International and Regional Cyber Security Initiatives Michele G

International and Regional Cyber Security Initiatives Michele G. Markoff Coordinator International Critical Infrastructure Protection U. S. Department of State

THE CHALLENGE u u Potential consequences of attacks on national and global critical information infrastructures not well understood Disruption of key allied infrastructures can have tangible security consequences for the U. S.

THE FORECAST u u As reliance on information networks increases, and attacks tools become more sophisticated, potential for devastating damage to critical infrastructures increases Physical attacks will become more frequent and potentially more disruptive

US GOALS/STRATEGY GOAL: Shape the international environment to reduce the risk to critical US and global information infrastructures on which the US and its allies depend. STRATEGY: Pursue cross-sector bilateral and multilateral cooperation that has tangible benefits to US national security.

ACT NATIONALLY, COOPERATE INTERNATIONALLY All nations need to take systematic domestic and international steps to enhance the security of their networked critical information infrastructures

THE CASE FOR INTERNATIONAL COOPERATION 1. 2. 3. Going it alone won’t work: We’re only as secure as the least secure among us Cascading international failures can have national security consequences : Need to address direct and indirect foreign interdependencies As more nations cross the “digital divide, ” threat more unpredictable

MULTIFACETED COLLABORATION u u u Modernize legal frameworks, enhance law enforcement capabilities, transborder cooperation Establish a national Point of Contact Establish 24/7 warning and incident response capability Inculcate “Culture of cybersecurity” – education and awareness aimed at prevention/security Understanding that government may lead, but public-private partnership essential

u u u US INVOLVEMENT IN REGIONAL INITIATIVES G-8 UN General Assembly Resolutions Asia Pacific Economic Cooperation Forum (APEC) Organization of Economic Cooperation and Development (OECD) Organization of American States (OAS) UN/ITU – World Summit for the Information Society)

G-8 INITIATIVES w HIGH TECH CRIME GROUP – work is basis for current initiatives in COE, UNGA, APEC, OAS, WSIS 1997 - Cyber Crime principles 2003 - CIP principles

UNGA RESOLUTIONS w 55/63 and 56/121: “Combating the Criminal Misuse of Information Technology” w 57/239: “Creation of a Global Culture of Cybersecurity” w UNGA 58 – US will present resolution based on 2003 G-8 Principles “Protecting Critical Information Infrastructures”

OECD NETWORK SECURITY GUIDELINES w 2002 Update of longstanding network security guidelines - Details how all levels of civil society should implement security in a manner appropriate to their roles w Provides basis for 2002 UNGA Resolution w Currently working on implementation guidelines

ORGANIZATION OF AMERICAN STATES (OAS) w JUNE 2003 - OAS General Assembly Resolution 1939, “Development of an Inter-American Strategy to Combat Threats to Cybersecurity” w Builds on work of 3 OAS committees: telecom, counter-terrorism and legal – Directs the development of a cybersecurity strategy for OAS member states – July 2003 Cybersecurity Conference in Buenos Aires began discussion of strategy

APEC TEL CYBERSECURITY STRATEGY 1. Developed by APEC Telecommunications and Information Working Group (TEL) 2. APEC strategy first to commit to concrete steps for regional cybersecurity cooperation 3. Builds on principles outlined in UNGA Res 55/63) and OECD (Network Security Guidelines) 4. Approved at APEC Ministerial, October 2002

APEC TEL CYBERSECURITY STRATEGY 2 w Comprehensive and modernized legal frameworks w Cyber incident information-sharing (APCERT) and law enforcement cooperation w Development of IT security and technical guidelines w Strengthening regional public awareness of cybersecurity w Increased training and education opportunities w Examination of wireless security issues

UN/ITU WSIS 1. World Summit on the Information Society (WSIS) agenda – December 10 -12 Geneva - US has introduced language on cyber security, leverages OECD Guidelines and new G-8 principles on cybersecurity - Many unhelpful proposals being submitted - Working to ensure final declaration provides a general guide for the international community – oppose new conventions other than COE

CONCLUSION 1. No nation will be secure until every nation takes systematic steps to enhance the security of its critical networked information systems and inculcate a culture of cybersecurity in its citizens 2. All nations need to cooperate internationally, sharing information, experiences and expertise in prevention of cyber attacks, and in prosecution of perpetrators if prevention fails.

CONTACT INFORMATION Michele Markoff Coordinator for International Critical Infrastructure Protection US Department of State (202) 736 -4020 email: Markoff. MG@T. State. gov