutions and strategies coordinating cybersecurity development at the national level. Capacity building can be measured based on the existence and number of research and development, education, and training programs, certified professionals, and public-sector agencies. National and international cooperation can be measured based on the existence and number of partnerships, cooperative frameworks, and information-sharing networks.

18. Timeframe and Project Activities
The project represents a combined effort of 18 months, from inception to publication.
As well as a global rank, the GCI averages ranks in 6 regions:
The GCI project represents a combined effort of 18 months. As well as a global rank, GCI provides averages ranks in 6 regions.
The GCI research phases includes:
Methodology, Conceptual Framework, Primary Research, Secondary Research, Data Extraction, Data Input, Country Ratification, Finalization.

19. Surveys sent out to all ITU Member States
Available in English, French and Spanish languages
105 total responses received
The primary research phase focuses on answers provided by MS in an ITU survey. Secondary research included ABI Research databases, government databases, regulatory/legislative pronouncements, whitepapers, press releases and academic journals. Total of 103 countries responded to a survey. As you can see on a graph response rate differ by regions, with the highest engagement from Arab States, Africa and Asia Pacific;

20. Here you can see top 5 results
Here you can see top 5 results. Some of them are not really a surprise, for example USA, Japan and Korea are commonly perceived as leaders when it comes to ICT development and cybersecurity. However, some of the results might be surprising. After viewing the next couple of slides the reasons for such high ranking might become clearer.

21. URUGUAY LEGAL MEASURES Regulatory Framework on Cybersecurity
Policy on Information Security in Public Sector
Information Security Direction
National Computer Incident Response Centre CERTuy Decree
Personal data protection and habeas data action Act
EU Commission decision on the adequate protection of personal data by Uruguay (2912)
Uruguay became the first non-European state to join COE’s personal data protection convention (2013)
Uruguay: ranked surprisingly high in the global ranking (8th position), partly due to extensive legal framework. Here you can see some legal solutions adopted by this administration;

22. OMAN TECHNICAL Oman National Computer Emergency Readiness Team (OCERT)
Oman’s Information Security Management Framework is part of the overall ITA standards framework and is based on a structured collection of independent guidelines, processes and practices, primarily from ISO 27011
Information Technology Authority (ITA) as a parent organization of OCERT is ISO certified and encouraging all organizations to adopt and implement the ISO framework
Through the cybersecurity professional development service, OCERT is providing professional cybersecurity training in different security domains by providing information security competency and capability courses and certifications
The training is categorized to three levels (Level 3, Level 2 and Level 1, with Level 1 being the most senior level)
Oman: ranked 3rd in the Global ranking. Oman is a regional leader when it comes to implementation of technical measures;

23. TURKEY ORGANIZATIONAL
The National Cybersecurity Strategy and Action Plan
The action plan consists of 29 main actions and 95 sub-actions and assigns responsibilities about legislation, capacity building, development of technical infrastructure, etc.
The Cybersecurity Board was established in order to determine the measures regarding cybersecurity; to approve the prepared plans, programs, reports, procedures, principles, and standards; and ensure their application and coordination
In the last 3 years, three cybersecurity exercises were organized at the national level with participants from both the public and private sector. The exercise played a big role in raising awareness of cybersecurity and also were a great tool for measuring the development of cybersecurity.
Turkey: ranked 7th. Turkey examples show how important the organizational element of whole cyber framework is.

24. AZERBAIJAN CAPACITY BUILDING
Azerbaijan Ministry of Communications and High Technologies has officially recognized national or sector-specific research and development programs/projects for cybersecurity standards, best practices, and guidelines to be applied in the private and the public sector
The Technical Committee is to implement the preparation of national standards on the basis of international (regional) and interstate standards
Azerbaijan conducts short training courses on E-government and information security
AZ-CERT organizes capture-the-flag competitions to enhance professional competence in information security
The IT and Communications Department of the State Oil Company of Azerbaijan Republic (SOCAR) is certified under ISO 27001:2005
SOCART IT and Communications Department is certified under ISO 27001:2005
Azerbaijan, ranked 11th That is mainly due to extensive capacity building framework developed by administration.

25. REPUBLIC OF KOREA COOPERATION
KISA has in place a number of memorandums of understanding on cybersecurity cooperation with the following: OCSIA (United Kingdom), INCB (Israel), Australia, CNCERT (China), STS (Kazakhstan), CERT Romania, Korea-China-Japan CERT and private sector cooperation with Microsoft, Checkpoint and McAfee
Information Communications Infrastructure Protection Committee to decide and deliberate on protection of critical ICT infrastructure to guarantee national security and stabilize the life of people
National Cybersecurity Conference: Private/public/military response team (Art. 8) organized and operated for decision-making on cyber threats, situation monitoring, analyzing of threats and joint investigation
Cooperation and participation in meetings with APCERT (Asia-Pacific Computer Emergency Response Team), FIRST (Forum on Incident Response and Security Teams)
Republic of Korea, not really a surprise, as Korea leads in ICT innovation. But what is special about Korea is that in spite of having extensively developed legal, technical, organizational and capacity building pillars, country puts strong focus on cooperation. Country’s leadership has a deep understanding that the cybersecurity issue is one of a global nature, and is blind to national borders or sectoral distinctions.

26. Invite countries to assist us in maintaining updates information
Factual information on cybersecurity achievements on each country based on the GCA pillars
Live documents
Invite countries to assist us in maintaining updates information
EXAMPLE
As from 2014, Cyberwellness country profiles are available to the public on the ITU website. The profiles are factual non-analytical representations of cybersecurity wellness of each nation state based on the five GCA pillars namely legal measures, technical and procedural measures, organisational structure, capacity building and in International Cooperation . More profiles are currently being elaborated. The profiles are live documents that will be updated as more data for the countries becomes publicly available. We request countries to contact us and provide update at any point in time.

28. GCI Version 2 Resolution 130 (Rev. Busan, 2014)
“invites Member States to support ITU initiatives on cybersecurity, including the Global Cybersecurity Index (GCI) …”
What is new?
Have a unique value addition to the sphere of existing Cybersecurity indices
Capture more details on Cybersecurity
Enhance consultation with Member States
Expand the partnerships into a multi-stakeholder collaborative platform
The GCI has been successfully recognized at the ITU Plenipotentiary Conference in Busan and included under Resolution 130 (Rev. Busan, 2014) on strengthening the role of ITU in building confidence and security in the use of information and communication technologies. Specifically, Member States are invited “to support ITU initiatives on cybersecurity, including the Global Cybersecurity Index (GCI), in order to promote government strategies and the sharing of information on efforts across industries and sectors”.
Following feedback received from various communities, a second iteration of GCI is under preparation. This new version is being formulated around an extended participation from member states, experts and industry stakeholders as contributing partners. An enhanced conceptual framework and questionnaire is being devised.

29. The conceptual framework, partnership model and questionnaire are being elaborated and will submitted for comments to Member States through the ITU-D SG2/Q3 and through other forums such as the present event todat. As from 2016, the GCI will become an annual exercise with results being proclaimed most probably at WSIS. The yearly results will enable further analysis of trends in the cybersecurity commitment of Member States. The ultimate goal of this initiative is to help foster a global culture of cybersecurity and its integration at the core of information and communication technologies, a key mandate of the ITU. Many other products will be created along with the index as indicated in the diagram. The products will also include elements to enhance existing indicators and to measure the Connect 2020 goal on cybersecurity readiness.

30. What makes the GCI unique is the balanced combination of:
The broad geographic range covering all Member States of ITU
The study of cybersecurity in five broad areas (pillars of Global Cybersecurity Agenda)
The scoring and ranking mechanisms
The cyberwellness country profiles
Index of Indices has been submitted as a contribution to the work of ITU D SG2 Q 3/2.
As there are many cybersecurity indices currently available and not all of them measure the same capabilities, the Cybersecurity Index of Indices aims to facilitate identification of a publication most relevant to specific conditions in which an organization operates. The list contained within the Cybersecurity Index of Indices is in no way finite, but represents the current publications that can be considered as most closely resembling an index or maturity model for cybersecurity measurement and assessment.
What makes the GCI unique is the balanced combination of:
The broad geographic range covering all Member States of ITU;
The study of cybersecurity in five broad areas (pillars of Global Cybersecurity Agenda);
Thescoring and ranking mechanisms;
The cyberwellness country profiles.

31. Go beyond 5 pillars of Global Cybersecurity Agenda (GCA)
Go in more details on each pillar
Address elements needed by SG2Question3
Address elements for Connect 2020
Goal 3 Sustainability: Manage Challenges resulting for telecommunications / ICT development
Target 3.1. Improve cybersecurity readiness by 40%

32. Study group 2 Question 3 WSIS Forum
Contribution submitted for rapporteurs’ meeting of 29 April
SG 3/2 agreed to review and endorse the GCIv2, and to make it the main instrument for data collection to meet their own needs.
Open consultation for 1 month in July
The SG 3/2 will endorse the harmonized questionnaire at main meeting of September 2015
WSIS Forum
2015: release of GCI 2014 report and inform on new version preparation
2016: announcement of Global Results based on GCI version 2
Every WSIS event thereafter: annual results announced
Throughout the steps of this new version, member states will be consulted using various means, including the work of ITU-D SG2/Q3. In the recent rapporteurs’ meeting held on 29th April 2015, Oman has contributed a paper to merge the survey questions of ITU-D SG2/Q3 ( a key element of their ToR) with the GCI given the much higher response rate (104 replies) and broader thematic coverage of GCI questions. This proposal was seconded by other members and was agreed. Additional questions from a joint contribution of UK, Australia, Samoa, Vanuatu and Ireland may also be considered. The new GCI conceptual framework and questionnaire will then be opened for consultations through ITU-D SG2/Q3.

33. “Primary” Partners : ABI Research
Commitment, Continuity, Positive Experience, Expertise
New “Contributing” Partners
Domain Experts, Academia, Industry, Other organizations doing similar work
Partnership
Expertise (Index Development, Statistical analysis, Software tools provision, Qualitative review of results
Data sharing
Funding
Contributing partners would pool resources to increase the granularity of the GCI questionnaire, to provide strong evidence based secondary data, to further analyse the data collected through a qualitative appreciation from experts as well as quantitative correlations with other established indicators such as the ITU’s ICT Development Index and Word Economic Forum’s Network Readiness Index.

34. Index of indices June 2015
New partnerships July 2015
Draft questionnaire & conceptual framework mid-July 2015
Open consultations mid-July 2015
Final questionnaire & conceptual framework Sep 2015
Circular letter to MS with online questionnaire Oct 2015
Data collection Oct 2015 – mid-March 2016
Analysis of responses mid-April 2016
GCIv2 results & all other deliverables May 2016

35. What is GCI for you …
“Help us to build a tool that you can use to gauge your cybersecurity readiness and to take informed decision thereon” K. Huseinovic, ITU
“The GCI is a collaborative index not a competitive one”
A. Boyd, ABI Research
“GCI is a capacity building tool, nothing more than that”
M. Obiso, ITU

36. As a respondent to a questionnaire
As a partner
Add to this body of knowledge under construction
Your expertise on thematics to help enhance the GCI process and deliverables
Connect better with ITU and Member States
As a respondent to a questionnaire
Reflect your Country’s achievements and plans for enhancing cybersecurity
Share best practices
Position your country on the cybersecurity commitment scale

37. Cybersecurity Conference, Sibiu, Romania, 24-25 Sep 2015
Cyberdrills
Americas: Colombia 3 – 6 Aug 2015
Europe & CIS: Montenegro 30 Sep – 2 Oct 2015
Study Group Meetings
ITU-T SG17 Meeting, 8 – 17 Sep 2015
Cybersecurity Workshop, 8 Sep 2015
ITU-D SG2Q3 Meeting, 9 Sep 2015
International Conference “Keeping Children and Young People Safe Online”, Warsaw, Poland, Sep 2015
Cybersecurity Conference, Sibiu, Romania, Sep 2015