EU Cyber Resilience for Development Cyber4Dev

Summary

Cyber4Dev is an EU-funded programme focused on supporting the development of Cyber Resilience in nine priority partner countries, plus additional associate countries, around the world.  It focuses on: strengthened cybersecurity policy, strategy, and coordination frameworks; incident response capabilities; and fostering networks of cyber expertise and co-operation.

Details

Aim

The objective of Cyber4Dev is to increase the cyber resilience of Partner Countries while promoting an inclusive multi-stakeholder and rights based approach and ensuring compliance with the rule of law and good governance principles to allow citizens of developing countries the digital dividends of an open, free, secure and resilient cyberspace.

Context

Cyber Resilience for Development (Cyber4Dev) is an EU funded project of a duration of 66 months in a number of countries in Asia, Africa and Latin America. The project is delivered by NI-CO (Northern Ireland Cooperation Overseas) in partnership with government agencies from Estonia, the United Kingdom and the Netherlands.

The project operates globally, with 9 priority countries and additional associate countries in which training or activity has taken place.

In Africa:

• Botswana (priority)
• Mauritius (priority)
• Rwanda (priority)
• Congo-Brazzaville
• Gambia
• Malawi
• Mozambique
• Seychelles

In Asia:

• Cambodia (priority)
• Lao PDR (priority)
• Sri Lanka (priority)
• Bangladesh
• Indonesia
• Maldives
• The Philippines
• Singapore

In the Americas:

• Costa Rica (priority)
• Dominican Republic (priority)
• Ecuador (priority)
• Antigua & Barbuda
• Barbados
• Belize
• Chile
• Dominica
• Guyana
• Paraguay
• Trinidad and Tobago

In Middle East North Africa:

• Lebanon

Shortly after its launch, Cyber4Dev was recognised by the Global Forum Cyber Expertise (GFCE) as an important initiative that multiple GFCE members are collaborating to deliver.  Further details are available on the GFCE website.

Cyber4Dev structures its activities under three pillars:

1. Strengthened Cybersecurity Policy, Strategical, and Coordination Frameworks

2. Increasing Cybersecurity Incidence Response Capabilities

3. Fostering Networks of Cyber Expertise and Co-operation)

Outcomes

• Countries will have increased political will to act on cybersecurity;
• Countries are supported to devise a new cybersecurity strategy or supported in starting implementing an existing strategy;
• Countries will have established democratic and inclusive multi-stakeholder governance structures for developing and implementing a cybersecurity strategy;
• Countries/regions will have stronger, more effective collaborative relationships on cybersecurity and incident handling;
• Countries/regions will have improved CSIRT capability and more effective collaborative relationships with the EU for information sharing and incident response;
• Countries will have improved coordination between authorities in charge of cybersecurity and cybercrime;
• Countries will have included measures to protect human rights, rule of law and vulnerable individuals within their cybersecurity strategies/policies/laws;
• EU trading partners will have improved cybersecurity and better conditions for growth;
• The EU is supported to counter cyber threats and foster the cyber resilience of the EU and its partners.

Outputs

As a project which provides high level practical and strategic support to our partner countries, it has been pleased to have delivered holistic and wide ranging support to colleagues across the globe.

Through the eployment of a comprehensive raining prospectus, over the course of the project to date, training to over 7,500 people through over 235 individual activities have been delivered accross three main pillars.

In addition to this, it has engaged with over 380 public institutions and 284 private organisations through a range of stakeholder activities.

Activities

RECENT ACTIVITIES IN LATIN AMERICA AND THE CARIBBEAN

Dominican Republic: Component 1: Strengthened Cybersecurity Policy, Strategical, and Coordination Frameworks

• Scoping visit in November 2019 to project activities
• IT Risk Assessment training (2 sessions – public and private sector reps) in January 2020
• CISRT-RD SIM3 assessment
• Signature of MoU for cooperation between the Ministry of President of the Dominican Republic and Cyber4Dev in March 2020
• Support in drafting of the Cybersecurity Law from January-July 2020
• Online workshop on practicalities of establishing a Cyber Diplomacy Division at the MFA in May 2020
• Online workshop on secure digital ID in May 2020
• Support to the National Cybersecurity Centre (CNCS) in drafting of national awareness strategy and action plan
• Cybersecurity Preparedness and Crisis Management online training delivered in November 2020
• Digital Transformation online workshops were carried out in November and December 2020.
• On-site mission in January 2021 with multiple workshops focusing on Communication Strategy development, preparation for the National Cyber Exercise “Cyber Llamas 2021”, crisis management and response plan, and crisis communications.
• Technical workshops carried out for INDOTEL and OGTIC and their constituency, covering secure data exchange and secure digital ID topics in relation to the DR Digital transformation program in January 2021.
• Development of a National Cybersecurity Communication strategy in April 2021 to support the implementation of National Cybersecurity Strategy with regard to education and awareness campaigns both for the public sector and for the wider public.
• First national cyber emergency management table-top exercise “CyberLlamas 2021” was organised on in May 2021. The aim of the exercise was to bring together the National Cybersecurity Council, led by the vice minister of the Digital Agenda and other senior politicians and officials to rehearse strategic level decision-making according to arrangements detailed in the National Cyber Strategy in case of a large-scale cyber-attack. A comprehensive report of the exercise was drafted including concrete proposals for a way ahead. The results of the exercise have been discussed through with the CNCS and adequate trainings to fill in the identified gaps have been suggested and taken into our work plan.
• IT risk assessment training to the financial sector in August 2021
• Study visit to Estonia in September 2021 of a high-level delegation from the Dominican Republic representing the National cybersecurity Centre (CNCS), the National Institute of the Telecommunications (INDOTEL) and the Government Office of Information and Communication Technologies (OGTIC) to learn from the Estonian experience of organising cyber security, secure data exchange and secure digital identity. The 5-day study visit programme involved meetings and engagements with key players from the cyber security perspective of both public and private sector:
• Crisis Preparedness and Management 3-day online training for Financial Sector in September 2021.
• Co-organisation of the regional conference on cybersecurity to Internet Service providers in the Latin America and Caribbean region in October 2021 in cooperation with Indotel and EU CyberNet. Cyber4Dev was responsible of organising several sessions of the conference: cybersecurity policy good practices from Latin America; IT risk management and Cybersecurity baseline standards; data protection panel; introduction to the Critical Information Infrastructure Protection; CISO training: “Information security – what, why and how”.
• 3-day workshop on Critical Information Infrastructure Protection (CIIP) methodology and CII identification in October 2021 for key public and private sector to deepen their knowledge and awareness on CII and the need to identify vital services and apply to them specific measures on cybersecurity. Continuous mentoring on the CIIP in December and January 2022 to develop for CNCS a work plan on identifying critical services for the Dominican Republic.
• Revision on as-is basis the draft of the national cyber security strategy of the Dominican Republic and advise the CNCS on the recommendations drawing on EU models in November 2021.
• Revision of the Data Protection Draft law to make it compliant with the provisions of the General Data Protection Regulation of the EU (2016/679) in November and December 2021.
• In collaboration with EU CyberNet, the National Cybersecurity Strategy Implementation seminar in May 2022 to national cybersecurity stakeholders to help the national authorities to draft the National Cybersecurity Action Plan for NCS 2030.

Dominican Republic: Component 2: Increasing Cybersecurity Incidence Response Capabilities

• Multiple SIM3 assessment reviews over the course of September to December 2020 were carried out with recommendations to raise the levels of maturity in specific model parameters for CSIRT-RD for joining the Forum of Incident Response and Security Teams (FIRST) in December 2020.
• An introductory online course on MISP (an open source threat sharing platform) was delivered for the CSIRT-RD constituency in December 2020.
• MISP online configuration support was delivered in February 2021 for CSIRT-RD.
• Technical onsite training mission with more focus on the CSIRT-RD in April 2021. During the mission, the Advanced CSIRT Management Training, the Worldwide CSIRT system and advanced CSIRT technical training were carried out. Second week technical training was focused on the technical capability building on incident handling, technical artefact handling, vulnerability management and awareness building.
• In collaboration with the OAS, six technical trainings for CSERTs were organised between April and June 2021 where members of CERT-RD participated (5 participants).
• Mentoring and technical advisory on secure data exchange and interoperability mechanisms between different databases of the Dominican Republic in August and September 2021.
• Visit of the Estonian National CERT (CERT-EE) and briefing given by the head of CERT regarding their internal organisation and cooperation with other stakeholders in September 2021 during the study visit.
• Technical on-site assistance to Dominican Republic’s national CSIRT and financial CSIRT on maintaining and using the MISP platform (Malware Information Sharing Platform) in October 2021.
• On-site workshop on the use of open source tools in threat identification and threat handling delivered during the Regional Conference on cybersecurity to Internet Service providers in October 2021.
• MISP training for Defence CERT in March 2022.
• Training on Detecting compromise and Understanding Exploits 1 and 2 to financial sector in May 2022.

Dominican Republic: Component 3: Fostering Networks of Cyber Expertise and Cooperation

• Assistance to CISRT-RD in compiling a membership application documentation to join FIRST. CERT-EE and INCIBE-CERT agreed to become the 2 sponsors of the application. CISRT-RD joined FIRST in December 2020.
• Study visit to Estonia from 25 September to 1 October 2021 of a high-level delegation from the Dominican Republic to foster EU-Dominican Republic relations and personal contacts between project partners.
• Co-organisation of the regional conference on cybersecurity to Internet Service providers in the LAC region on 19-21 October in cooperation with Indotel and EU CyberNet in the Dominican Republic to foster relationships and community building between different countries of the region. Cyber4Dev sponsored and facilitated the participation of 8 persons from our priority and association countries of the region (Ecuador, Trinidad and Tobago, Belize and Guyana) Representatives from Antigua and Barbuda and Dominica participated virtually.
• Co-organisation of a practical and hands-on 4-day regional training on Designing and Executing Cybersecurity Exercises in the Caribbean region for 8 English-speaking countries on 17-20 January 2022 in the Dominican Republic. This joint EU Cyber4Dev-EU CyberNet Regional on-site training had active participation from 8 different Caribbean countries. Cyber4Dev facilitated and sponsored the participation of 5 representatives from our project’s associated countries in the Caribbean region (Antigua and Barbuda, Belize, Dominica and Trinidad and Tobago).
• First project’s pilot on the “train the trainer” in January 2022 to preselected trainer candidates from various institutions to improve their trainer skills to effectively reach to audiences and to identify potential local trainers who can be expected to deliver Cyber4Dev and/or other trainings in the future.
• Series of trainings organised with the Organisation of the American Sates to members of CSIRTAmericas Network: cyber security engagement + the worldwide CSIRT System in March 2022 for Policy makers.
• Sponsorship of the participation of 2 representatives of the CNCS in the first Cyber Resilience Conference in the African region by Cyber4Dev in April 2022 to share their experience as a hub country of Cyber4Dev project in the LAC region.
• Sponsorship of the participation of 2 representatives of the CSIRT-RD in the 34th Annual FIRST conference in Dublin in June 2022.

Ecuador: Component 1: Strengthened Cybersecurity Policy, Strategical, and Coordination Frameworks

• Joint scoping visit with EU Glacy+ project in February 2020 to project activities.
• online lecture on cybersecurity strategic communications during Covid-19 (best practices from Estonian Government Office’s Communications Department) in April 2020
• IT Risk Assessment course (online) in May 2020
• Cyber Security Preparedness, Crisis Management and Exercises Basics in June 2020.
• Workshop on “Building resilience to disinformation in a democratic society” in July 2020.
• Digital transformation training course in September-October 2021 to give insight into the most important facets of the digital society.
• Data protection workshop in March 2021 to share practical knowledge on the key aspects of data protection and privacy as they relate to the secure management and regulation of e-commerce platforms and services.
• Re-engagement mission with the new government of Ecuador in Quito in October 2021: meetings and engagements with high-level officials from various key-ministries and agencies regarding cyber-security
• Interinstitutional and intersectorial workshop on Ecuadorian cybersecurity priorities facilitated by Cyber4Dev in October 2021.
• Participation and facilitation of the working seminars organised by MINTEL and MFA on specific cybersecurity policy pillars (governance, information systems and incident handling, international cooperation, cybersecurity culture and education).
• IT risk assessment training in October 2021.
• Review of MINTEL’s project proposal to reinforce EcuCERT and transform it to a national CERT between December 2021 and April 2022.
• Signature of Memorandum of Understanding between Cyber4Dev and MINTEL in January 2022
• Seminar on cybersecurity and the role of national CERT to judiciary sector in February 2022.
• Seminar on cybersecurity and the role of national CERT to control entities in February 2022.
• Introductory Critical Information Infrastructure Protection seminar on in February 2022 to give overview of the European methodology of defining critical infrastructure and the community building and future cooperation.
• Training on IT Risk assessment to telecommunications and financial sector in April 2022
• In Cooperation with OAS, development of the first national cyber security strategy to Ecuador for June 2022

Ecuador: Component 2: Increasing Cybersecurity Incidence Response Capabilities

• Consultancy on SIM3 self-assessment review, written comments and advice in April-May 2020
• Six technical trainings for CSERTs organised in the collaboration of OAS between April and June 2021 where members of EcuCERT and representatives of other Ecuadorian institutions participated (15 participants).
• SIM3 evaluation in October 2021
• Technical assistance to EcuCERT regarding incident tracking system RT/RTIR in October 2021
• Seminar to EcuCERT regarding the development of National CERT in February 2022.
• Series of joint technical trainings organised with the OAS to members of CSIRTAmericas Network: ICS/SCADA in March 2022.
• Assessment of software and hardware needs of EcuCERT in April 2022

Ecuador: Component 3: Fostering Networks of Cyber Expertise and Cooperation

• Sponsorship and facilitation of participation of two representatives from Ecuador in the Regional Conference on Cybersecurity to Internet Service Providers in the LAC region in October 2021 in the Dominican Republic.
• Provision of high-level speaker at the “Ecuador Open for Business” forum in the panel of “Closing technological gaps through investment and innovation for the future” in November 2021. The Director of National Cyber Security in the Ministry of Economics and Telecommunications of Estonia gave an overview of the importance of cybersecurity in the governmental issues and on its benefits to the society.
• Provision of a Spanish-speaking EU data protection expert to speak at the Ecuadorian data protection workshop in December 2021 and provide insights of the GDPR and advice of mistakes to avoid when adopting or implementing data protection laws.
• Series of trainings organised with the OAS to members of CSIRTAmericas Network: cyber security engagement + the worldwide CSIRT System in March and April 2022
• Effective Project proposal and management training to public authorities in April 2022.
• Sponsorship of the participation of 2 representatives of the EcuCERT in the 34th Annual FIRST conference in Dublin in June 2022.

Costa Rica: Component 1: Strengthened Cybersecurity Policy, Strategical, and Coordination Frameworks

• Scoping visit in November 2019 to project activities
• IT Risk Assessment training in January 2021
• In cooperation with OAS, review of the existing National Cybersecurity strategy of Costa Rica and providing recommendations for the new draft according to existing best international practices in November-December 2021.
• In cooperation with OAS, review of the new draft of National Cybersecurity strategy for Costa Rica in April 2022.

Costa Rica: Component 2: Increasing Cybersecurity Incidence Response Capabilities

• SIM3 assessment in January 2021
• CISRT training on the national CSIRT baseline structure and services in May 2021.
• Incident classification workshop to CSIRT-CR in September 2021.
• Incident response frameworks and practices training sessions in October 2020, covering topics including national level incident response framework, information sharing and incident reporting, formal and informal mechanisms for resilience building, steps and procedures for effective incident handling in an organization and Covid-19 cyber threat landscape from the attacker’s perspective.
• Six technical trainings for CSERTs organised in the collaboration of OAS between April and June 2021 where representatives of the Ministry of Science, Technology and Telecommunications participated (8 participants).
• SIM3 reassessment (online) in August 2021
• Series of joint technical trainings organised with OAS to members of CSIRTAmericas Network: ICS/SCADA in March 2022

Costa Rica: Component 3: Fostering Networks of Cyber Expertise and Cooperation

• Series of trainings organised with OAS to members of CSIRTAmericas Network: cyber security engagement + the worldwide CSIRT System in March 2022 for Policy makers.
• Sponsorship of the participation of 2 representatives of the CSIRT-CR in the 34th Annual FIRST conference in Dublin in June 2022.

RECENT ACTIVITIES IN AFRICA

Botswana: Component 1: Increasing Cybersecurity Incidence Response Capabilities

• Continued cooperation with the Ministry of Transport and Communications and associated stakeholders in driving forward implementation of the National Cybersecurity Strategy.
• Advisory support and direct engagement in the development of a legal framework and associated policies addressing national cybersecurity concerns.
• Ongoing support to the national cybersecurity Centre of Excellence committee that brings together the public and private sectors, academia, and the research community to develop a platform for cross-sector cooperation and long-term planning for capacity development.
• Through introductions from the EU Delegation to Botswana and SADC, initiated coordination with the SmartBots initiative that is focusing on the development of the digital economy.
• Briefing and advisory support to the Botswana Communications Regulatory Authority executive team regarding the strategic positioning of cybersecurity capacities.
• Initiation of advisory services and support for the adoption of sound Monitoring and Evaluation processes across all National Cybersecurity Strategy implementation efforts.
• Participation in the planning and delivery of Botswana Cyber Week events to include a series of seminars addressing Critical Information Infrastructure Protection, media engagement and coordination and other workshops promoting cross-sector coordination.
• Engagement with advisory team assigned to assess opportunities for EU support to digitalisation programmes in Botswana.
• Provided support to local NGO in the delivery of the second annual CyberSmart campaign – run in alignment with Botswana Cyber Week. To support the development and promotion of national networks of cyber skills within the youth community – building from the CyberSmart campaigns delivered in 2020 and 2021 — established and trained six CyberSmart chapters in Gaborone, Nata, Serowe, Francistown, Molepolole, Bobonong.  The purpose of the pilot initiative was to develop young peer-to-peer educators on issues relevant to cybersecurity. Facilitated workshops supported the 155 participants (68% female) to identify key cyber hygiene messages and to develop campaigns to disseminate these messages.

Botswana: Component 2: Increasing Cybersecurity Incidence Response Capabilities

• Planning and delivery of Advanced CSIRT Management workshops with active participation of stakeholders from across the public and private sectors.
• Planning and delivery of Detecting Compromise training sessions for Botswana Communication Regulatory Authority and Department of Information Technology participants.
• Site visits and assessments of existing cybersecurity stance of COMM-CIRT constituents including:
  • Botswana Telecommunications Corporation
  • Civil Aviation Authority of Botswana
  • Botswana Defence Force
• Collaborative review of tools, workflow and procedures in use and applied with COMM-CIRT
• Introduction of SIM3 assessment methodology to COMM-CIRT constituents from across the public and private sectors
• Advisory support to the national CSIRT planning committee to include a review of the existing capacities with the Botswana Communications Regulatory Authority.

Botswana: Component 3: Fostering Networks of Cyber Expertise and Cooperation

• Supported the Botswana Communications Regulatory Authority’s COMM-CIRT in its application for membership of FIRST. Provided SIM3 Assessment reports as validation of the CIRTs level of maturity and readiness.
• Ongoing cooperation with AfricaRICC to support delegates from Botswana to attend the ENISA sponsored International Cybersecurity Challenge.
• Cooperation with C3SA to support pre-competition workshop for delegates to the Cyber 9/12 Strategy Challenge.
• Coordinating attendance and participation of Botswana stakeholders at the Cyber4Dev Southern Africa Cyber Resilience Conference to be held in Port Louis, Mauritius.

Mauritius: Component 1: Strengthened Cybersecurity Policy, Strategical, and Coordination Frameworks

• Review of the draft National Cybersecurity Strategy 2021-2024. Getting Mauritius to renew its cybersecurity strategy, which concluded with the end of 2019, has been an important line of work for Cyber4Dev since the beginning of our work there. The kick-start of that process was the national cybersecurity strategy seminar that we organized in Mauritius in March 2020, just days before COVID-19 lock-downs started and sadly the whole process lost some of its energy during COVID-19 period.

Component 2: Increasing Cybersecurity Incident Response Capabilities

• A SIM3 re-assessment was conducted by Cyber4Dev in October 21. Increasing incident response capabilities has been an important line of work with our project having supported CERT-MU and its constituents with several trainings and activities throughout our work.

Component 3: Fostering Networks of Cyber Expertise and Co-operation

• Observation of an online training on cyber incident response by CERT-MU in the framework of the ITU Academy in November 21.
• Delivery of regional African Cyber Security Conference in CyberCity, April 2022.

RECENT ACTIVITIES IN ASIA

Sri Lanka Component 1: Strengthened Cybersecurity Policy, Strategical, and Coordination Frameworks

Firstly, supporting the revision and updating of four key pieces of policies and legislative frameworks, more specifically:

1) National Cybersecurity Strategy – Provision of materials to support cabinet approval,

2) NCS Implementation Plan – Review, refinement and implementation support,

3) Cybersecurity Communications Strategy – Development support, and

4) Cybersecurity Law – Drafting support.

Component 2: Increasing Cybersecurity Incidence Response Capabilities

• SIM 3 re-assessment conducted in September 2021
• Ongoing technical workshops and mentoring advice

Component 3: Fostering Networks of Cyber Expertise and Co-operation

• Participation in FIRST conference, Dublin June 2022
• Participation in regional African Cyber Security Conference in CyberCity, April 2022.

Lao PDR Component 1: Strengthened Cybersecurity Policy, Strategical, and Coordination Frameworks

• Cyber4Dev/LaoCERT Conference with stakeholders/Review of National Cybersecurity Strategy and support promotion & adoption across stakeholder community/CIIP

Cambodia Component 2: Increasing Cybersecurity Incidence Response Capabilities

• A SIM3 re-assessment was conducted by Cyber4Dev in May 21
• Various technical training courses in 2021/22

For further information contact Enrico Calandro, Project Leader, (enrico.calandro@cyber4dev.eu) or Belinda Conlan, Project Manager (belinda.conlan@cyber4dev.eu)