AddToAny

Printer Friendly and PDF

Cybersecurity

Updates

12 Jan 2017

In its recently published report on Technology, Media and Telecommunications Predictions, Deloitte predicts that over 300 million smartphones will have on-board neural network machine learning capability in 2017, allowing devices to perform machine learning tasks even when offline. This will enhance applications such as indoor navigation, augmented reality, speech recognition, and language translation. Such capabilities are also likely to be found in tens of millions drones, tablets, cars, virtual or augmented reality devices, medical tools, etc. Deloitte also expects that DDoS attacks, including those involving compromised IoT devices, will be more intense and frequent in 2017. The company, however, notes that embedded machine learning capabilities have the potential to protect devices (though, for example, detecting malware or suspicious or anomalous behavior) and ‘might help turn the tide against the growing wave of cyber-attacks’.

5 Jan 2017

The US Federal Trade Commission (FTC) filed a lawsuit against Taiwanese-based computer networking equipment manufacturer D-Link, alleging that ‘inadequate security measures taken by the company left its wireless routers and Internet cameras vulnerable to hackers and put U.S. consumers’ privacy at risk’. FCT argues that the company failed to ‘take reasonable steps to secure its routers and Internet Protocol (IP) cameras, potentially compromising sensitive consumer information, including live video and audio feeds from D-Link IP cameras’. According to the Commission, the action is part of its efforts to protect consumers’ privacy and security in the Internet of Things. D-Link later reacted saying it ‘denies the unwarranted allegations outlined in the FTC complaint and will vigorously defend the action’.

4 Jan 2017

The US Federal Trade Commission (FTC) has launched a competition inviting the public to create a technical solution that consumers can use to guard against security vulnerabilities in software found on the Internet of Things (IoT) devices in their homes. Participants in the ‘IoT Home Inspector Challenge’ are asked to develop a tool that would, at minimum, help protect consumers from security vulnerabilities caused by out-of-date software.

Pages

Cybersecurity is among the main concerns of governments, Internet users, technical and business communities. Cyberthreats and cyberattacks are on the increase, and so is the extent of the financial loss. 

Yet, when the Internet was first invented, security was not a concern for the inventors. In fact, the Internet was originally designed for use by a closed circle of (mainly) academics. Communication among its users was open.

Cybersecurity came into sharper focus with the Internet expansion beyond the circle of the Internet pioneers. The Internet reiterated the old truism that technology can be both enabling and threatening. What can be used to the advantage of society can also be used to its disadvantage.

 

Today, the cybersecurity framework includes policy principles, instruments, and institutions dealing with cybersecurity. It is an umbrella concept covering (a) critical information infrastructure protection (CIIP), (b) cybercrime, and (c) cyberconflict.

As a policy space, cybersecurity is in its formative phase, with the ensuing conceptual and terminological confusion. We often hear about other terms that are used without the necessary policy precision: cyber-riots, cyberterrorism, cybersabotage, etc. In particular, cyberterrorism came into sharper focus after 9/11, when an increasing number of cyberterrorist attacks were reported. Cyberterrorists use similar tools to cybercriminals, but for a different end. While cybercriminals are motivated mainly by financial gain, cyberterrorists aim to cause major public disruption and chaos.

Cybersecurity policy initiatives

Cybersecurity is tackled through various national, regional, and global initiatives. The main ones are described below.

At national level, a growing volume of legislation and jurisprudence deals with cybersecurity, with a focus on combating cybercrime, and more and more the protection of critical information infrastructure from sabotage and attacks as a result of terrorism or conflicts. It is difficult to find a developed country without some initiative focusing on cybersecurity.

At international level, the ITU is the most active organisation; it has produced a large number of security frameworks, architectures, and standards, including X.509, which provides the basis for the public key infrastructure (PKI), used, for example, in the secure version of HTTP(S) (HyperText Transfer Protocol (Secure)). The ITU moved beyond strictly technical aspects and launched the Global Cybersecurity Agenda. This initiative encompasses legal measures, policy cooperation, and capacity building. Furthermore, at WCIT-12, new articles on security and robustness of networks and on unsolicited bulk electronic communications (usually referred to as spam) were added to the ITRs.

A major international legal instrument related to cybersecurity is the Council of Europe’s Convention on Cybercrime, which entered into force on 1 July 2004. Some countries have established bilateral arrangements. The USA has bilateral agreements on legal cooperation in criminal matters with more than 20 other countries (Mutual Legal Assistance in Criminal Matters Treaties (MLATs)). These agreements also apply in cybercrime cases.

The Commonwealth Cybercrime Initiative (CCI) was given its mandate from Heads of government of the Commonwealth in 2011 to improve legislation and the capacity of member states to tackle cyber crime. Dozens of partners involved with CCI assist interested countries with providing scoping missions, capacity building programmes, and model law outlines in the fields of cybercrime and cybersecurity in general.

The G8 also has a few initiatives in the field of cybersecurity designed to improve cooperation between law enforcement agencies. It formed a Subgroup on High Tech Crime to address the establishment of 24/7 communication between the cybersecurity centres of member states, to train staff, and to improve state-based legal systems that will combat cybercrime and promote cooperation between the ICT industry and law enforcement agencies.

The United Nations General Assembly passed several resolutions on a yearly basis on ‘developments in the field of information and telecommunications in the context of international security’, specifically resolutions 53/70 in 1998, 54/49 in 1999, 55/28 in 2000, 56/19 in 2001, 57/239 in 2002, and 58/199 in 2003. Since 1998, all subsequent resolutions have included similar content, without any significant improvement. Apart from these routine resolutions, the main breakthrough was in the recent set of recommendations for negotiations of the cybersecurity treaty, which were submitted to the UN Secretary General by 15 member states, including all permanent members of the UN Security Council.

Events

Instruments

Conventions

Resolutions & Declarations

IPU Resolution on the Contribution of new information and communication technologies to good governance, the improvement of parliamentary democracy and the management of globalization (2003)
Wuzhen World Internet Conference Declaration (2015)

Standards

Recommendations

Other Instruments

2013 Report of the Group of Governmental Experts on Developments in the Field of Information and Telecommunications in the Context of International Security (2013)
2015 Report of the Group of Governmental Experts on Developments in the Field of Information and Telecommunications in the Context of International Security (2015)

Resources

Articles

Apple vs FBI: A Socratic Dialogue on Privacy and Security (2016)
The UN GGE on Cybersecurity: The Important Drudgery of Capacity Building (2015)

Publications

Internet Governance Acronym Glossary (2015)
An Introduction to Internet Governance (2014)

Papers

Expert and Non-Expert Attitudes towards (Secure) Instant Messaging (2016)
A Security Analysis of Emerging Web Standards. HTML5 and Friends, from Specification to Implementation (2012)

Reports

Technology, Media and Telecommunications Predictions 2017 (2017)
State of DNSSEC Deployment 2016 (2016)
Comparative analysis of the Malabo Convention of the African Union and the Budapest Convention on Cybercrime (2016)
Enabling Growth and Innovation in the Digital Economy (2016)
One Internet (2016)
Blue Skies Ahead? The State of Cloud Adoption (2016)
Cybersecurity Competence Building Trends (2016)
Automotive IoT Security: Countering the Most Common Forms of Attack (2016)
Stocktaking, Analysis and Recommendations on the Protection of CIIs (2016)
The Global Risks Report 2016 (2016)
Best Practice Forum on Establishing and Supporting Computer Security Incident Response Teams (CSIRT) for Internet Security (2015) (2015)
NI Trend Watch 2016 (2015)
OECD Digital Economy Outlook 2015 (2015)
Global Internet Report 2015 (2015)
Best Practices to Address Online, Mobile, and Telephony Threats (2015)
Global Cybersecurity Index & Cyberwellness Profiles (2015)
Security: The Vital Element of The Internet of Things (2015)
Cybersecurity Capacity Building in Developing Countries. Challenges and Opportunities (2015)
Riding the Digital Wave. The Impact of Cyber Capacity Development on Human Development (2014)
Best Practice Forum on Establishing and Supporting Computer Security Incident Response Teams (CSIRT) for Internet Security (2014) (2014)

Other resources

Security and Privacy Handbook: 100 Best Practices in Big Data Security and Privacy (2016)
The CEO's Guide to Securing the Internet of Things - Exploring IoT Security (2016)
GSMA IoT Security Guidelines (2016)
Combating Spam and Mobile Threats - Tutorials (2016)
Cyber Security Guidelines for Smart City Technology Adoption (2015)
Symantec 2015 Internet Security Threat Report (2015)
Security Guidance for Early Adopters of the Internet of Things (2015)
DNSSEC: Securing your Domain Names (2014)
Symantec Monthly Threat Report
M3AAWG Best Practices
DNSSEC Deployment Report

Processes

WSIS Forum 2016 Report

As the demands of ICT-related SDGs need to be met with capacity-building initiatives, cybersecurity was identified as one of the eight core digital skills people need in the twenty-first century. Internet Governance, Security, Privacy and the Ethical Dimension of ICTs in 2030 (session 150) suggested that the interpretation of vast amounts of information and big data that Internet of Things (IoT) will bring could result in an innovative multi-trillion-dollar economy. Examples of solutions that can both boost the economy and increase security were raised in From Cybersecurity to ‘Cyber’ Safety and Security (session 172); these included the use of social media for managing disasters. 

Ensuring trust in cyberspace through collaboration between governments, the industry, and users was outlined as fundamental for utilising economic opportunities necessary for fulfilling the SDGs during discussions in Action Line C5 (Building Confidence and Security in the Use of ICTs) - National Cybersecurity Strategies for Sustainable Development (session 120). Such cooperation in the area of cybersecurity, however, should be built on trust between the public and private sectors. A Trusted Internet Through the Eyes of Youth (session 151) warned that trust on the Internet is highly fragmented due to the diverse interests of stakeholders, and especially due to surveillance programmes. Multistakeholder dialogue and shaping policies by consensus were mentioned as ways to strengthen mutual trust.

When it comes to practical suggestions for improving cooperation in cybersecurity, panellists of session 120 also suggested cooperation in incident response that can include both compulsory and voluntary reporting on cyber-incidents. Session 170 on The Contribution IFIP IP3 Makes to WSIS SDGs, with an Emphasis on Providing Trustworthy ICT Infrastructure and Services invited companies to invest more in education, professionalism, and security. Providing good quality legal and technical information and data to decision-makers was added to the list of suggested measures by the discussants of session 172. 

Various emerging risks were also discussed in several sessions. Session 172 raised concerns about the emerging face of terrorism which increasingly uses new technologies including commercial drones. 

Session 150 warned that big data should be accompanied by ‘big judgment’ and awareness of communities of the risks of ‘uberveillance’ - becoming possible due to brain-to-computer interfaces (BCIs) and and sub-dermal implants - that can have an irreversible impact on society. On the other hand, session 120 commented on encryption as a useful concept that can enhance individual security, and suggested that law enforcement agencies can benefit greatly from other digital evidence. 

IGF 2015 Report

With a rise in cybercrime and a sharper focus on cybersecurity by policymakers worldwide, it is no surprise that the issue was discussed at great length during the IGF 2015. Cyberattacks, which are on the rise and are evolving with the growth in infrastructure, mobile money transfers, and social media, affect the economic growth and sustainable development of many countries. The real economic cost of cyberattacks is considerable. However, as the discussion during Managing Security Risks for Sustainable Development (WS 160) concluded, it was hard to identify and calculate the cost of each cyberattack due to multiple tangible and intangible effects, with one of the consequences being the limited availability of global statistics on cyberattacks.

With regard to cybersecurity strategies, the speakers made reference to the OECD’s recommendation on Digital Security Risk Management for Economic and Social Prosperity which seeks to ensure that risk management is considered an important facet when decisions are made on digital issues. They said, however, that existing cybersecurity strategies are too focused on technology and are missing the human element. In Commonwealth Approach on National Cybersecurity Strategies (WS 131), the speakers agreed that cybersecurity should be tackled by governments in partnership with the private sector, regulators, and other governments. It requires legal frameworks, the use of technology to enforce cybersecurity, harmonisation of regional laws, and cooperation among states to tackle cross-border cybercrime.

The issue of trust (as well as other issues, such as privacy and freedom of expression, which are discussed below) was a main theme that intersected with security. Discussed predominantly during the main session dedicated to Enhancing Cybersecurity and Building Digital Trust, the panel agreed that multistakeholder approaches and private-public partnerships should be used to address the challenges. ‘If you want total security, go to prison’, said one panellist. On the other hand, surveillance and censorship cannot be used to justify cybersecurity. Surprisingly, a panellist in Cybersecurity, Human Rights and Internet Business Triangle (WS 172) revealed that 80% of actionable intelligence comes from publically available resources.

The GIP Digital Watch observatory is a service provided by

 

in partnership with

 

and members of the GIP Steering Committee

 




 

GIP Digital Watch is operated by