CSS CYBER DEFENSE National Cybersecurity Strategies In
Total Page:16
File Type:pdf, Size:1020Kb
CSS CYBER DEFENSE National Cybersecurity Strategies in Comparison – Challenges for Switzerland Zurich, March 2019 Center for Security Studies (CSS), ETH Zürich Authors: Marie Baezner, Sean Cordey Additional research: Matteo Bonfanti, Robert Dewar, Jasper Frei and Fabien Merz Layout: Miriam Dahinden-Ganzoni © 2019 Center for Security Studies (CSS), ETH Zürich Contact: Center for Security Studies Haldeneggsteig 4 ETH Zürich CH-8092 Zürich Switzerland Tel.: +41-44-632 40 25 [email protected] www.css.ethz.ch This research was ordered by the Federal IT Steering Unit (FITSU) Analysis prepared by Center for Security Studies (CSS), ETH Zürich ETH-CSS project- and quality management: Myriam Dunn Cavelty, Deputy Head for Research and Teaching; and Andreas Wenger, Director of the CSS. Disclaimer: The opinions presented in this study exclusively reflect the authors’ views. Please cite as: Baezner, Marie; Cordey, Sean (2019): National Cybersecurity Strategies in Comparison – Challenges for Switzerland, March 2019, Center for Security Studies (CSS), ETH Zürich. Contents Synopsis 4 Contents 5 Cybersecurity strategies in comparison 7 Core documents and their development 8 Roles and Responsibilities 9 Relationships between the civilian and military domains 10 Cybersecurity in the armed forces 10 The role of intelligence services 11 Law enforcement 11 Main challenges 12 1) Integration (vertical) 12 2) Coordination (horizontal) 12 3) International cooperation 12 4) Crisis management 13 5) Situation analysis 13 6) Education, information and capacity-building 13 7) Public-private partnerships 13 8) Legislation and regulation 14 Conclusion and challenges for Switzerland 15 Annex 17 Country information Finland 17 Country information France 20 Country information Germany 23 Country information Israel 26 Country information Italy 28 Country information Netherlands 31 National Cybersecurity Strategies in Comparison – Challenges for Switzerland Synopsis tasked with cybersecurity matters, in particular the challenge of finding the right balance between Digital transformation, which is emerging as one of the centralization and reliance on existing competences; major challenges of future years, offers not only wide- ranging advantages, but also harbors new risks and en- • the promotion of international cooperation and the genders new vulnerabilities. A majority of states has be- establishment of international norms of conduct in gun to address these by developing national strategies an environment in which geopolitical fault lines have under the heading of ‘cybersecurity’. Switzerland pub- deepened; lished its second ‘National Strategy for the protection of Switzerland against cyber risks’ (NCS), which identifies • the creation of sound, resilient structures for crisis main challenges, traces responsibilities and outlines fu- management, including efficient crisis communica- ture action, in 2018. This study compares the cybersecu- tions, and the development of a strong ability to rity strategies adopted by Germany, Finland, France, Isra- respond to serious incidents which takes this commu- el, Italy and the Netherlands in order to place the Swiss nications aspect into account; approach within a broader international context and elic- it the most important future challenges through compar- • the development of an adequate situation analysis ison. and a precise analysis of threats, both of which must It focuses on key strategies, describing main actors resist exaggerated assessments of cyber threats and their tasks (in particular the distribution of tasks be- despite the difficulty of collecting reliable data; tween civilian and military authorities in the fields of ‘se- curity’, ’defense’ and ‘law enforcement’), and identifying • the building of capacities and the design of future the general challenges for organizing national cybersecu- education and training programmes to address rity policies. shortages of specialist cybersecurity staff; The cybersecurity strategies examined share a number of common conceptual elements. Six central as- • the development of a framework for cooperation with pects have in particular been found across all of the the private sector which promotes national security states in the study: a holistic approach which encom- without hampering innovation; and passes both national security and socioeconomic as- pects; links to broader national security strategies; a cen- • the harmonization of laws and efficient strategies for tral focus on developing defensive cyber capabilities; fighting cybercrime.. great appreciation of international cooperation; empha- sis on the necessity of cooperating with the private sec- Switzerland is also exposed to these challenges. If a small, tor; and finally the need for greater awareness, education wealthy state such as Switzerland wishes to secure its fu- and information. ture in a digital world, it should ensure that it invests ad- The most important differences between the ex- equately in cybersecurity without excessively expanding amined states lie in where cybersecurity is positioned the reach and role of government. This requires all parts within the context of government structures, and who of government to work towards the same overarching bears which responsibilities. This relates to the extent of goal. At the same time, capacity-building and the design centralization, the relationship between civilian and mili- of education and training programmes likely constitute tary forces, and the tasks of intelligence and law enforce- the most productive approach. ment services. These differences arise predominantly out of the states’ distinct political cultures and ways of orga- nizing their political systems. Given the global nature of cyber threats, compa- rable states are confronted with comparable challenges when developing, implementing and maintaining their cybersecurity strategies. We have identified eight chal- lenges: • the (vertical) integration of national cybersecurity with national security and/or an overall strategy for controlling national resources as efficiently as possible; • the (horizontal) coordination of different bodies 4 National Cybersecurity Strategies in Comparison – Challenges for Switzerland Introduction • Israel All over the world, countries endeavor to shape digital • Italy and transformation processes to obtain optimal benefit from this technologically controlled change for their societies. • the Netherlands However, the spread of digital technologies also entails risks. Their technical substructure is insecure due to tech- This comparison focuses mainly on: nical, economic and political factors, and prone to being exploited for criminal or political purposes. Spectacular, a) the nature and substance of core strategies; criminally motivated cybercrime and the strategic use of cyberspace have become an everyday reality in a world b) the roles and responsibilities of main actors and where the number of attractive targets is growing and cy- bodies (law enforcement, military, intelligence bercrime abilities and competences are becoming more services and civilian bodies), and and more sophisticated due to high demand. It is therefore imperative that the challenges of cy- c) the challenges these states are exposed to in terms of bersecurity be met if the digital transformation is to be cybersecurity. successful. As a result, most states are reviewing their cy- bersecurity strategies to ensure that they are better pre- This study is mainly based on primary sources, such as pared for the risks which are emerging in a more and publicly available national cybersecurity and cyber de- more closely networked and at the same time more and fense strategies, and secondary sources such as media ar- more politicized and militarized environment. The chal- ticles and scientific research. All of the documents relied lenges which need to be met are not exclusively technical on are publicly available. However, it is important to un- in nature: Largescale economic and political cyberespio- derstand the context and goals of these documents, nage, strategic interference campaigns and threats to which are subject to certain constraints: critical infrastructures of national significance are all is- sues relevant to security policy. • First, many national cybersecurity strategies in fact However, the precise role governments and ad- provide very little information about states’ actual ministrations play in cybersecurity must be elicited and levels of preparedness or relevant activities, in carefully defined through a political process. Critical in- particular as far as national security and defense are frastructures are mainly held by private actors. Cyber- concerned. Strategies are, above all, declarations of space can be viewed as a common good whose dynamics intent, which set and signal the future direction of and use are shaped by an entire ecosystem of state and the national cybersecurity agenda for a highly diverse non-state actors. There is no single solution able to re- internal/domestic and external/international solve all cybersecurity problems – given the numerous audience. Germany and France have sector-specific risks associated with digital technologies, the definition implementation plans (i.e. for IT in administration of responsibilities and the planning of resource alloca- and for the private sector), while the Dutch imple- tions are complex, demanding political tasks. mentation plan is still being drafted. Israel does not Switzerland published its second ‘National