Committed to connecting the world

ICTs for a Sustainable World #ICT4SDG


ITU publications pertaining to Cybersecurity is listed below. 
For additional publications from ITU industry partners click here​.

Global Cybersecurity Index (GCI) 2017

​​​The Global Cybersecurity Index (GCI) 2017 measures each nation's level of commitment to the ITU's Global Cybersecurity Agenda, with the aim of highlighting potential areas for improvement and driving cybersecurity to the forefront of national plans. 


Downl​​oa​d Full report​​ ​version of ​19th of July 2017

The Quest for Cyber Confidence

The Quest for Cyber Confidence
​This book addresses the increasingly daunting task of building confidence in the use of cyber platforms and technologies against a backdrop of recent high-profile security breach incidents and a plethora of emerging threats that have shaken trust in these essential tools of our time. It follows publication of The Quest for Cyber Peace in 2009, which focuses on the promotion of cyber peace in a sphere which has generated tremendous benefits and progress to mankind, but also spawned widespread criminal activities and created new avenues for intelligence gathering, industrial espionage, and conflict. Necessarily, this volume returns to these issues revolving around the overriding theme of the use of the cyber domain as a potent force for either good or evil, especially the impact of the 'dark' Internet on trust in the cyber dimension. Here, however, its central theme promotes the concept of cyber confidence. Table of contents

Global Cybersecurity Index & Cyberwellness Profiles Report 2015
​​​The Global Cybersecurity Index (GCI) measures each nation's level of commitment to the ITU's Global Cybersecurity Agenda, with the aim of highlighting potential areas for improvement and driving cybersecurity to the forefront of national plans. This report presents the 2014 results of the GCI and the Cyberwellness country profiles for Member states. It includes regional rankings, a selected set of good practices and the way forward for the next iteration.

The original publication is in English and translations in other languages may not accurately reflect the content of the English publication. In case of discrepancy, the English text shall prevail.

New edition 2014: ITU Publication on UNDERSTANDING CYBERCRIME: Phenomena, Challenges and Legal Response
​​​​​As cyber-threats can originate anywhere around the globe, the challenges are inherently international in scope and it is desirable to harmonize legislative norms as much as possible to facilitate regional and international cooperation. To assist countries in understanding the links between cybersecurity, the building of confidence and security in the use of ICTs, and cybercrime, ITU has developed, and is in the process of developing, a number of tools. One such tool, which ITU has developed together with an expert, is the ITU publication titled “UNDERSTANDING CYBERCRIME: Phenomena, Challenges and Legal Responce”. The Guide can serve to help developing countries better understand the implications related to the growing cyber-threats and assist in the assessment of the current legal framework and in the establishment of a sound legal foundation, if this does not yet exist​.

Question 22-1/1

​​Securing Information and Communication Networks. Best practices for Developing a Culture of Cybersecurity.

Cybercrimes/e-Crimes: Assessment Report

​​​This report is an assessment of the analysis of the enacted cybercrime legislation in the 6 Caribbean countries. This include the challenges faced and possible measures to enhance the related legislation so as to ensure a steady and regular flow of communication and availability of internet related services.

Electronic Crimes: Knowledge-based Report (Assessment)

​​​​This report delves into the current cyber-crime landscapes, adequacy of legislative instruments and recommendations by international experts. 

Electronic Crimes: Knowledge-based Report (Skeleton)

​​​​This report documents the achievements of the regional activities carried out under the ICB4PAC project, Capacity Building and ICT Policies, Regulations and Legislative Frameworks for Pacific Island countries, ​officially launched in Fiji in November 2009. These include the enactment of substantive criminal law, procedural law, electronic evidence law and also include the possible liability of internet ​service providers.

Computer Crime and Cybercrime: Southern African Development Community (SADC) Model Law

​​​The present document represents an achievement of a regional activity carried out under the HIPSSA project (“Support to the Harmonization of ICT Policies in Sub-Sahara Africa”) officially launched in Addis Ababa in December 2008. 

Readiness Assessment for Establishing a national CIRT

​ITU and a team of experts from IMPACT, carried out readiness assessment of Cybersecurity situation in five least developed countries in the South Asia to review the institutional and regulatory framework, existing critical information infrastructure, and identify areas of improvement and recommend suggestion for establishing a Computer Incidence Response Team (CIRT). The objectives of the CIRT assessment study were to assess the capability and readiness to build a sustainable national CIRT, based on an analysis of stakeholder attributes with relevance to security incident response needs of the concerned countries.​​

ITU/UNODC Cybercrime:The global challenge

​Combination of existing training material and courses, pr​oviding countries with wider access to a range of knowledge and tools; Access to region-specific experience, through combination of two broad networks of field offices in all regions; A comprehensiv​e approach combining crime prevention, criminal justice and cybersecurity, covering all applicable legal and technical standards. 

ITU National Cybersecurity Strategy Guide

​This document is a reference model for national Cybersecurity strategy elaboration. It discusses what constitutes a national Cybersecurity strategy and it seeks to accomplish and the context that influences its execution. The Guide also discusses how States and other relevant stakeholders such as private sector organisations can build capacity to execute a cybersecurity strategy and the resources required to address risks. . As national capabilities, needs and threats vary, the document recommends that countries use national values as the basis for strategies for two main reasons. Firstly, culture and national interests influence the perception of risk and the relative success of defences against cyber threats. Secondly, a strategy rooted in national values is likely to gain support of stakeholders such as the judiciary and private sector. Lastly, since cybersecurity is a branch of information security, the documents seeks to adopt global security standards.

Cybersecurity Guide for Developing Countries

​This Cybersecurity guide for developing countries has been prepared for facilitating the exchange of Information on best practices, related to Cybersecurity issues and to meet the stated goal of the Global Cybersecurity Agenda (GCA) to "enhance security and build confidence in the use of information And communication technologies (ICT)". The guide is intended to give developing countries a tool allowing them to better understand the economic, political, managerial, technical and legal Cybersecurity related issues in the spirit of the Global Cybersecurity Agenda. The purpose of it is to help countries get prepared to face issues linked to ICT deployment, uses, vulnerabilities and misuses. The content of the guide has been selected to meet the needs of developing and, in particular, least developed countries, in terms of the use of information and communication technologies for the provision of basic services in different sectors, while remaining committed to developing local potential and increasing awareness among all of the stakeholders. ​​

ITU National Cybersecurity/CIIP Self-Assessment Tool

​​Information infrastructures have long been subject to national policies, procedures and norms. National government agencies and institutions exist to implement and oversee these activities, and the responsibility for the operation and management of information infrastructures has traditionally been shared among government, owners and operators, and users. Protection of the information infrastructure (formerly the PSTN network) has been a longstanding concern of member states and the work of the ITU is testimony to this concern. However, the use of information systems and networks and the entire information technology environment have changed dramatically in recent years. These continuing changes offer significant advantages but also require a much greater emphasis on security by government, businesses, other organizations and individual users who develop, own, provide, manage, service and use information systems and networks (“participants”). Increasing interconnectivity, the growing intelligence at the edges of the network, and the expanding role of information infrastructures in the economic and social life of a nation demand a new look at existing measures for the enhancement of cybersecurity...

ITU Botnet Mitigation Toolkit​
​​​​​​'Botnets', or as the media calls them, 'Zombie Armies' or 'Drone Armies', and their associated malware have grown over the years into a multimillion dollar criminal economy, a risk to government, critical infrastructure, industry, civil society and to the broader Internet community.
Botnets are coordinated groups of several thousand computing devices (such as PCs, laptops and even the new generation of mobile devices such as 'smartphones'), all infected with the same virus or other malware. Their collective computing power and Internet connectivity is harnessed into a collective whole and remote controlled for the performance of malicious and criminal activities.
Botnets are an illegal and unethical application of the concept of Distributed Systems, which has existed since at least 1970, in which multiple computing devices cooperate to achieve an integrated result...