he authors have drafted a multi-annual analysis, estimation, and trends assessment matrix for the evaluation of cybersecurity environment in Romania. Besides that, the matrix serves for building worst-case and best-case scenarios related to the cybersecurity in Romania. As their proposal is a beta-version, their work is intended for experts’ consideration and debate only. In summary, Mr. Nițu refines the initial and simplified method of analysis, estimation, and trends assessment established earlier by Mr. Popa. The indicators the authors proposed here were chosen based on a well balanced impact-relevance methodology and they are designed strictly for evaluation, feedback and scenario building purposes. The authors acknowledge some of them may be subject to ongoing change.

1. Combined Multi-Annual Analysis,
Estimation, and Trends Assessment
Method for Cybersecurity and
Cyberspace Governance RA
(non-technical proof of concept)
IONEL NITU, PHD
IULIAN POPA, PHD
NEW STRATEGY CENTER

4.  The lack of a harmonized national framework for cyber security
assessment (ref. ENISA, 2013)
 The lack of comprehensive methods to assess cyber threats
nationwide (ref. ENISA, 2013)
 Not only a matter of security, but governance also
 Assessment of cybersecurity and cyberspace governance in the
same time may prove difficult and time lasting
Assessment challenges

5. What for?
1. Standardized and harmonized framework for
assessment of cybersecurity and cyberspace
governance
2. Better implementation of lessons learned by countries
3. National level risk and opportunity management (both
security and governance)
4. Improved preparedness / readiness capacity, better
understanding
5. Practical and systematic estimation and trends
assessment (scenarios are developed upon a matrix
model, with limited lifecycle)
6. Better incident management

6. Matrix design / Indicators assessment
Quantitative and qualitative (hybrid approach), both security and governance:
Stage 1 (risk indicators assessment). Quantitative impact-likelihood assessment :
1. Cybersecurity – Technical Risk Indicators
2. Cybersecurity – Cooperation Risk Indicators (P2P, PPP, B2B)
3. Governance - Non-technical risk indicators (e.g. legal framework, plans, procedures and so on)
4. Governance – e-Government risk indicators
5. Governance – Human Assets Risk Indicators (e.q. cybersecurity culture, cybersecurity
education, awareness
Risk Multiplier
(1 – public safety, 2 -
national security)
Risk Indicator Name
Impact
(0 – 1, minor -
significant)
Likelihood
(0 – 1, low high)
1 Risk1 0.7 0.3
2 Risk2 0.5 0.5
… … … …
Total Risk Grade = (Risk Score 1 + Risk Score 2 + ... ) / (Multiplier 1 + Multiplier 2+...)
- Weighted average -

7. Matrix design
Stage 2
Establish the country risk profile (open to discussion)
Identify cybersecurity and cyberspace governance opportunities
Develop narratives and scenarios (3x3 assessment)
Stage 3
Policy recommendations and conclusion (actionable)

8. Scenarios
3
2
1
Significant
Moderate
Minor
(>36 months) (12-36months) (6-12 months)
IMPACT
LIKELIHOOD

9. Scenarios
Considerable
policy measures
required
Significant policy
measures and
close monitoring
required
Extensive policy
measures
required
Acceptable
monitored risks
Policy measures
worthwhile
Significant policy
measured required
Risks should be
accepted
Acceptable
monitored closely
risks
Considerable
policy measures
and monitored
risks required
Significant
Moderate
Minor
(>36 months) (12-36months) (6-12 months)
IMPACT
LIKELIHOOD

10. Country Risk Profile - Example
0
0.1
0.2
0.3
0.4
Cybersecurity Technical
Cybersecurity Cooperation
Governance Non-technicalGovernance e-Government
Governance Human Assets
2015 2016

11. Thank you!