![THANK YOU!
[EMAIL ADDRESS]
@CapacityCentre
Thank you for your attention J
https://www.linkedin.com/company/
global-cyber-security-capacity-centre/
www.oxfordmartin.ox.ac.uk/cybersecurity
Department of Computer Science
University of Oxford
15 Parks Road, Oxford, OX1 3QD, UK
Phone: +44(0)1865 287903
cybercapacity@cs.ox.ac.uk](https://image.slidesharecdn.com/gcscc-ocsc2020conferencemelbourne-200218043838/85/Lessons-Learned-from-Implementing-the-Cybersecurity-Capacity-Maturity-Model-for-Nations-CMM-35-320.jpg)
Lessons Learned from Implementing the Cybersecurity Capacity Maturity Model for Nations (CMM)
- 1. Lessons Learned from Implementing the CMM Prof Michael Goldsmith – Co-Director and Senior Research Fellow Dr Patricia Esteve-González – Research Fellow 2020 Global Cybersecurity Capacity Building Conference Melbourne, 18 February 2020
- 2. At the Heart of Oxford • A research programme at the Oxford Martin School • Part of the Cyber Security research network at the University of Oxford • Partnership and collaboration with the Department of Computer Science, Department of Sociology, Oxford Internet Institute, Said Business School and others
- 4. The 5 DIMENSIONS of Cybersecurity Capacity D 5 Standards Organisations, and Technologies D 3 Cybersecurity Education, Training and Skills D 1 Cybersecurity Policy and Strategy D 2 Cyber Culture and Society D 4 Legal and Regulatory Frameworks
- 5. Example: Dimension, Factors, and Aspects
- 6. Aspect 2 Indicator Q Indicator P Indicator O Indicator N Indicator M Indicator L Indicator K Indicator J Indicator I Indicator H Indicator G Indicator F Indicator E Indicator D Indicator C Indicator B Indicator A Start-up Formative Established Strategic Dynamic 5 STAGES of Maturity
- 7. Stakeholder clusters Academia, Civil Society groups & Internet Governance Criminal Justice & Law Enforcement Defence & Intelligence Community Government Ministries Legislators/Policy OwnersCSIRT and IT leaders (Government & Private) Critical National Infrastructure Private Sector & Businesses Cyber Task Force International Partners Stakeholder Clusters
- 8. Brazil Colombia Ecuador Jamaica + 2 Regional Studies by the OAS Botswana Burkina Faso Cabo Verde Cameroon Cote d’Ivoire The Gambia Ghana Lesotho Liberia Madagascar Bangladesh Bhutan Kyrgyzstan Indonesia Myanmar Thailand Sri Lanka Status: January 2020 Fiji Kiribati Micronesia Samoa Papua New Guinea Tonga Vanuatu Albania Armenia Bosnia & Herzegovina Cyprus Georgia Iceland Kosovo Lithuania Macedonia Montenegro Serbia Switzerland UK Over 80 National Cybersecurity Capacity Reviews Mauritius Namibia Niger Nigeria Senegal Sierra Leone Tunisia Uganda Zambia
- 9. Melbourne, Australia Cape Town, South Africa Cybersecurity Capacity Centre for Southern Africa Consortium of University of Cape Town, Research ICT Africa, the Norwegian Institute of International Affairs (NUPI) and the GCSCC Constellation of Regional Cybersecurity Capacity Research Centres
- 10. Lessons Learnt • Policy and Strategy: Misperception of the role of the CSIRT. • Culture and Society: Lack of awareness and of understanding of the relationship between trust/confidence and security. • Education and Training: Disconnect between educational offerings and industry needs. • Bada et al. (2018): study of 6 countries with lack of national programme for raising awareness, and low ICT literacy levels. The authors link low awareness to increasing cybercrime indicators. • Legal Frameworks: Question whether new cybercrime/cybersecurity legislation is needed or adapting existing law is sufficient. • Standards: Standards adoption (particularly ISO standards) mostly ad-hoc. • Overall: Lack of cooperation and information-sharing; resources; data collection challenges.
- 11. • Countries found the reviews informative and helpful in identifying previously under-considered capacity gaps. • Diverse stakeholder groups enables comprehensive picture in report development. • Review itself as capacity-building exercise and allowed discussions among different stakeholders. • Various lessons learned across all five dimensions of cybersecurity capacity. The Impact of a CMM Assessment
- 12. • There are cybersecurity challenges not reflected on the current CMM. • Workshop to discuss suggested changes and gather your feedback (this Thursday at Fitzroy Ballroom, Sofitel Melbourne on Collins). • The revised CMM will consider backwards comparability. • Research outputs. Revision of the CMM to Keep its Robustness
- 13. Research on Cybersecurity Capacity 1. What is the status of cybersecurity capacity building? 2. What factors are shaping capacity building within nations? 3. What are the implications of capacity building for nations?
- 14. The Shaping and Impacts of Cyber Security Capacity Prof S. Creese‡, Dr P. Esteve-González*, Dr R. Shillair†, and Prof W.H. Dutton* ‡ Founding Director, GCSCC, University of Oxford * Oxford Martin Fellows, GCSCC, University of Oxford † Assistant Professor, Quello Centre, Michigan State University & GCSCC Research Associate
- 15. Research Model in Dutton et al. (2020)* *Dutton, W.H., Creese, S., Shillair, R., and Bada, M. (2020). Cybersecurity Capacity: Does It Matter? Journal of Information Policy, 9, 280-306. Diffusion (centrality) Indicators of Cyber Security Capacity Wealth End User Cyber Security Problems Size (scale) Scale
- 17. Data This study considers granulated data at the aspect level for 62 countries where the CMM was implemented (2015-2019). • 31 countries from CMM assessments – collection of data by field research (GCSCC and strategic & implementation partners). • 31 countries in IDB and OAS (2016)* – collection of data by an online survey. *Inter-American Development Bank and Organization of American States (2016). Cybersecurity. Are we ready in Latin America and the Caribbean? Cybersecurity Report 2016. Available at https://publications.iadb.org/en/cybersecurity-are-we-ready-latin- america-and-caribbean (25 June 2019, last accessed).
- 18. Region Obs. Income (WB) Obs. Africa 10 Low and lower-medium 22 America 31 Low: 6 Asia 6 Lower-medium: 16 Eastern Europe 5 Upper-medium 30 Europe 4 High 10 South Caucasus 2 Oceania 4 Total 62 Total 62 Countries in the Sample 62 countries where the CMM was applied (2015-2019)
- 19. The Cyber Security Capacity Variable (CSC) Our strategy is to summarize the CMM data on the maturity stage of 47 aspects through an overall average maturity stage that we name Cybersecurity Capacity (CSC). • Factors’ average maturity stages were calculated from their corresponding aspects. • Dimensions’ average maturity stage were calculated from their corresponding factors. • CSC was calculated as the average maturity stage of all dimensions.
- 20. Alternative indicators Correlation with CSC (N) Global Cybersecurity Index (ITU) 0.61 (61) Networked Readiness Index (WEF) 0.76 (50) Secure Servers (Netcraft) 0.79 (61) Software Spending (Global Innovation Index) 0.53 (39) Cyber Security Capacity (CSC) related to other Cybersecurity Indicators Pearson’s correlation coefficients, number of observations in parentheses. All correlations have statistical significance <.001.
- 21. What is the status of cybersecurity capacity building?
- 22. Average Maturity Stage per Factor (N=62)
- 23. Methodology We consider 2 statistical methods to test the model: 1. OLS regressions with heteroskedasticity-robust errors. 2. Structural equation modelling and path analysis. Using SmartPLS: Ringle, C. M., Wende, S., and Becker, J.-M. 2015. "SmartPLS 3." Boenningstedt: SmartPLS GmbH, http://www.smartpls.com The results under both methodologies are consistent.
- 24. What factors are shaping capacity building within nations?
- 25. OLS to explain Cyber Security Capacity (CSC) Robust standard errors in parentheses. Symbols +, *, **, *** indicate, correspondingly, levels of significance at 0.1, 0.05, 0.01, 0.001. CSC Number of Users (log) 0.12*** (0.03) Percentage of Users 0.01** (0.00) GDP per capita (log) 0.14* (0.05) Constant -1.55** (0.51) N 62 R-Squared 0.67
- 27. What are the implications of capacity building for nations?
- 28. *p<.05; **p<.01; ***p<.001 Impact of CSC on End User Cyber Security Problems (Piracy and Encounter Rates) Figure 1: Cyber Security Capacity and Impact on Threats
- 29. *p<.05; **p<.01; ***p<.001 Impact of CSC on Use (Individual, Government, and Business Usage)
- 30. *p<.05; **p<.01; ***p<.001 Impact of CSC on Voice (Voice and Accountability)
- 31. OLS to Explain the Impact of CSC Robust standard errors in parentheses. Symbols +, *, **, *** indicate, correspondingly, levels of significance at 0.1, 0.05, 0.01, 0.001. Piracy Encount. Rates NRI: Ind. usage NRI: Bus. usage NRI: Gov. usage Voice & account. CSC -17.77* -5.23 0.51* 0.52+ 0.85** 0.58* (7.23) (5.17) (0.22) (0.26) (0.29) (0.23) Number of Users -0.58 2.24* -0.02 -0.04 0.00 -0.17** (log) (1.07) (0.87) (0.05) (0.04) (0.06) (0.04) Percent. of Users -0.07 -0.25+ 0.03*** -0.01 0.01 -0.01+ (0.14) (0.14) (0.01) (0.00) (0.01) (0.00) GDP per capita -3.52 3.52 0.15 0.23* -0.10 0.34** (log) (4.23) (3.58) (0.14) (0.11) (0.15) (0.11) Constant 146.78*** -18.83 -0.06 1.61+ 2.62* -0.79 (36.23) (28.95) (1.04) (0.89) (1.19) (0.97) N 34 35 50 50 50 62 R-Squared 0.71 0.43 0.87 0.44 0.43 0.64
- 32. • Mitigates end user problems. • Fosters ICT adoption and usage. • Enhances citizens’ perception of freedom. Capacity Catters: the Impact of CSC
- 33. Conclusions
- 34. • Nations in the sample are in the early phases of capacity building. • Capacity shaped by the scale and diffusion of the Internet along with the wealth of nations. • National choices on building capacity have implications for end-user problems, citizens’ perception of freedom, as well as the vitality of ICT adoption and usage. • Cybersecurity capacity needs to be prioritized in the political agenda to address the cybersecurity global gap. Cybersecurity Divide and Global Gap
- 35. THANK YOU! [EMAIL ADDRESS] @CapacityCentre Thank you for your attention J https://www.linkedin.com/company/ global-cyber-security-capacity-centre/ www.oxfordmartin.ox.ac.uk/cybersecurity Department of Computer Science University of Oxford 15 Parks Road, Oxford, OX1 3QD, UK Phone: +44(0)1865 287903 cybercapacity@cs.ox.ac.uk