Critical Information Infrastructure Protection A Commonwealth Perspective

Critical Information Infrastructure Protection

A Commonwealth Perspective

Geneva, Switzerland15-16th September 2014

Dr Martin KoyabeHead of Research & Consultancy

Commonwealth Telecommunications Organization (CTO)E-mail: [email protected]

ITU Workshop on “ICT Security Standardizationfor Developing Countries”

Acknowledgement

© Commonwealth Telecommunications Organisation | www.cto.int

Understanding CIIP

• Critical Resources

General definition

• Critical Infrastructure

• Critical Information Infrastructure In

terd

epen

denc

ies

© Commonwealth Telecommunications Organisation | www.cto.int 4

Critical Resources

Water Energy Forests

Defined by some national governments to include:-

• Natural & environmental resources (water, energy, forests etc)• National monuments & icons, recognized nationally &

internationally


Critical Infrastructure (1/3)

Airports Power Grid Roads

Defined by some national governments to include:-

• Nation’s public works, e.g. bridges, roads, airports, dams etc• Increasingly includes telecommunications, in particular

major national and international switches and connections



“ the assets, systems, and networks, whether physical or virtual, so vital to the United States that their incapacitation or destruction would have a debilitating effect on security, national economic security, national public health or safety, or any combination thereof.”

Source: US Homeland Security

“ the (CNI) comprises those assets, services and systems that support the economic, political and social life of the UK whose importance is such that loss could either, cause large-scale loss of life; have a serious impact on the national economy; have other grave social consequences for the community; or be of immediate concern to the national government.”

Source: UK Centre for the Protection of National Infrastructure (CPNI)

“ an asset or system which is essential for the maintenance of vital societal functions. The damage to a critical infrastructure, its destruction or disruption by natural disasters, terrorism, criminal activity or malicious behaviour, may have a significant negative impact for the security of the EU and the well-being of its citizens.”

Source: European Union (EU)



“ those physical facilities, supply chains, information technologies and communication networks which, if destroyed, degraded or rendered unavailable for an extended period, would significantly impact on the social or economic wellbeing of the nation or affect Australia’s ability to conduct national defense and ensure national security.”

Source: The Australian, State & Territory Government

“ processes, systems, facilities, technologies, networks, assets and services essential to the health, safety, security or economic well-being of Canadians and the effective functioning of government. Critical infrastructure can be stand-alone or interconnected and interdependent within and across provinces, territories and national borders. Disruptions of critical infrastructure could result in catastrophic loss of life, adverse economic effects, andSignificant harm to public confidence.

Source: Government of Canada

“those facilities, systems, or functions, whose incapacity or destruction would cause a debilitating impact on national security, governance, economy and social well-being of a nation”

Source: National Critical Information Infrastructure Protection Centre (NCIIPC)


What about commonwealth member countries?

Do they have a national critical infrastructure initiative or strategy?


Critical Infrastructure Sub-Sectors

e.g. Germany has technical basic & social-economic services infrastructure


Critical Information Infrastructure (1/2)

CII definition:-

“ Communications and/or information service whose availability, reliability and resilience are essential to the functioning of a modern economy, security, and other essential social values.”

Rueschlikon Conference on Information Policy Report, 2005


Critical Information Infrastructure (2/2)Cr

itica

l Inf

rast

ruct

ures

Telecoms

Energy

Transportation

Finance/Banking

Government Services

Large Enterprises

End-users

Critical Information Infrastructure

Cross-cutting ICT interdependencies among all sectors

Cyber securityPractices and procedures that enable the secure use and operation of cyber tools and technologies

Non-essential IT Systems

Essential IT Systems


Critical Information Infrastructure Protection (CIIP)

• Widespread use of Internet have transformed stand-alone systems and predominantly closed networks into a virtually seamless fabric of interconnectivity.

• ICT or Information infrastructure enables large scale processes throughout the economy, facilitating complex interactions among systems across global networks.

• ICT or Information infrastructure enables large scale processes throughout the economy, facilitating complex interactions among systems across global networks; and many of the critical services that are essential to the well-being of the economy are increasingly becoming dependent on IT.


• Today Critical Information Infrastructure Protection (CIIP) – Focuses on protection of IT systems and assets

o Telecoms, computers/software, Internet, interconnections & networks services

– Ensures Confidentiality, Integrity and Availabilityo Required 27/4 (365 days)o Part of the daily modern economy and the existence of any country

Critical Information Infrastructure Protection (CIIP)

TelecomNetwork

Power Grid

Water Supply

PublicHealth

NationalDefence

NationalDefence

LawEnforcement


CII Attack Scenarios

Telecoms

Health Services

Cloud Services

Finance/Banking

eGovernment

Critical Information Infrastructure (CII)Cross-cutting ICT interdependencies among all sectors

Natural disaster, power outage, or hardware failure

Resource exhaustion (due to DDoS attack)

Cyber attack (due to a software flaw)


• Expanding Infrastructures– Fiber optic connectivity

o TEAMS/Seacom/EASSy

– Mobile/Wireless Networkso Africa – accounts for 30% of ALL

mobile phones in the world

• Existence of failed states– Increased ship piracy

o To fund other activities

– Cyber warfare platformso Doesn’t need troops or military hardware

• Cyber communities– Social Networks – Attacker’s “gold mine”

Future CII Attack Vectors


• Increased awareness for CIIP & cyber security– Countries aware that risks to CIIP need to be managed

o Whether at National, Regional or International level

• Cyber security & CIIP becoming essential tools– For supporting national security & social-economic well-being

• At national level– Increased need to share responsibilities & co-ordination

o Among stakeholders in prevention, preparation, response & recovery

• At regional & international level– Increased need for co-operation & co-ordination with partners

o In order to formulate and implement effective CIIP frameworks

Global trends towards CIIP


Challenges for developing countries

#1: Cost and lack of (limited) financial investment– Funds required to establish a CIIP strategic framework can be a hindrance– Limited human & institutional resources

Source: GDP listed by IMF (2013)


#2: Technical complexity in deploying CIIP– Need to understand dependencies & interdependencies

o Especially vulnerabilities & how they cascade


Powerplants Regional Power Grid

Regional Power Supply

Private D2D links

Private Datacenters

Banks & Trading

Public Administration

Public Datacenters

eGovernment

Online services, cloud

computing Telco sites, switch areas,

interconnections

Public eComms

Regional network, cables,

wires, trunks

Public Transport

Emergency care (Police, Firefighters,

Ambulances)

Emergency Calls

(99.9%) 8 hr outages are disastrous

(99%) 3 days outages are disastrous

(90%) 30 days outages are disastrous


#3: Need for Cybersecurity education & culture re-think– Create awareness on importance of Cybersecurity & CIIP

o By sharing information on what works & successful best practices

– Creating a Cybersecurity culture can promote trust & confidenceo It will stimulate secure usage, ensure protection of data and privacy



#4: Lack of relevant CII strategies, policies & legal framework– Needs Cybercrime legislation & enforcement mechanisms– Setup policies to encourage co-operation among stakeholders

o Especially through Public-Private-Partnerships (PPP)

#5: Lack of information sharing & knowledge transfer– It is important at ALL levels National, Regional & International – Necessary for developing trust relationships among stakeholders

o Including CERT teams



Steps towards CI Protection

(1) Establish CIP Goals, e.g.Critical infrastructures (CI) provide the essential services that support modern information societies and economies. Some CI support critical functions and essential services so vital that the incapacitation, exploitation, or destruction, through natural disaster, technological failure, accidents or intentional attacks could have a debilitating effect on national security and economic well-being.

• Critical Infrastructure (CI)

CI exploitation, or destruction, through natural disaster, technological failure, accidents or intentional attacks could have a debilitating effect on national security and economic well-being.

• Understand Critical Infrastructure (CI) Risks

Prevent or minimize disruptions to critical information infrastructures, no matter the source, and thereby protect the people, the economy, the essential human and government services, and the national security. In the event disruptions do occur, they should be infrequent, of minimal duration and manageable.

• Articulate CIP policy/goals

National CIP framework includes relevant government entities, as well as, establishing public private partnerships involving corporate and non-governmental organizations.

• Establish Public-Private Partnerships



(2) Define CIP Roles

Define Policy and Identify Roles

GovernmentDefine CIP goal and roles

Determine Acceptable Risks Levels

Public-Private PartnershipDefine what’s critical

Assess RisksIdentify Controls and MitigationsImplement ControlsMeasure Effectiveness

InfrastructurePrioritize Risks

Operators & Service ProvidersDeploy best control solutions



CIP Coordinator(Executive Sponsor)

Law Enforcement

Computer Emergency

Response Team (CERT)

Public Private

Partnership

Infrastructure owners and operators

IT vendors and

solution providers

Shared PrivateGovernment



(3) Identify & Prioritize Critical Functions

Critical FunctionInfrastructure

Element

Supply Chain

Supply Chain

Key Resource

Supply Chain

Critical Function

Infrastructure Element

Supply Chain

Supply Chain

Key Resource

Supply ChainCritical Function

Infrastructure Element

Supply Chain

Supply Chain

Key Resource

Supply Chain

InterdependenciesUnderstand requirements &

complexity

• Understand the critical functions, infrastructure elements, and key resources necessary for

– Delivering essential services– Maintaining the orderly operations if the

economy– Ensure public safety.



(4) Continuously Assess and Mange Risks

Assess Risks

Identify Controls

and Mitigations

Implement

Controls

Measure Effective

ness

• Based on holistic approach• Implement defense in-depth

• Organize by control effectiveness

• Evaluate program effectiveness• Leverage findings to improve risk

management

• Identify key functions• Assess risks• Evaluate consequences

• Define functional requirements• Evaluate proposed controls• Estimate risk reduction/cost

benefit• Select mitigation strategy


Steps towards CI protection

• Develop joint PPP plans for managing emergencies – including recovering critical functions in the event of significant incidents, including but limited to natural disasters, terrorist attacks, technological failures or accidents.

• Create emergency response plans to mitigate damage and promote resiliency.

• Create effective emergency response plans that are generally short and highly actionable so they can be readily tested, evaluated, and implemented.

• Testing and exercising emergency plans to promote trust, understanding and greater operational coordination among public and private sector organizations.

• Exercises also provide an important opportunity by identifying new risk factors that can be addressed in response plans or controlled through regular risk management functions.

(5) Establish & Exercise Emergency Plans


Steps towards CII protection

• Promote trusted relationships needed for information sharing and collaborating on difficult problems

• Leverage the unique skills of government and private sector organizations

• Provide the flexibility needed to collaboratively address today’s dynamic threat environment

(5) Establish Public Private Partnership (PPP)



• Ability to prepare for and adapt to changing conditions, and withstand and recover rapidly from disruptions

• Implement contingency frameworks that will enable critical functions to withstand and recover from deliberate attacks, accidents, or naturally occurring threats or incidents

(6) Build Security & Resiliency into Operations



• Cyber threats are constantly evolving

• All CIP stakeholders need to prepare for changes in cyber threats

• Constantly monitor trends and changes in critical function dependencies

• Keep systems patched and maintain the latest software versions

• Adopt smart & effective procedures and processes

(7) Update & Innovate Technology and Processes

Commonwealth Cybergovernance Model


Trends in Cyberspace

• Cyberspace provides access to ICT– Bridging the digital divide and influencing social-economic activities

• Cyberspace is increasingly becoming a global system– Anticipated to grow from 2-4 Billion users by 2020 (mostly from developing

countries)

• Cyberspace is open, decentralised and empowering– This has fostered innovation, collaboration and rapid development

• Cyberspace success depends on it’s infrastructure– Infrastructure should be secure, resilient and available to users

• Cyberspace can also be used for criminal activities– Cybercrimes, extremisms and other social crimes


Why a Commonwealth Model

• Contrasting views emerging across the world on governing the Cyberspace

• Harmonisation is critical to facilitate the growth and to realise the full potentials of Cyberspace

• Commonwealth family subscribes to common values and principles which are equally well applicable to Cyberspace

• CTO is the Commonwealth agency mandated in ICTs• The project was launched at the 53rd council meeting of the

CTO in Abuja, Nigeria (9th Oct 2013) • Wide consultations with stakeholders• Adopted at the Commonwealth ICT Ministers Forum on 3rd

and 4th March 2014 in London


Objectives

The Cybergovernance Model aims to guide Commonwealth members in:-

– Developing policies, legislation and regulations– Planning and implementing practical technical

measures– Fostering cross-border collaboration– Building capacity


Commonwealth Values in Cyberspace

• Based on Commonwealth Charter of March 2013– Democracy, human rights and rule of law

• The Charter expressed the commitment of member states to – The development of free and democratic societies– The promotion of peace and prosperity to improve the lives of

all peoples– Acknowledging the role of civil society in supporting

Commonwealth activities

• Cyberspace today and tomorrow should respect and reflect the Commonwealth Values– This has led to defining Commonwealth principles for use of

Cyberspace


Commonwealth Principle for use of Cyberspace

Principle 1: We contribute to a safe and an effective global Cyberspace• as a partnership between public and private sectors, civil society and users,

a collective creation;• with multi-stakeholder, transparent and collaborative governance promoting

continuous development of Cyberspace;• where investment in the Cyberspace is encouraged and rewarded;• by providing sufficient neutrality of the network as a provider of information

services;• by offering stability in the provision of reliable and resilient information

services;• by having standardisation to achieve global interoperability;• by enabling all to participate with equal opportunity of universal access;• as an open, distributed, interconnected internet;• providing an environment that is safe for its users, particularly the young and

vulnerable;• made available to users at an affordable price.



Principle 2: Our actions in Cyberspace support broader economic and social development• by enabling innovation and sustainable development, creating greater

coherence and synergy, through collaboration and the widespread dissemination of knowledge;

• respecting cultural and linguistic diversity without the imposition of beliefs;• promoting cross-border delivery of services and free flow of labour in a multi-

lateral trading system;• allowing free association and interaction between individuals across borders;• supporting and enhancing digital literacy;• providing everyone with information that promotes and protects their rights

and is relevant to their interests, for example to support transparent and accountable government;

• enabling and promoting multi-stakeholder partnerships;• facilitating pan-Commonwealth consultations and international linkages in a

single globally connected space that also serves local interests.



Principle 3: We act individually and collectively to tackle cybercrime• nations, organisations and society work together to foster

respect for the law;• to develop relevant and proportionate laws to tackle

Cybercrime effectively;• to protect our critical national and shared infrastructures;• meeting internationally-recognised standards and good

practice to deliver security;• with effective government structures working collaboratively

within and between states;• with governments, relevant international organisations and the

private sector working closely to prevent and respond to incidents.



Principle 4: We each exercise our rights and meet our responsibilities in Cyberspace• we defend in Cyberspace the values of human rights, freedom of expression

and privacy as stated in our Charter of the Commonwealth;• individuals, organisations and nations are empowered through their access

to knowledge;• users benefit from the fruits of their labours; intellectual property is

protected accordingly;• users can benefit from the commercial value of their own information;

accordingly, responsibility and liability for information lies with those who create it;

• responsible behaviour demands users all meet minimum Cyberhygiene requirements;

• we protect the vulnerable in society in their use of Cyberspace;• we, individually and collectively, understand the consequences of our actions

and our responsibility to cooperate to make the shared environment safe; our obligation is in direct proportion to culpability and capability.


Practical Application of Commonwealth Principles

• Commonwealth members can develop individual strategies– Aimed at addressing unique local needs and socio-economic

priorities

• The Commonwealth Telecommunications Organisation welcomes engagement by all stakeholders


Further Information Contact:

Dr Martin KoyabeEmail: [email protected] Tel: +44 (0) 208 600 3815 (Off) +44 (0) 791 871 2490 (Mob)

Q & A Session

Documents

Critical Information Infrastructure Protection A Commonwealth Perspective