MOST systems in developed societies rely on computer communication and information infrastructure. This growing dependence on information and communication technologies is a blow to computers and information flow processes, which are liable to disrupt, paralyze, and sometimes cause substantive physical damage to essential systems. Computer based capabilities and their near global ubiquity exposes states to harm in cyberspace through various elements, including hostile countries,¹ terrorist organizations, criminal elements, and even individuals driven by personal challenges or anarchist motives.

Even though states in the past decades have progressed and profited in their production and provision of national services, they have been exposed to new threats. Yet, insufficient attention has been paid to appropriate means of confronting such threats. In the recent past, industry (private and public) was protected by the state. For example, excluding workplace accidents, power stations producing electricity (whether private or publicly owned) were exposed to physical damage only if the state encountered a physical war, and it was the state’s job to protect such infrastructure along with economic institutions, industrial facilities and so on.

 

Public and civilian institutions were protected by virtue of their existence in the territorial space under the state’s authority and control. That has changed. In addition, the trend in recent decades to privatize government services has placed a large portion of infrastructure plants traditionally in the hands of the government in private hands, including those relating to communications, transportation, electricity, energy and heavy industry. Moreover, traditional industries in recent decades have been joined with new industries in the hi-tech realm that constitute a significant component of the state’s GDP.

In order to create a common language, one may distinguish the cyber-space into three groups. The first group comprises of government security and intelligence organizations. These are the nation’s security organizations that are typically investing some effort in their cyber defence. The intensity of this effort is usually subject to the extent of threats and overall awareness levels of the organization’s management. In some countries, this is also the case found in government ministries and services. The second group is commonly considered to be the nation’s critical national infrastructure. These are civilian services such as communications, transportation, electricity, energy and heavy industry. Advanced countries will have a special authority dealing with or special regulations for cyber defence of these critical infrastructures.

The last group is the rest of the cyberspace users and includes civilian sector industries and private sector businesses. This group is left with no guidance for cyber defence, though a coordinated cyber attack on entities in this group may result in heavy damage. One can only imagine a successful attack occurring on a food or pharmaceutical manufacturer or the effect of IP cyber theft.² At the same time, changes in the structure of the nation’s economy and the emergence of elements, processes, assets and projects – which, if damaged, could potentially cause significant harm on a national level – have exposed and increased the range of weak points and the targets for cyber attacks.

Moreover, potential damage is not restricted to what can be quantified in financial terms or what impacts the GDP: significant damage can also be caused to assets and values that have cytological effect. Thus, for example, in the United States, defensive plans also apply to heritage and memorial sites.³ 

The aim of this article is to propose a concept and methodology to categorize private sector cyber risks and ways to enhance cyber defence of the civilian and private sector by means of regulations and mandatory minimal security measures. The process proposes to categorize civilian and private sector cyber risks for the effect they may pose to the public.⁴ 

 

Who will be subject to regulation? It is commonly understood that a company or organization from the private sector will invest resources for cyber defence only if this is in line with its business needs. Thus, it is unlikely for a company to voluntarily invest resources for cyber security measures that would reduce the impact and consequences on the public from a cyber attack on the company. This is why governments would need to step in with regulations, thus creating one of the main tools of enforcing cyber security standards in the private sector.

Of course, not all private companies will be subject to the same regulations. For example, cyber security requirements for a large food manufacturer would differ from those for a small restaurant. Methodologies and tools need to be therefore developed in order to identify and categorize the private sector: it is proposed to divide the private sector according to risk levels based on the impact of a cyber attack on the public and on national security.

 

The methodology is based on a two step process. The first step is a screening phase. Private sector companies and organizations will be screened based on a few basic criteria such as activity sector and business volume. In the second phase, each company that has passed the screening round will be graded on the basis of a set of criteria aimed at defining the severity of a cyber attack on national security or the public. At the end, each analyzed company will be given a risk grade between 1 (lowest) to 5 (highest). A set of minimal cyber security standards would be defined for each group. These standards can then be adapted to the type of business or sector the graded company is active in. For example, companies from the energy sector will probably need different cyber security measures than companies in the health sector.

 

Implementation of statutory regulations of any kind requires a legal framework. It is always preferable to use existing laws rather than trying to initiate new legal frameworks. The aim is to make cyber protection a built-in component of the existing statutory process, both during the establishment stages (i.e., the permits required for new projects) and the operational process (i.e., during the business licensing permit). It is proposed that the legal framework process be also used to ensure compliance with minimum cyber security standards.

This is similar to other regulations. Those businesses that are screened and scored for their cyber risks shall be required to submit a Cyber Resiliency Assessment. This assessment will constitute the main statutory tool for examining the project’s and business’s exposure to the possibility of cyber attacks. Protective measures against these risks/vulnerability would be based on the minimal defence standard for each particular risk group. At the same time, within the framework of business licenses (licenses requiring periodic renewal), the relevant authority can check for ongoing compliance with cyber protection instructions of the organization under review.

The establishment of every project requires compliance with the processes of statutory planning. Thus, projects need to build facilities and structures that must be approved by various planning commissions in accordance with relevant regulations at local, regional, and national levels. A review of the planning documents submitted for approval is the planning authorities’ central tool of control over these projects. Currently in most states, among the documents submitted for review by the planning commissions, one may find reports concerning firefighting, public health issues, environmental aspects, handling of hazardous materials, home front defence requirements, etc. The documents define the steps the project initiator is required to take in order to comply with the necessary requirements in each of these areas. These steps are then to be relayed to the authorized regulatory authorities, who would employ experts to ensure that the project is being implemented with public interest in mind and public security is maintained throughout the various spheres.

In Israel, dozens of projects that could potentially damage or might harm national security are discussed every year, including infrastructure facilities, water and sewage treatment facilities, delivery systems, transportation projects, energy facilities and communications. Expansion and establishment of industrial factories and a wide range of other projects are discussed as well. Cyber damage to some of the projects and ventures is liable to harm the country’s economy not only directly, such as through the inability to supply an essential service, but also in the form of commercial damage where targeted Israeli companies would be unable to supply their products for a given period.

 

An example clarifying the above process of documentation is the requirement to submit an Environmental Impact Assessment. The goal of the assessment is to identify the environmental hazards likely to be caused by the project, along with ways to minimize the damage to a tolerable level. Submission of the review is anchored in the planning and building regulations (of 1982, and in its final version of 2003). The idea for this review originated as a response to the magnified public awareness in the United States on environmental issues, and in 1970, legislation was passed requiring the Environmental Impact Assessment to be a part of the preparation for the planning process.

Together with the planning component of new projects, it is also possible to make use of the business licensing process. This requires periodic renewal to ensure the project meets the necessary criteria in various spheres over the years, including protection from cyber attacks.

 

When a decision is made, the organization must submit a Cyber Resiliency Assessment. This process will adhere to a defined procedure, as follows:

a) Assessment guidelines. It is the responsibility of the regulator to provide guidelines for carrying out the assessment. These guidelines must be suited to the sector of the specific body and cover a number of components, including: mapping potential damage to national or to public security from a cyber attack; mapping vulnerability of the business; and issuing instructions making it possible to minimize exposure and damage.

b) Assessment preparation. The assessment will be prepared under the auspices and from funding of the project initiator or the business seeking the permit. This is best done with the help of designated consultants trained and authorized by the regulator.

c) Checking the assessment. This lies under the responsibility of the regulator and may also involve use of external advisors trained and authorized to check the reviews, with the cost charged to the project initiator of the business.

d) Approval of the assessment. This would include examination and a review by regulator officials and a decision on guidelines in this context for the business. This approval can also address aspects of the stipulations for the business license.

 

Who will be the regulator? There are three options in regard to the identity of the government’s regulator: the sectorial approach, the centralized approach and the hybrid approach. All have their advantages and disadvantages.

1. The sectorial approach entails each ministry being responsible for the business and projects within its sector. This enables the cyber security regulation process to be more professional and sector oriented. For example, the ministry for communication shall be in charge of the regulation of Internet service providers, telecom companies, web hosting services, etc. On the other hand, utility providers (energy, water, petrol, etc.) shall be regulated by the relevant sectorial bureau/ministry.

2. In the centralized approach, all cyber security related regulation will be handled by a single regulator, either from a dedicated cyber defence ministry or from the government’s appointed authority designated in charge of cyber security regulation. A single authority shall develop knowhow on cyber security regulation and advocate necessary adaptations for each sector.

3. The hybrid approach is a mixture of the above two. Some of the string sectors regulators (i.e., ministries) will be given cyber security regulation authorities and the rest shall be put under a centralized authority. This approach takes into account the existing linkages within the government to provide an optimal level/strategy of cyber security defence for the private sector.

 

Threats to civilian companies and the private sector have grown not only because of increased competition in the marketplace, but also because of their exposure to attacks by hostile elements. Hostile parties identify the potential damage to the country’s economic infrastructure inherent in striking these companies. States tend to mainly protect bodies that have a direct connection to national security. This traditionally and primarily includes government offices, intelligence and security bodies, organizations engaged in sensitive/classified security manufacturing, and classical critical infrastructure such as electricity, water and transportation.

The logic defined within the criterion of this privileged class was derived from the classic strategic concept: a list of national infrastructures susceptible to disaster in the event of war, and which, if damaged, could cause direct harm to the country’s fighting ability and resilience. However, this raises questions regarding the fate of civilian and private sector companies such as the pharmaceutical industry and food manufacturing companies. Additionally, what of cable and insurance companies, not to mention memorial and heritage sites? A quick examination shows damage to these organizations is liable to cause significant damage to the country and harm the fabric of civilian life.

Now, with increasing realization that cyberspace is becoming a combat zone before our very eyes, the ability of the states and their economies to weather cyber attacks must be enhanced. Introducing cyber defence regulation in the statutory processes can allow continuous, systematic monitoring of the immunity of a nation’s cyber security system.

 

* This article is partially based on research published by the author in Military and Strategic Affairs 3(1), May 2011.

Footnotes:

1. Mandiant, ‘APT1: Exposing One of China’s Cyber Espionage Units’, February 2013. http://intelreport.mandiant.com/Mandiant_ APT1_Report.pdf

2. Office of the Counter-intelligence Executive, ‘Foreign Spies Stealing US Economic Secrets in Cyberspace, Report to Congress on Foreign Economic Collection and Industrial Espionage, 2009-2011’, Annex B – West and East Accuse China and Russia of Economic Espionage, October 2011. http://www.ncix. gov/publications/reports/fecie_all/Foreign_ Economic_Collection_2011.pdf

3. Patrick Beggs, ‘Securing the Nation’s Critical Cyber Infrastructure’, US Department of Homeland Security, 25 February 2010.

4. The idea is to identify how severe a successful cyber attack on a certain civilian or private sector company is to the public. The proposed method does not deal with the consequences of a cyber attack on the internal organization’s business and operations.