1. The National Cyber Security Strategy and Action Plan A presentation by Ms. Antoinette Lucas-Andrews Director, International Affairs Ministry of National Security
A very pleasant morning to all gathered here today.
From the outset, I wold like to express my appreciation to Mr Jack Groete and the team from the National Security Service for inviting me to be a part of this conference and to share with you the experiences of my country in developing our national cyber security strategy.
ITM4D Meeting
Tobago
July

2. FORMAT OF PRESENTATION
BACKGROUND
The ICT and Cyber Security Landscape in Trinidad and Tobago
APPROACH TO STRATEGY DEVELOPMENT
ELEMENTS OF THE NATIONAL CYBER SECURITY STRATEGY
Governance
Incident Management
Culture
Collaboration
Legislation
IMPLEMENTATION OF ACTION PLAN
Over the next few minutes therefore, I propose to outline the BACKGROUND which would provide a general understanding of
Critical Infrastructure Protection in Trinidad and Tobago, and
The ICT and Cyber Security Landscape in my country
I would spend some time detailing the general APPROACH that was used in developing our national strategy; before looking at the actual ELEMENTS OF THE NATIONAL CYBER SECURITY STRATEGY; those being:
Governance
Incident Management
Culture
Collaboration
Legislation
Finally, I will seek to share our experience with respect to LESSONS LEARNT along the way

3. ICT Landscape in Trinidad and Tobago
Mobile phone users: 1,944,000
Mobile penetration 146% (Dec 2013)
Internet household penetration: 54.2%
Fixed Broadband Internet subscriptions: 232,000
Mobile Internet penetration: 33.9%
(Source: TATT, Quarterly Market Update, Q )
Network Readiness Index: 71 out of 148 countries
(Source: WEF Global Information Technology Report 2014)
In a population of 1.5 million people, the latest records reveal that we have over 1.9 Mill phone users, a mobile penetration of 146% and an internet household penetration rate of over 54 %
A government wide movement towards a shared services framework has resulted in an increased requirement for security, stability and resilience.

4. THE ICT LANDSCAPE IN TRINIDAD AND TOBAGO
Cyber bullying
Unauthorised access: Government websites defaced / hacked
Data Leaks
Skimming
Spam, Phishing Scams, Malware
I will like to share two examples with you:
The government’s eConnect and Learn or eCAL project is designed to achieve seamless, high quality and comprehensive education via: 
The provision of Laptops to every student entering secondary school
The Expansion of secondary schools’ connectivity-
Teacher training and infusion of ICT into curriculum delivery
Digital resources and content
Digital portal
TTBizLink is a secure, online platform that was introduced to facilitate the conduct of business and trade related services with the Government of Trinidad and Tobago. Though this single electronic window, you can apply for :
Import/export licences
Work permits
Fiscal Incentives
VAT Registration
These are just two examples of services that would necessitate the requirement for comprehensive information and internet security measures
Recent incidents have included:
Cyber bullying
Unauthorised access: Government websites defaced / hacked
Data Leaks
Skimming
Spam, Phishing Scams, Malware
Isolated incidents are treated on an ad-hoc basis by the ISPs, financial sector or computer related departments in the government.
There is a reliance on ISPs and financial sector to provide support and knowledge sharing on best practices and security awareness.
THE ICT LANDSCAPE IN TRINIDAD AND TOBAGO

5. APPROACH TO STRATEGY DEVELOPMENT

6. THE PROBLEM
Cyber attacks growing in sophistication, frequency and gravity, globally
Impact difficult to quantify as victims very often fail to report incidents
Threats lurking in cyberspace from the general community (unseen)
Lack of coordinated efforts to address cyber security and secure information infrastructure
No comprehensive legislative framework
Inadequate technical expertise
A problem was identified; multi-faceted in nature.
Cyber attacks are growing in sophistication, frequency and gravity, globally.
The real impact is difficult to quantify as victims very often fail to report incident
The threats that are lurking in cyberspace from the general community are unseen
In Trinidad and Tobago there existed little or no coordinated efforts to address cyber security and secure information infrastructure
There was a Ministry of Science and Technology responsible for national ICT policy and management of the government ICT backbone.
The Ministry of National Security had the oversight for the development of the policy and governance framework for cyber security.
And the Ministry of Public Administration the responsibility for programmes to increase ICT access and reduce the digital divide.
There was No comprehensive legislative framework (Computer Misuse Act that was outdated)
And there was inadequate technical expertise pertaining to cyber security.

8. THE SOLUTION: A Coordinated Approach
Establishment of Inter-Ministerial Committee
Political endorsement at the highest level
Clearly defined mandate
Projectized and of specific duration
Inclusive of Government Ministries and Agencies, Telecomm Regulator and National ICT Company
Power to co-opt private sector representatives when necessary
The Solution was in Establishing an inter-ministerial committee with the political endorsement at the highest level. The Committee was given a clearly defined mandate
To develop a coordinated National Cyber Security Strategy and Action Plan
To facilitate, guide and ensure the enactment of a national Cybercrime Act
To facilitate, guide and ensure the implementation of a National Computer Security Incident Response Team (CSIRT)
To establish an implementation mechanism that would have legislative authority to develop and enforce cyber security regulations
To create a mechanism/framework that ensures the regular conduct of risk/vulnerability assessments
The Committee was also given a specific timeframe to complete its mandate (24 months). It began operations in April 2011 and submitted its final report to the Cabinet in May 2013.
Inclusive of Government Ministries and Agencies, Regulator and National ICT Company
Power to co-opt private sector representatives when necessary
Core Committee
Ministry of National Security (Chair)
Ministry of Science and Technology
Ministry of Tertiary Education and Skills Training-University of the West Indies
Ministry of Public Administration
Ministry of the Attorney General
Ministry of Public Utilities
Ministry of Energy and Energy Affairs
Ministry of Finance and the Economy
National ICT Company Ltd. (iGovTT)
Supporting Ministries:
Ministry of Health
Ministry of Education
Ministry of Legal Affairs
Ministry of Foreign Affairs
Ministry of Transport
Telecommunications Authority of Trinidad and Tobago (Regulator)
THE SOLUTION: A Coordinated Approach

9. THE ACHIEVEMENTS
Developed and obtained approval for National Cyber Security Strategy (December 2012).
Developed and obtained approval for a National Cybercrime Policy (February ).
Developed and obtained approval for the establishment of a Cyber Security Agency (August 2013). A Bill to establish same is currently before Parliament
Obtained approval for technical assistance from the International Telecommunication Union for the establishment of a CSIRT (September 2013)
Coordinated the work of a HIPCAR Consultant which resulted in the development of a Draft Cybercrime Bill, currently before Parliament .
Accessed capacity building and training for government stakeholders (OAS/CICTE, HIPCAR and CCI).

10. The creation of a secure and resilient cyber environment, based on collaboration among all key stakeholders, which allows for the exploitation of ICT for the benefit and prosperity of all.
Government’s vision : “a secure and resilient cyber environment, based on collaboration among all key stakeholders, which allows for the exploitation of ICT for the benefit and prosperity of all”
THE STRATEGIC VISION

11. National Cyber Security Strategy: Objectives
To create a secure digital environment;
To provide a governance framework for all cyber security matters;
To protect the physical, virtual and intellectual assets of citizens, organizations and the State;
To ensure the safety of all citizens by promoting awareness and mitigation of cyber risks;
To protect critical infrastructure and secure information networks;
To minimize damage and recovery times ; and
To create the appropriate legal and regulatory framework

12. The National Cyber Security Strategy: Focus Areas
Governance
Incident Management
Culture
Collaboration
Legislation
The Strategy is based on five pillars or focus areas: Governance, Incident Management, Culture, Collaboration and Legislation
Governance: establishment of a Trinidad and Tobago Cyber Security Agency (TTCSA).
Incident management: Establishment of Computer Security Incident Response Team (TT CSIRT)
Collaboration: The establishment of public-private/civil society partnership and enhanced external coordination
Culture: Awareness raising, training and education in cyber security throughout the country.
Legislation: The drafting and enactment of amended updated cybercrime legislation.

13. GOVERNANCE NPC for all cyber security related matters
Implementation and updating of Strategy;
Situational awareness;
efficient government-wide Network and Information security management;
Risk assessment activities, studies on IT security management solutions;
Standards on network and information security
Accreditation and certification
National Cyber Security Contingency Plan
Establishment of a Trinidad and Tobago Cyber Security Agency via legislation
With respect to Governance, the Strategy calls for the development of a Trinidad and Tobago Cyber Security Agency to
Act as the NPC for all cyber security related matters
Implement and periodically update the National Cyber Security Strategy;
Provide situational awareness and collect and analyse data on cyber incidents, cybercrime and cyber security matters;
Promote efficient Network and Information security management across government sectors;
Promote risk assessment activities, interoperable risk management solutions and studies on information technology security management solutions within public and private sector bodies;
Develop and publishes standards for products and services on network and information security
Establish and publish baseline security requirements and standards for various sectors including operators of critical infrastructure
Promote the development of training and education programs including the accreditation and certification of network and information security academic programs
Develop a National Cyber Security Contingency Plan
Enhance cooperation between different actors in the field of network and information security through consultations

14. AUTHORITY OF THE TTCSA
Formulate principles for the guidance of the public and private sector concerning ICT security measures;
Refer such matters to the Trinidad and Tobago Police Service as necessary when an offence under the Cybercrime Act comes to its knowledge;
Undertake such other activities as are necessary or expedient for giving full effect to the Cybercrime Act;
Enter into Memoranda of Understandings with key stakeholders and partners as necessary to execute its function.
The Authority of the TTCSA will be enshrined in legislation. The TTCSA Bill speaks to that Agency being able to, inter alia:
Formulate principles for the guidance of the public and private sector concerning ICT security measures;
Refer such matters to the Trinidad and Tobago Police Service as necessary when an offence under the Cybercrime Act comes to its knowledge;
Undertake such other activities as are necessary or expedient for giving full effect to the Cybercrime Act;
Enter into Memoranda of Understandings with key stakeholders and partners as necessary to execute its function.
The Board:
Chairman with knowledge of and experience in computer networks and internet security ;
Senior representative of the Ministry responsible for National Security;
Senior representative of the Ministry responsible for science and technology;
Person with qualifications and experience in telecommunications;
Attorney-at-law with at least eight years' experience in corporate matters;
Representative of the financial or banking sector; and
Representative of the e-business community.

15. INCIDENT RESPONSE
Establishment of a Computer Security Incident Response Team
The first point of contact to address cyber incidents that may affect national critical information infrastructure
– detection, tracking, mitigation
Alerts and warnings
-a part of hemispheric and international network of CSIRTS
Pillar 2 of the Strategy is Incident Management. The Strategy calls for the establishment of a Computer Security Incident Response Team (CSIRT) as the first point of contact to address cyber incidents that can affect national critical information infrastructure.
The CSIRT will have overall responsibility for detection, tracking and mitigation of such incidents.
It will participate in trusted information sharing and disseminate information with international CSIRTS on the emerging threats to critical information infrastructure and Internet resources; and participate in and be a member of regional and international CSIRTS for collaborative efforts to fight cyber incidents.
The GOTT, in February 2014 entered into an Administrative Agreement with the ITU for the provision of the relevant technical assistance to implement the CSIRT.

16. RESPONSIBILITIES OF THE CSIRT
Provide incident response and management services
Provide alerts and warnings on the latest cyber threats and vulnerabilities
Assess and analyse the impact of incidents
Establish internal and joint procedures between the public and private sectors to manage the incidents and mitigate the threats associated with them
Provide appropriate strategic insights to policy and decision-makers to strengthen the national cyber infrastructure
Assess the work of incident response teams within the public and private sector
provide incident response and management services, in a coordinated manner, via established industry standard policies and procedures to manage threats associated with cyber incidents;
provide alerts and warnings on the latest cyber threats and vulnerabilities which can impact the national community;
assess and analyse the impact of incidents in order to develop strategies and measures to counteract these incidents;
provide to the national community, educational guidelines as to the appropriate use of the national cyber infrastructure;
establish internal and joint procedures between the public and private sectors to manage the incidents and mitigate the threats associated with them;
provide appropriate strategic insights to policy and decision-makers to strengthen the national cyber infrastructure;
assess the work of incident response teams within the public and private sector;
participate in trusted information sharing and disseminate information with international CSIRTS on the emerging threats to critical information infrastructure and Internet resources; and
participate in and be a member of regional and international CSIRTS for collaborative efforts to fight cyber incidents.
RESPONSIBILITIES OF THE CSIRT

17. COLLABORATION International Collaboration National Collaboration
T&T
OAS UN
CCI
ITU
Government
Private Sector
Civil Society
Academia
The third Pillar or Focus Area of the Strategy is that of Collaboration.
The emphasis here is on the requirement for collaboration at the national level and also international.
At the national level, the strategy calls for the establishment of a Permanent Stakeholders Group that would mean bi-annually to discuss concerns and developments in the area of cyber security.
This Group will comprise: representatives from various sectors: ISPs, Banking, Financial, Trade, Academia, Civil Society, etc.
It will be an open forum for continued dialogue on cyber security matters and for discussions on regulations and standards to be set by the TTCSA
National Collaboration
Identify public stakeholders responsible for initiating and developing cyber security policies and regulations;
Engage both the public and private stakeholders in the process by clearly defining their roles and responsibilities;
Define the appropriate incentives that allow private, public and civil society stakeholders to participate in the process;
Involve specific critical infrastructure and Internet service providers instead of allocating responsibilities to a specific sector;
Include civil society in the implementation of the strategy from an awareness raising standpoint;
Foster the development of cyber security certification programmes that will be nationally recognized and accepted;
Educate the general public and small, medium and large businesses
With respect to international collaboration, the Strategy speaks to continued engagement with bilateral parners, hemispheric and international organizations in respect of :
Mutual legal assistance
Technical capacity building
Training
Public awareness

18. CULTURE Multi-disciplinary and multi- stakeholder approach
Promote awareness of risks at all levels
Embedding cyber security in wider aspects of policy formulation
Certification programs through public and private education institutions
Research and development
On the issue of culture, the Strategy recognises the requirement to engender and develop a culture of cyber security throughout the length and breadth of the country: a process that will target the smallest child to the most senior elder that is online for whatever business or purpose.
The approach is both multi-disciplinary and multi-stakeholder and the intention at the end of the day is:
To promote awareness of the risks associated with online activity at all levels: homes, internet cafes, schools, businesses,
The Ministry of National Security is currently developing a public awareness campaign in collaboration with:
The Internet Soceity of TT ( ISOCTT) for launching of safe.tt website
The Anti Phishing Working Group – Stop.Think.Connect
The Commonwealth Cybercrime Initiative (CCI)
The objective is also
To embed cyber security in wider aspects of policy formulation.
Right now the Cyber Security Strategy is a component of the National ICT Strategy and the National Security Strategy. However, the intent is to ensure that cyber security pervades many more policies and strategies.
To inculcate this culture, there is of course, the need to develop and access certification programmes and the need for continuous research and development to keep abreast with this ever evolving reality
CULTURE

19. Criminalization of offences related to computer crime and cybercrime
Institution of investigation mechanisms
Use of electronic evidence in prosecution
Creation of an environment that defines the obligations and restricts the liability of ISPs
Finally, and most importantly for some, the Strategy addresses legislation. It calls for the enactment of a new more comprehensive Cybercrime Act to replace the existing Computer Misuse Act (2000)
The Cybercrime Bill which is currently before Parliament treats inter alia, with:
The Criminalization of offences related to computer crime and cybercrime
The institution of investigation mechanisms
The Use of electronic evidence in prosecution
The Creation of an environment that defines the obligations and restricts the liability of ISPs
The Offences in the Bill includes:
Illegal access to a computer system (“hacking”etc.)
Illegal interception (violating privacy of data communication)
Illegal Data interference (malicious codes, viruses, trojan horses etc.)
System interference (hindering the lawful use of computer systems)
Misuse of devices and illegal devices (tools to commit cyber-offences)
Offences affecting critical infrasturcture
Computer-related forgery (similar to forgery of tangible documents)
Computer-related fraud (similar to real life fraud)
Identity related offences
SPAM
Harassment using an electronic means
Infringement of copyright and related rights
The process in developing the legislation involved:
A Review of existing national legislation
Comparative Study conducted in conjunction with HIPCAR Consultant
Consultations with stakeholders
Drafting of a Cybercrime Policy
LEGISLATION: FOCUS

20. LEGISLATION – PURPOSE
Prevention, investigation, prosecution and sentencing of computer crime and cybercrime in Trinidad and Tobago
Conformity with the international endeavour to fight transnational computer crime and cybercrime
Repeal of the Computer Misuse Act (2000) and replace with the Cybercrime Act

21. LEGISLATION: PROCESS A. Review of existing national legislation:
Anti-Terrorism Act (as amended), 2005
Computer Misuse Act, 2000
Children's Act (as amended), Chap 46:01
Electronic Transfer of Funds Crime Act, 2000
Evidence Act (Section 14B)
Extradition (Commonwealth and Foreign Territories)Act, 1985
Financial Intelligence Unit of Trinidad and Tobago Act, 2009
Interception of Communications Act, 2010
Mutual Assistance in Criminal Matters Act (as amended)
Offences Against the Persons Act, Chap 11:08 (Section 30A)
Proceeds of Crime Act, Chapter 11:27
Telecommunications Act (as amended), Chap 47:31

22. LEGISLATION: PROCESS Commonwealth Model Law Budapest Convention
B. Comparative Study conducted in conjunction with HIPCAR Consultant
Commonwealth Model Law
Budapest Convention
HIPCAR Cybercrime Model Policy Guidelines and Legislative Text
Legislation from other Countries: US, Philippines, Dominican Republic Jamaica, Belgium
Scholastic Articles
Case Law
C. Stakeholder Consultations
Economic/Financial, Telecoms, Academia, IT Security,

23. LEGISLATION – OFFENCES
Illegal access to a computer system (“hacking”etc.)
Illegal interception (violating privacy of data communication)
Illegal Data interference (malicious codes, viruses, trojan horses etc.)
System interference (hindering the lawful use of computer systems)
Misuse of devices and illegal devices (tools to commit cyber-offences)
Offences affecting critical infrasturcture
Computer-related forgery (similar to forgery of tangible documents)
Computer-related fraud (similar to real life fraud)
Identity related offences
SPAM
Harassment using an electronic means
Infringement of copyright and related rights

24. Environmental Scanning Internal Resource Analysis
The importance of:
Environmental Scanning
Internal Resource Analysis
External Resource Identification
The value of:
Problem Identification
Finding Solutions
Prioritization
The requirement for:
Stakeholder consultation
Political commitment
In developing our National Cyber Security Strategy, we have recognised the importance of Environmental Scanning. A needs assessment must be conducted to identify gaps.
Options for technical assistance are widely available in the external environment.
The value in identifying the problem lies in the fact that the solution becomes apparent. In the context of competing security challenges, we need to prioritise and decide whether cyber security will make it to the top of the agenda, or close enough thereto.
Development of policies takes time and requires consultation across various sectors
And finally, if there is not political commitment, at all levels to the Strategy, it will remain a document on a shelf somewhere waiting to be implemented. There is therefore immense value in identifying a champion to move things forward. In our case, it is the TTCSA, which would be established in legislation.

25. THE WAY FORWARD Establishment of the CSIRT
Parliamentary approval and enactment of Cybercrime Bill
Parliamentary approval and enactment of Cyber Security Agency Bill
Establishment of TTCSA
Continuous training and capacity building
Launch of public awareness campaign
THE WAY FORWARD

26. THANK YOU
nationalsecurity.gov.tt