In response to global cybersecurity and cybercrime threats, members of the international community are assisting each other through cyber capacity building projects. But what is cyber capacity building?
Several definitions of cyber capacity building have been proposed, but these can feel formal and academic. The definitions do not convey what capacity building looks like in practice: people from different countries helping each other through the sharing of skills, knowledge or resources in a collaborative, global effort to make us all safer in a digital world.
The Cybil Portal team believe the best way to explain capacity building is to describe examples of what projects look like. We have therefore chosen a few of the hundreds of projects you can read about on the site to illustrate how projects look very different, but all have the common theme of international cooperation to help protect countries and their citizens from the threats of cybersecurity and cybercrime. We have chosen at least one illustrative project from each of the Themes and Topics the site uses to categorize projects.
Theme: Cybersecurity Policy and Strategy
A national CMM Assessment was carried out by GCSCC in Ghana (2018)
Capacity building should be guided by each government’s assessment of its national capacity gaps and how improvements should be prioritised. National capacity assessment projects help governments with this process. An example of such a project is the Global Cyber Security Capacity Centre’s assistance to the government of Ghana in 2018.
This is delivered by international experts visiting partner countries and working with their governments to collect information through multidisciplinary workshops. This information is combined with desk research and analysed within a cybersecurity maturity model for nations. The reports that the project produces help catalyse follow-on action, while the workshops themselves often strengthen connections and cybersecurity discussions between government agencies. The project is an example of how universities and academics can work with governments and contribute their knowledge and expertise.
Belize received capacity building support as it prepared a national cyber security strategy
Civil society are an important stakeholder and partner to governments in improving national cybersecurity capacity. It is therefore useful to involve them in the development of national cybersecurity strategies – an essential foundation for national cybersecurity. Belize did this as it prepared its own national strategy in 2018 to 2020.
Global Partners Digital (GPD) assisted them through activities such as advice to the strategy development taskforce and training civil society organisations so they could engage more effectively. The project is also an example of how a countries’ international capacity building partners can collaborate: in this case through coordinating support from GPD and the Organisation of American States.
Women in Cyber Fellowship meeting
Diplomacy to agree the norms of responsible government behaviour in cyberspace contributes to stronger cybersecurity at a global level and mitigates the risk of conflict.
Capacity building is assisting this diplomacy by providing training, information and networking opportunities to officials and civil society who are taking part in it or contributing to it as stakeholders. The Women in Cyber Fellowship is an example of a series of projects that both support cyberdiplomacy and illustrate how gender and inclusion can be addressed within capacity building. The Fellowship projects are contributing to the cyberdiplomacy in the 1st and 3rd committees of the UN, growing with each round of these processes.
Find out more about the women and international security in cyberspace fellowship and the women in cyber fellowship.
Theme: Cyber Incident Management & Critical Information Protection
PACTRAINING project workshop (Papua New Guinea, February 2020)
Incident response teams and personnel play a critical in mitigating the risk from cybersecurity threats. Many projects help to establish or strengthen these teams and train front line cybersecurity professionals. An example of such a project is the PACTRAINING run by APNIC, the regional Internet address registry for the Asia-Pacific region.
Since 2019 the project has trained over 150 cybersecurity practitioners across the Pacific region. It demonstrates how consultation with beneficiaries can inform project design and how training can be adapted to online and hybrid formats in response to the restrictions caused by COVID 19.
DNS AND DNSSEC training workshop, Papua New Guinea, February 2020. See: https://apnic.foundation/wp-content/uploads/2021/11/APNIC-Foundation-Annual-2020.pdf
Facilitating a national cyber risk assessment in Cameroon
The African Commonwealth National Cyber Risk Assessment Community project is an example of how countries can share their own in-house cybersecurity management tools. In this case, the project shares a tool to help countries identify their critical infrastructure and assess its vulnerability.
The project demonstrates the principle of respect for the confidentiality of information, as only the country that uses the tool has access to its data and the outputs of the tool.
Theme: Cybercrime
GPEN Cyber Crime Prosecution Training
Cybercrime training takes many forms and is provided to police officers, prosecutors, judges and officials. The International Association of Prosecutors uses online training to provide prosecutors in 158 countries with information that will help them prosecute cybercrimes. The project also uses a peer-to-peer training model in which prosecutors deliver training to other prosecutors, across borders.
Outcomes from this training include examples of successful prosecutions by trainees using the knowledge they have gained through the project.
GLACY project meeting
Legal frameworks underpin national efforts to tackle cybercrime. The Council of Europe’s GLACY and GLACY+ projects help countries strengthen their capacity to apply legislation on cybercrime and electronic evidence and enhance their abilities for effective international cooperation. Since the start of GLACY, and with the support of it and its successor, eleven countries have acceded to the Budapest Convention on Cybercrime and five more have been invited to join. The project provides advice and training to help countries update their legislation and bring it in line with international standards. The project also takes a holistic approach, supporting policy/decision-makers in government as well as law enforcement agencies, judges and prosecutors. It emphasizes international cooperation and strengthens police capacities to effectively cooperate with counterparts.
Find out more about the GLACY project and the GLACY+
Theme: Cybersecurity Culture & Skills
Stop.Think.Connect public awareness campaign
Capacity building projects can help governments, companies and civil society grow their ability to deliver or direct effective public awareness campaigns. STOP THINK CONNECT stared as messaging campaign within the United States in 2010, but has grown to be a global campaign with a capacity building arm. Under its capacity building it provides advice and resources to governments and other actors to help them run the campaign in their own countries. This is an example of both public private partnerships and how countries can turn their own tools into global good resources that they share with others.
Senegal’s National School of Cybersecurity Regional Training
National cybersecurity readiness requires a workforce with sufficient professionals with cybersecurity skills and an education and training pipeline that can produce those professionals.
Capacity building projects can help governments develop national policies and frameworks for these and support individual training initiatives that work at scale to reach a large portions of the workforce. An example of the later is Senegal’s National School of Cybersecurity for Regional Training (École nationale de cybersécurité à vocation régionale, ENVR). This national and regional vocational training college was inaugurated in 2018 and received support from the French government. It is an example of how projects can send national expert – in this case 2 French trainers – to live and work in partner countries for extended periods, in support of the local government.
Theme: Standards
Standards schemes can make large scale improvements to cybersecurity by changing how goods and services are designed or procured. Projects can help countries develop, adopt and apply recognized international standards. An example of such a project was Critical and Emerging Technology Standards for Safety, Security and Trade. This was implemented by the Standards Australia with ASEAN partner countries. A four-day conference in November 2021 provided information to 158 participants, including local and international experts, standards developers, policymakers and regulators.
Global / Regional Coordination Meetings
The Global Forum on Cyber Expertise holds global and regional conferences that act as platforms to share knowledge and coordinate projects. These are multistakeholder meetings that bring together those who are active in capacity building in a region together with local governments. This helps maximize the effectiveness of projects and avoids duplication or conflicting activities. It is also a way to identify capacity gaps and support a demand-driven approach in which governments give direction as to the priorities in their country and region. Examples of such events include the GFCE Annual Meeting in Addis Ababa in 2019 and the GFCE’s Pacific regional meeting in 2020. Find out more about
the GFCE Annual Meeting 2019 and the GFCE’s Pacific regional meeting.
