1. ITU activities on Cyber security
April 2014

2. Content ITU Mandate on Cybersecurity ITU Initiatives
Global Cybersecurity Agenda
High Level Experts Group
ITU Initiatives
National CIRT Programme with IMPACT
Child Online Protection
Global Cybersecurity Index
Enhancing Cybersecurity in LDCs
National Strategies and Legislations
UN-wide framework on Cybersecurity & Cybercrime
Global Partnerships

3. ITU Overview Founded in 1865 Leading UN Specialised Agency for ICTs
HQs in Switzerland
Three sectors (ITU-T, ITU-D, and ITU-R)
5 Regional Offices & 7 Area Offices
193 Member States and 700 Sector Members
ITU-T
Efficient, right-time production of international telecommunication standards
ITU-R
Managing the international radio-frequency spectrum and satellite orbit resources
ITU-D
Established to help spread secure, equitable, sustainable and affordable access to ICT.
ITU TELECOM
Brings together the top names from across the ICT industry & ministers and regulators for a major exhibition, a high level forum & a host of other opportunities

4. ITU mandate on cybersecurity
2003 – 2005
WSIS entrusted ITU as sole facilitator for WSIS Action Line C5 - “Building Confidence and Security in the use of ICTs”
2007
Global Cybersecurity Agenda (GCA) was launched by ITU Secretary General
GCA is a framework for international cooperation in cybersecurity
2008 to date
ITU Membership endorsed the GCA as the ITU-wide strategy on international cooperation.
The WSIS happened in two phases: 2003 in Geneva and 2005 in Tunis. During the Tunis phase, WSIS goals and the implementation mechanisms for each action lines were elaborated.
ITU was identified as sole facilitator of the Action Line C5: Building confidence and security in the usage of ICTs, and as such was tasked by world leaders to coordinate Cybersecurity efforts at the global level.
In line with ITU’s role as sole facilitator for WSIS Action Line CS and in accordance with other decisions by ITU Membership, the Global Cybersecurity Agenda (GCA) was launched by the ITU Secretary-General in 2007 as the ITU framework for international multi-stakeholder cooperation in cybersecurity aimed at building synergies with current and future initiatives and partners towards a safer and more secure information society.
Building confidence and security in the use of ICTs is widely present in PP and Conferences’ resolutions. In particular WTSA 12, PP 10 and WTDC 10 produced Resolutions (WTSA 12 Res 50, 52, 58, PP Res 130, 174, 179, 181 and WTDC 45 and 69) which touch on the most relevant ICT security related issues, from legal to policy, to technical and organization measures.

5. ITU-T Activities ITU-T Study Group 17
Lead Study Group for Telecommunication Security
Mandate for Question 4/17 (Q.4/17): Cybersecurity
Provides ICT Security Standards Roadmap
ITU-T Cybersecurity Information Exchange Framework (CYBEX)
ITU-T Security Manual "Security in telecommunications and information technology
Focus Group on Identity Management (IdM)
Approved over 100 Recommendations on security for communication
JCA on COP
WTSA Resolutions
ITU WTSA Resolution 50: Cybersecurity
ITU WTSA Resolution 52: Countering and combating spam
ITU WTSA Resolution 58: Encourage the creation of national computer incident response teams, particularly for developing countries
ITU-T Study Group 17 (SG-17), the lead study group on security and identity management (IdM), continues to be instrumental in study and standardization in the areas of cybersecurity, anti-spam, IdM, X.509 certificates, information security management, ubiquitous sensors networks, telebiometrics, IPTV security, virtualization security towards cloud computing security, and security architecture and application security, often in cooperation with external Standards Developing Organizations and Consortia.
SG-17 approved seven Recommendations on cybersecurity: ITU-T X.1208 “A cybersecurity indicator of risk to enhance confidence and security in the use of telecommunication/information and communication technologies”, X.1210 “Overview of source-based security troubleshooting mechanisms for Internet protocol-based networks”, revised X.1520 “Common vulnerabilities and exposures”, revised X.1526 “Language for the open definition of vulnerabilities and for the assessment of a system state”, X.1544 “Common attack pattern enumeration and classification”, X.1546 “Malware attribute enumeration and characterization”, X.1582 “Transport protocols supporting cybersecurity information exchange”, and X.1601 “Security framework for cloud computing”. Draft Rec. ITU-T X.1211 “Guideline on techniques to prevent web-based attacks” was determined, and draft Rec. ITU-T X.1303bis “Common alerting protocol (CAP 1.2)” was consented to.
New work has started on a technical framework for countering mobile messaging spam, on a security capability requirements framework for countering smartphone-based botnets, on information security controls for cloud computing, and on certified mail transport and certified post office protocols.

6. ITU-R Activities
Establish fundamental security principles for IMT-2000 (3G) networks
Issue ITU-R Recommendation on security issues in network management architecture for digital satellite system and performance enhancements of transmission control protocol over satellite networks
ITU-R Recommendations
Recommendation ITU-R M.1078: Security principles for International Mobile Telecommunications-2000 (IMT-2000)
Recommendation ITU-R M.1223: Evaluation of security mechanisms for IMT-2000
Recommendation ITU-R M.1457: Detailed specifications of the radio interfaces of International Mobile Telecommunications-2000 (IMT-2000)
Recommendation ITU-R M.1645: Framework and overall objectives of the future development of IMT-2000 and systems beyond IMT-2000
Recommendation ITU-R S.1250: Network management architecture for digital satellite systems forming part of SDH transport networks in the fixed-satellite service
Recommendation ITU-R S.1711: Performance enhancements of transmission control protocol over satellite networks
ITU-R’s work in radiocommunication standardization continues, matching the constant evolution in modern telecommunication networks. ITU-R established clear security principles for IMT (3G and 4G) networks (Recommendations ITU-R M.1078, M.1223, M.1457, M.1645 and M.2012). It has also issued recommendations on security issues in network management architecture for digital satellite systems (Recommendation ITU-R S.1250) and performance enhancements of transmission control protocol over satellite networks (Recommendation ITU-R S.1711).

7. Global Cybersecurtiy Agenda (GCA)
GCA is designed for cooperation and efficiency, encouraging collaboration with and between all relevant partners, and building on existing initiatives to avoid duplicating efforts.
GCA builds upon five pillars:
Legal Measures
Technical and Procedural Measures
Organizational Structure
Capacity Building
International Cooperation
Since its launch, GCA has attracted the support and recognition of leaders and cybersecurity experts around the world.
H.E. Blaise Compaoré, President of Burkina Faso, and H.E. Dr Óscar Arias Sánchez, Former President of the Republic of Costa Rica and Nobel Peace Laureate, are both Patrons of the GCA.

8. High-Level Expert Group (HLEG)
The High-Level Expert Group (HLEG) on Cybersecurity was established in It is comprised of over 100 renowned experts from a broad range of backgrounds, sectors and geographical regions.
These experts worked tirelessly to formulate proposals to the ITU Secretary-General on strategies to curb cyberthreats, combat cybercrime and promote cybersecurity.
Its outputs include the Report of the Chairman of the HLEG, a set of strategic proposals, and the HLEG Global Strategic Report, which summarizes the HLEG’s work in seeking to promote cybersecurity around the world.

9. Global Cybersecurity Agenda (GCA)
GCA: From Strategy to Action
Publication : Understanding Cybercrime A Guide for
Developing Countries
MoU with UNODC for assistance
ITU-EC project model law for ACP
1. Legal Measures
ITU Standardization Work: ITU-T , ITU-D SG1 Q22
ITU-R recommendations on security
ICT Security Standards Roadmap ITU-T JCA on COP
2. Technical and Procedural Measures
National CIRT deployment
ITU work on National CIRTs cooperation
ITU Cybersecurity Information
Exchange Network (CYBEX)
ITU-D SG 1 Q22
3. Organizational Structures
Global Cybersecurity Agenda (GCA)
ITU National Cybersecurity Strategy Guide
Report on ITU-D SG1 Q22
Technical assistance and projects:LDCs
Regional Cybersecurity Seminars
National Cyber drills
4. Capacity Building
5. International Cooperation
ITU High-Level Expert Group (HLEG)
ITU-IMPACT Collaboration
ITU’s Child Online Protection(COP)
Collaboration with UN, and other IGOs, as well as with
Symantec, Trend Micro, ABI research, etc
In May 2011 ITU and UNODC signed an MoU to collaborate globally to facilitate the establishment of legal measures and legislative frameworks pertaining to cybercrimes at national level.
ITU-EC Project : provides support for the establishment of harmonized cybersecurity policies for the ICT market in the ACP states (SADC model law on cybersecurity)
ITU-D SG 1 Q22-1/1 : Securing information and communication networks: best practices for developing a culture of cybersecurity.
ICT Security Standards roadmap: to assist in the development of security standards.
It provides information about existing standards and current standards work from different stakeholders and
It enables potential users of security standards, and other stakeholders to better understand standards available or under development as well as the key organizations that are working on these standards.
ITU-T JCA on COP : The purpose of the Joint Coordination Activity - COP is to coordinate the ITU-T child online protection (COP) work amongst the ITU-T study groups, and to liaise with ITU-R and ITU-D as well as with the Council Working Group on Child Online Protection.
CYBEX : framework describes how cybersecurity information is exchanged between cybersecurity entities on a global scale and how the exchange is assured. The worldwide implementation of the framework will eventually minimize the disparate availability of cybersecurity information.

10. ITU-IMPACT Initiative
Since 2008 – a global initiative – for technical capacity building
149 Member States joined this global initiative
Conducted 47 country assessment to determine cybersecurity readiness and 3 more underway
Facilitated the deployment of 7 National CIRTs and 6 more in progress
Trained over 2700 cybersecurity professional and practitioners globally
Granted over 360 scholarships to 52 countries
Conducted world’s first cyber drills benefitting more than 60 countries
- Next drill for Europe region in Turkey on May 2014
The ITU-IMPACT Partnership is based on a Memorandum of Understanding (MoU) signed in 2008 and constitutes the first truly global multi-stakeholder and public-private alliance against cyberthreats.
ITU, in partnership with IMPACT, continues to deploy capabilities to build capacity at regional and international levels. ITU–IMPACT has undertaken technical assessments to evaluate the preparedness for the establishment of national CIRTs in 47 countries and is continuing with the necessary follow-up actions. Future assessments are planned in Bolivia amongst other.
National CIRTs have been set up in 7 countries namely Burkina Faso, Côte d’Ivoire, ​Kenya, Montenegro, Tanzania, Uganda, Zambia and establishment is currently underway in Jamaica, Ghana, Burundi, , , Trinidad and Tobago, Barbados and Cyprus. Training for Burkina Faso on CIRT operations was carried out in June and July Technical assistance on CIRT and National strategies were provided to Monaco, Cyprus and Rwanda during the period of September-December 2013.
In collaboration with IMPACT, ITU conducts Cyber Drills for its partner countries to enhance the communication and incident response capabilities of participating teams, and to strengthen national and international cooperation against cyber threats. So far, ITU–IMPACT has conducted Cyber Drills for more than 50 countries. A Cyber Drill was held for the Latin America region in Montevideo, Uruguay, from 26 to 29 August 2013 and for the Arab Region in Muscat, Oman, from 27 to 28 October Cyber Drills for Europe in Turkey is being held on May and the America Region one is planned for the first semester of 2014 in Peru.
In July 2013, ITU signed a Memorandum of Understanding (MoU) with the Nigerian Communication Commission to set up a Regional Cybersecurity Centre to facilitate collaboration on combating cyber threats at the regional and national levels. This centre will also provide support to the champion for Child Online Protection, the First Lady of Nigeria, Dame Patience Jonathan champion. .

11. ITU’s Child Online Protection
Under the GCA umbrella, ITU initiated the Child Online Protection initiative (COP) in November 2008.
COP has been established as an international collaborative network for promoting the online protection of children and young people worldwide by providing guidance on safe online behavior.
July 2013: H.E. Dame Patience Goodluck Jonathan, First Lady of Nigeria was appointed ITU COP Champion
Objectives
Identify risks and vulnerabilities to children in cyberspace
Create awareness
Develop practical tools to help minimize risk
Share knowledge and experience
The COP Initiative is currently in the process of updating the COP Guidelines for Industry. The drafting process involved COP partners from all stakeholder groups, with UNICEF assuming editorial responsibility. Open consultations (online and at IGF 2013) were conducted by ITU and UNICEF with all stakeholders in order to collect views on the draft guidelines (expected to be ready in mid-2014).
The Joint Coordination Activity on Child Online Protection (JCA-COP) continues its work under SG-17, with three virtual meetings held since the last reporting period. Issues discussed include standards for age verification for enhancing IdM best practices, and approaches of voluntary regulation by Industry.

12. The Global Cybersecurity Index (GCI)
Objective
The Global Cybersecurity Index (GCI) aims to measure and rank each nation state’s level of cybersecurity development in five main areas:
Legal Measures
Technical Measures
Organizational Measures
Capacity Building
National and International Cooperation
Goal
Promote government strategies at a national level
Drive implementation efforts across industries and sectors
Integrate security into the core of technological progress
Foster a global culture of cybersecurity
The GCI project is a joint effort between the ITU and ABI Research. The Global Cybersecurity Index was launched at ITU Telecom World in November 2013 with the first results from the Arab region. Results for the African region are currently being compiled. The index will allow nation states to better address their cybersecurity needs and drive development of national capabilities in all five areas. The ultimate goal is to help foster a global culture of cybersecurity and its integration at the core of information and communication technologies. We need responses from all countries to be able to develop a tool to help all. Collaborate by sending your country response.
The World Economic Forum and Oxford University have approached us to collaborate and share info on the GCI.

13. Enhancing Cybersecurity in Least Developed Countries project
Aims at supporting the 49 Least Developed Countries in strengthening their cybersecurity capabilities.
How
Assessment for selected key government ministries &
subsequent solutions provision
Capacity building through training of trainers, workshops,..
Customised guidelines on legislation, regulation and technologies
End Result
protection of their national infrastructure, including the critical information infrastructure, thereby making the Internet safer and protecting Internet users
serve national priorities and maximize socio-economic benefits in line with the objectives of the World Summit on the Information Society (WSIS) and the Millennium Development Goals (MDGs).
Cyber-threats are increasingly affecting the daily lives of ICT users around the world. Least Developed Countries (LDCs) may seem currently unaffected by this global concern but it is only a question of time before LDCs realise the implications and feel the impact of cyber-threats. It is to be noted that a region like Africa accounts for 2% of the global GDP but 10% percent of cyber incidents (in other words it is estimated that 10% of the global cyber-attacks of various nature, including cybercrimes originate from the African continent). 34 of the 49 LDCs are located in the African region.
For the first stage, 8 LDCs were selected based on their interest in this program and bearing in mind their need to enhance cybersecurity at national level. These are: Haiti, Sierra Leone, Gambia, Guinea, Djibouti, Mauritania, Comoros and Vanuatu.
ITU made available 500,000 USD to start implementation, out of the total required amount of around 4 Million USD. Resource mobilization activities are taking place to secure the necessary funds to complete this project.
We are only as secure as our weakest link … 13 13

14. National Strategies and Legislations
Establishment of Harmonized Policies for the ICT Market in the ACP States completed in in 3 subprojects
by ITU and European Commission.
Enhancing competitiveness in the Caribbean through the harmonization of ICT Policies, Legislation and Regulatory Procedures (HIPCAR Project).
Support for harmonization of the ICT Policies in Sub-Saharan Africa (HIPSSA Project).
Capacity Building and ICT Policy, Regulatory and Legislative Frameworks Support for Pacific Island Countries (ICB4PAC Project).
ITU assists Member States to develop National Cybersecurity Strategies and to adapt their legislations to effectively address cybercrimes
Understanding Cybercrime: Phenomena, challenges and legal response - an ITU publication
     
Within the framework of the European Commission project (Support for the Establishment of Harmonized Policies for the ICT Market in the African, Caribbean and Pacific islands (ACP) regions), and in close collaboration with work under Programme 2, BDT has undertaken activities aimed at facilitating the harmonization of cybersecurity-related legislation at the regional level. Completed in September 2013, the three sub-projects covered around 60 countries in the ACP regions.
As cyber-threats can originate anywhere around the globe, the challenges are inherently international in scope and it is desirable to harmonize legislative norms as much as possible to facilitate regional and international cooperation. To assist countries in understanding the links between cybersecurity, the building of confidence and security in the use of ICTs, and cybercrime, ITU has developed, and is in the process of developing, a number of tools. One such tool, which ITU has developed together with an expert, is the ITU publication titled “UNDERSTANDING CYBERCRIME: Phenomena, Challenges and Legal Response”. The Guide can serve to help developing countries better understand the implications related to the growing cyber-threats and assist in the assessment of the current legal framework and in the establishment of a sound legal foundation, if this does not yet exist.

15. UN-wide framework on Cybersecurity & Cybercrime
ITU and UNODC, along with some 33 UN Agencies, developed UN-wide framework on Cybersecurity & Cybercrime.
Document focuses on the external efforts of UN entities concerning Member States
The purpose of this framework is:
To enable enhanced coordination among UN entities in their response to concerns of Member States regarding cybercrime and cybersecurity
Framework document presented to and endorsed by the UN CEB in November 2013
Strategy document under preparation for 2014
The UN wide framework on Cybersecurity and Cybercrime was endorsed in the CEB meeting of 2013 : The framework highlights seven principles to enable enhanced coordination amongst UN agencies in their response to the concerns of Member States on Cybersecurity. The CEB has requested ITU, UNESCO, UNODC, UNDP, and UNCTAD, in close coordination with HLCP, HLCM and UNDG, to develop a system-wide comprehensive and coherent strategy for addressing the issue, for discussion at CEB’s Second Regular Session of 2014
Principle 1: Cyber incidents should be dealt with in a holistic manner through the delivery of technical support for criminal justice, as well as the strengthening of international cooperation in prevention, identification, investigation response, prosecution and recovery.
Principle 2: UN entities should aim to respond to cybercrime and cybersecurity needs in Member States within their respective mandates.
Principle 3: All cybercrime and cybersecurity-related programming by UN entities should respect the principles of the rule of law and human rights
Principle 4: Cybercrime and cybersecurity programming by UN entities should focus on assisting Member States to take evidence-based action, supported by crime and risk assessment of a potential threat posed, taking into consideration particular responses to regional or national risk factors.
Principle 5: Where possible, cybercrime and cybersecurity-related programming should foster a “whole-of-government” response.
Principle 6: Support to Member States should, where possible, and bearing in mind the sovereign rights of Member States, aim to strengthen relevant formal and informal mechanisms for international cooperation in cybercrime and cybersecurity matters
Principle 7: Cybercrime and cybersecurity-related programming should make efforts to strengthen cooperation between government institutions and private sector enterprises

16. Building a global partnership
The recent establishment of global collaborations emphasize the role of ITU as global catalyst on international cooperation in cybersecurity and BDT as the implementing arm
Capacity building initiatives, joint consultations and more. February 2014 regional Cybercrime Investigation Seminar
Best practices in cybercrime legislations, joint technical assistance to member states, information sharing
Tap on expertise of globally recognized industry players and accelerate info sharing with ITU member states
Collaboration with ABI Research – The Global Cybersecurity Index (GCI)
We are collaborating with Interpol after the signing of an MoU with IMPACT in 2012 : A first regional Cybercrime Seminar was jointly organized in Kuala Lumpur on February
In May 2011, ITU and UNODC signed a Memorandum of Understanding (MoU) to collaborate globally on assisting Member States in mitigate the risks posed by cybercrime with the objective of ensuring secure use of Information and communication technologies. The MoU enables the two bodies to work together on technical assistance to be provided to Member States on cybercrime and Cybersecurity, making available the necessary expertise and resources to facilitate the establishment of legal measures and legislative frameworks at national level, within the principle of international cooperation, for the benefit of all countries in the world.
An MoU was signed with a key IT security player, Symantec, in 2011 with a view of expediting dissemination of cyberthreat related reports targeting not only technical people but also decision makers in our Member States community. A similar agreement has been reached with Trend Micro in To date annual and quarterly cyberthreat reports as well as predictions and cybersecurity related infographics (clear visuals containing complex information) are being dissiminated in a timely way to Member States and is also accessible from the ITU website.
The collaboration with ABI Research was initiated in 2013 with the Global Cybersecurity Index project.
In January 2014, ITU signed a cooperation agreement with FIRST, the Forum of Incident Response and Security Teams. FIRST is a premier organization and recognized global leader in incident response, bringing together a wide variety of security and incident response teams, who cooperatively handle computer security incidents and promote incident prevention programs. One of the key element of this collaboration is to facilitate the affiliation process of ITU Member State’s national CIRTs to FIRST.
We are also collaborating with Member States where certain National CIRTs have matured and expanded into Regional Cybersecurity Centres that provide specialized services such as Digital Forensics, Security Assessments and training not only at the national level but also to neighbouring countries. The Oman regional cybersecurity centre is operational since 2013 whilst the Nigeria regional cybersecurity centre’s implementation is being planned.
Collaboration with FIRST – To share best practices on computer incident response, engage in joint events, facilitate affiliation of national CIRTS of member states
Collaboration with Member States – Regional Cybersecurity Centres

17. A recent experience
Cybersecurity pavilion during ITU TELECOM World November 2013
Cybersecurity event in Azerbaijan December
Cybersecurity event in Greece March 2014
Cybersecurity was a key theme of ITU Telecom World A separate Cybersecurity Pavilion was established with the active participation of governments and major private sector entities. Activities at the pavilion highlighted the critical, wide-ranging and truly global nature of the security issues the world is facing and focused on how the international community can best deal with them.
The Republic of Azerbaijan organized an international conference titled “Global Cybersecurity Cooperation: Challenges and Visions”, on 2-3 December 2013 in Baku with the support of ITU in partnership with Interpol, the World Bank and the World Economic Forum. The conference brought together around 200 high-level delegates from different stakeholder groups to discuss global cybersecurity-related issues.
ITU recently collaborated with the Greek Government and the European Commission in organizing a regional conference in March 2014 in Athens on the theme ‘Safety & Security in Cyber Space : building up trust in the EU’. It provided an opportunity for High level dialogue between the stakeholders on strategies and policies directed towards a more protected and reliable cyber space, laying emphasis on potential cyber threats and areas that have scope for improvement, while building confidence and security in the use of information and communication technologies. The Forum also facilitated discussions on possible challenges that might be addressed at the regional level.

18. More information on the above at
Let’s work together
Respond to the questionnaire for the Global Cyber Security Index
Partner with us to ‘Enhance Cybersecurity in Least Developed Countries’
Join the IMPACT initiative to avail of cybersecurity services
International cooperation to address Child Online Protection
Join the ITU-T study group 17
More information on the above at