Cybersecurity Day for Parliament
•Download as PPTX, PDF•
0 likes•85 views
Michael Goldsmith and I presented an overview of cybersecurity capacity building and current research findings for delegates from across the Commonwealth nations. The first section of slides introduces the Global Cyber Security Capacity Centre (GCSCC), and the second part presents a comparative analysis of the status and impact of capacity building.
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Cybersecurity Day for Parliament
Similar to Cybersecurity Day for Parliament (20)
More from Oxford Martin Centre, OII, and Computer Science at the University of Oxford
More from Oxford Martin Centre, OII, and Computer Science at the University of Oxford (20)
Recently uploaded
Recently uploaded (16)
Cybersecurity Day for Parliament
- 1. Cybersecurity Capacity Building: Lessons Learned Prof Michael Goldsmith – Co-Director and Senior Research Fellow Professor William H. Dutton – Oxford Martin Fellow Oxford Martin School, 18 February 2020
- 2. At the Heart of Oxford • A research programme at the Oxford Martin School • Part of the Cyber Security research network at the University of Oxford • Partnership and collaboration with the Department of Computer Science, Department of Sociology, Oxford Internet Institute, Said Business School and others
- 4. The 5 DIMENSIONS of Cybersecurity Capacity D 5 Standards Organisations, and Technologies D 3 Cybersecurity Education, Training and Skills D 1 Cybersecurity Policy and Strategy D 2 Cyber Culture and Society D 4 Legal and Regulatory Frameworks
- 5. Example: Dimension, Factors, and Aspects
- 6. Aspect 2 Indicator Q Indicator P Indicator O Indicator N Indicator M Indicator L Indicator K Indicator J Indicator I Indicator H Indicator G Indicator F Indicator E Indicator D Indicator C Indicator B Indicator A Start-up Formative Established Strategic Dynamic 5 STAGES of Maturity
- 7. Stakeholder clusters Academia, Civil Society groups & Internet Governance Criminal Justice & Law Enforcement Defence & Intelligence Community Government Ministries Legislators/Policy OwnersCSIRT and IT leaders (Government & Private) Critical National Infrastructure Private Sector & Businesses Cyber Task Force International Partners Stakeholder Clusters
- 8. Brazil Colombia Ecuador Jamaica + 2 Regional Studies by the OAS Botswana Burkina Faso Cabo Verde Cameroon Cote d’Ivoire The Gambia Ghana Lesotho Liberia Madagascar Bangladesh Bhutan Kyrgyzstan Indonesia Myanmar Thailand Sri Lanka Status: January 2020 Fiji Kiribati Micronesia Samoa Papua New Guinea Tonga Vanuatu Albania Armenia Bosnia & Herzegovina Cyprus Georgia Iceland Kosovo Lithuania Macedonia Montenegro Serbia Switzerland UK Over 80 National Cybersecurity Capacity Reviews Mauritius Namibia Niger Nigeria Senegal Sierra Leone Tunisia Uganda Zambia
- 9. Melbourne, Australia Cape Town, South Africa Cybersecurity Capacity Centre for Southern Africa Consortium of University of Cape Town, Research ICT Africa, the Norwegian Institute of International Affairs (NUPI) and the GCSCC Constellation of Regional Cybersecurity Capacity Research Centres
- 10. Lessons Learnt • Policy and Strategy: Misperception of the role of the CSIRT. • Culture and Society: Lack of awareness and of understanding of the relationship between trust/confidence and security. • Education and Training: Disconnect between educational offerings and industry needs. • Bada et al. (2018): study of 6 countries with lack of national programme for raising awareness, and low ICT literacy levels. The authors link low awareness to increasing cybercrime indicators. • Legal Frameworks: Question whether new cybercrime/cybersecurity legislation is needed or adapting existing law is sufficient. • Standards: Standards adoption (particularly ISO standards) mostly ad-hoc. • Overall: Lack of cooperation and information-sharing; resources; data collection challenges.
- 11. • Countries found the reviews informative and helpful in identifying previously under-considered capacity gaps. • Diverse stakeholder groups enables comprehensive picture in report development. • Review itself as capacity-building exercise and allowed discussions among different stakeholders. • Various lessons learned across all five dimensions of cybersecurity capacity. The Impact of a CMM Assessment
- 12. • There are cybersecurity challenges not reflected on the current CMM. • Workshop to discuss suggested changes and gather your feedback (this Thursday at Fitzroy Ballroom, Sofitel Melbourne on Collins). • The revised CMM will consider backwards comparability. • Research outputs. Revision of the CMM to Keep its Robustness
- 14. Research on Cybersecurity Capacity: 1. What is the status of capacity building? 2. What factors shape the development of capacity? 3. What are the implications of capacity building?
- 15. The Shaping and Impacts of Cyber Security Capacity Prof S. Creese‡, Dr P. Esteve-González*, Dr R. Shillair†, and Prof W.H. Dutton* ‡ Founding Director, GCSCC, University of Oxford * Oxford Martin Fellows, GCSCC, University of Oxford † Assistant Professor, Quello Centre, Michigan State University & GCSCC Research Associate
- 16. Research Model in Dutton et al. (2020)* *Dutton, W.H., Creese, S., Shillair, R., and Bada, M. (2020). Cybersecurity Capacity: Does It Matter? Journal of Information Policy, 9, 280-306. Diffusion (centrality) Indicators of Cyber Security Capacity Wealth End User Cyber Security Problems Size (scale) Scale
- 17. Data This study based on data from field research at the aspect level for 62 countries where the CMM was implemented (2015-2019). • 31 countries from CMM assessments – collection of data by field research (GCSCC and strategic & implementation partners). • 31 countries in IDB and OAS (2016)* – collection of data by an online survey. *Inter-American Development Bank and Organization of American States (2016). Cybersecurity. Are we ready in Latin America and the Caribbean? Cybersecurity Report 2016. Available at https://publications.iadb.org/en/cybersecurity-are-we-ready-latin- america-and-caribbean (25 June 2019, last accessed).
- 18. Region Obs. Income (WB) Obs. Africa 10 Low and lower-medium 22 America 31 Low: 6 Asia 6 Lower-medium: 16 Eastern Europe 5 Upper-medium 30 Europe 4 High 10 South Caucasus 2 Oceania 4 Total 62 Total 62 Countries in the Sample 62 countries where the CMM was applied (2015-2019)
- 19. The Cyber Security Capacity (CSC) Indicator Our strategy is to summarize the CMM data on the maturity stage of 47 aspects through an overall average maturity stage that we name Cybersecurity Capacity (CSC). • Factors’ average maturity stages were calculated from their corresponding aspects. • Dimensions’ average maturity stage were calculated from their corresponding factors. • CSC was calculated as the average maturity stage of all dimensions.
- 20. Alternative indicators Correlation with CSC (N) Global Cybersecurity Index (ITU) 0.61 (61) Networked Readiness Index (WEF) 0.76 (50) Secure Servers (Netcraft) 0.79 (61) Software Spending (Global Innovation Index) 0.53 (39) Cyber Security Capacity (CSC) related to other Cybersecurity Indicators Pearson’s correlation coefficients, number of observations in parentheses. All correlations have statistical significance <.001.
- 21. What is the status of cybersecurity capacity building?
- 22. Average Maturity Stage per Factor (N=62)
- 23. What factors are shaping capacity building within nations?
- 24. Results of Multivariate Regressions to Explain Cyber Security Capacity (CSC) Robust standard errors in parentheses. Symbols +, *, **, *** indicate, correspondingly, levels of significance at 0.1, 0.05, 0.01, 0.001. CSC Number of Users (log) 0.12*** (0.03) Percentage of Users 0.01** (0.00) GDP per capita (log) 0.14* (0.05) Constant -1.55** (0.51) N 62 R-Squared 0.67
- 26. What are the implications of capacity building for nations?
- 27. *p<.05; **p<.01; ***p<.001 Impact of CSC on End User Cyber Security Problems (Piracy and Encounter Rates) Figure 1: Cyber Security Capacity and Impact on Threats
- 28. *p<.05; **p<.01; ***p<.001 Impact of CSC on Use (Individual, Government, and Business Usage)
- 29. *p<.05; **p<.01; ***p<.001 Impact of CSC on Voice (Voice and Accountability)
- 30. • Mitigates end-user problems. • Fosters ICT adoption and usage. • Enhances citizens’ perception of freedom. Capacity Matters: the Impact of CSC
- 31. Conclusions
- 32. • Sample of nations indicates most nations in the early phases of capacity building. • Capacity shaped by the scale and centrality of the Internet and wealth of nations – a capacity divide • National choices on building capacity have implications for end-user problems, citizens’ perception of freedom, as well as the vitality of ICT adoption and usage. • Cybersecurity capacity needs to be prioritized in the political agenda to address needs to raise maturity and avoid inequalities across nations and regions. Cybersecurity Divide and Global Gap
- 33. THANK YOU! [EMAIL ADDRESS] @CapacityCentre Questions? https://www.linkedin.com/company/ global-cyber-security-capacity-centre/ www.oxfordmartin.ox.ac.uk/cybersecurity Department of Computer Science University of Oxford 15 Parks Road, Oxford, OX1 3QD, UK Phone: +44(0)1865 287903 cybercapacity@cs.ox.ac.uk
Editor's Notes
- Intro
- Dimension: The 5 dimensions represent the clusters of cybersecurity capacity through which the Capacity Centre analyses the nuances of capacity. They represent the different research ‘lenses’ through which cybersecurity capacity is studied. Accordingly, the most fundamental structure of the CMM is divided into dimensions, which consist of a number of factors. These five dimensions cover the broad expanse of areas that should be considered when seeking to enhance cybersecurity capacity. We recognise that these dimensions may overlap with one another on certain issues, and indeed the Capacity Centre hopes to understand the interdependences between cybersecurity capacities as it conducts more national capacity reviews. Within each dimension, there are several factors, aspects, stages of maturity, and indicators of cybersecurity capacity, each of which is defined as follows:
- CMM
- The GCSCC will work closely with the Local Host, who is made up of staff from the government organisation with which the agreement was drawn up, in organising the CMM review process. The Local Host is responsible to identify the relevant stakeholders and schedule consultations in coordination with the GCSCC. The following participants constitute several clusters of stakeholders, which should be invited to the consultations:
- We will make sure that the new version of the CMM is backward compatible with the previous version of the CMM.
- Come and see Cybil in the Basecamp Ask Cybil a question and win a bottle of Ginger Beer from Oxford Meet the Portal Advisory Group and give feedback to one of its members
- The GCSCC has developed the Cybersecurity Capacity Maturity Model for Nations (CMM) as a model to facilitate the assessment of the maturity of a country’s cybersecurity capacity. Developed in consultation with over two hundred international experts drawn from governments, international organisations, academia, public & private sectors and civil society, the CMM reviews cybersecurity capacity across five dimensions:
- The GCSCC has developed the Cybersecurity Capacity Maturity Model for Nations (CMM) as a model to facilitate the assessment of the maturity of a country’s cybersecurity capacity. Developed in consultation with over two hundred international experts drawn from governments, international organisations, academia, public & private sectors and civil society, the CMM reviews cybersecurity capacity across five dimensions:
- The GCSCC has developed the Cybersecurity Capacity Maturity Model for Nations (CMM) as a model to facilitate the assessment of the maturity of a country’s cybersecurity capacity. Developed in consultation with over two hundred international experts drawn from governments, international organisations, academia, public & private sectors and civil society, the CMM reviews cybersecurity capacity across five dimensions:
- The GCSCC has developed the Cybersecurity Capacity Maturity Model for Nations (CMM) as a model to facilitate the assessment of the maturity of a country’s cybersecurity capacity. Developed in consultation with over two hundred international experts drawn from governments, international organisations, academia, public & private sectors and civil society, the CMM reviews cybersecurity capacity across five dimensions:
- Before running the full model the multi-variable constructs were tested for validity and reliability. We used confirmatory factor analysis to test both the indicators of cybersecurity capacity and end user cyber security problems. The data satisfactorily passed the tests, indicating both the capacity indicators and the end user problems were reliable. Full details are in the paper since I don’t have time to go over those in depth here. The overall model was tested using structural equation methods (using SmartPLS- a partial least squares method of analysis). This helped us better see the impacts of the variables on each other. Again, further details of model strength and validity indicators are in the paper. In looking at scale- the total population and number of Internet users were closely tied together. No surprises there. And in looking at diffusion’s impact to investment in capacity- there is a strong positive relationship- with a beta of .437 The GDP per capita was also a and this generally carried through to a higher investment in the elements of cyber security capacity. The “ of Cyber Security Capacity” are the items that specifically address capacity that are a part of the investment by the nations that have a higher GDP per capita. So you can see that of the -.457 (beta) .370 (beta) can be accounted for by the cyber security capacity elements.
- Before running the full model the multi-variable constructs were tested for validity and reliability. We used confirmatory factor analysis to test both the indicators of cybersecurity capacity and end user cyber security problems. The data satisfactorily passed the tests, indicating both the capacity indicators and the end user problems were reliable. Full details are in the paper since I don’t have time to go over those in depth here. The overall model was tested using structural equation methods (using SmartPLS- a partial least squares method of analysis). This helped us better see the impacts of the variables on each other. Again, further details of model strength and validity indicators are in the paper. In looking at scale- the total population and number of Internet users were closely tied together. No surprises there. And in looking at diffusion’s impact to investment in capacity- there is a strong positive relationship- with a beta of .437 The GDP per capita was also a and this generally carried through to a higher investment in the elements of cyber security capacity. The “ of Cyber Security Capacity” are the items that specifically address capacity that are a part of the investment by the nations that have a higher GDP per capita. So you can see that of the -.457 (beta) .370 (beta) can be accounted for by the cyber security capacity elements.
- Before running the full model the multi-variable constructs were tested for validity and reliability. We used confirmatory factor analysis to test both the indicators of cybersecurity capacity and end user cyber security problems. The data satisfactorily passed the tests, indicating both the capacity indicators and the end user problems were reliable. Full details are in the paper since I don’t have time to go over those in depth here. The overall model was tested using structural equation methods (using SmartPLS- a partial least squares method of analysis). This helped us better see the impacts of the variables on each other. Again, further details of model strength and validity indicators are in the paper. In looking at scale- the total population and number of Internet users were closely tied together. No surprises there. And in looking at diffusion’s impact to investment in capacity- there is a strong positive relationship- with a beta of .437 The GDP per capita was also a and this generally carried through to a higher investment in the elements of cyber security capacity. The “ of Cyber Security Capacity” are the items that specifically address capacity that are a part of the investment by the nations that have a higher GDP per capita. So you can see that of the -.457 (beta) .370 (beta) can be accounted for by the cyber security capacity elements.
- The GCSCC has developed the Cybersecurity Capacity Maturity Model for Nations (CMM) as a model to facilitate the assessment of the maturity of a country’s cybersecurity capacity. Developed in consultation with over two hundred international experts drawn from governments, international organisations, academia, public & private sectors and civil society, the CMM reviews cybersecurity capacity across five dimensions:
- Last page option 1