Speech by Malcolm Johnson, ITU Deputy Secretary-General
Cyber Incident Simulation and Conference on National Critical Infrastructure Protection
23 November 2015, Bangkok, Thailand
Admiral Anuthai RATTARANGSI, Deputy Permanent Secretary for Defence
Air Chief Marshal Thares PUNSRI, Chairman of National Broadcasting and Telecommunications Commission of Thailand
Major General Chaiyot LILITWONG, Director, Computer Security Center, Defence Information and Space Technology Department, Ministry of Defence
Distinguished speakers, participants
Ladies and gentlemen
Good Morning, Arun Swad !
It is a great pleasure to be here with you today, and I would like to thank our co-hosts and co-organizers, the Ministry of Defence and the National Broadcasting and Telecommunications Commission of Thailand, for giving us the opportunity to be here and hold this conference.
As we know in today's world, everything depends on ICTs (information and communication technologies) – and the essential services particularly on the critical national ICT infrastructures and networks: the emergency services, water supplies, power grids, food distribution chains, aircraft and shipping, navigation systems, industrial processes, healthcare, public transportation and government services. They now all depend on the control systems operated through ICTs and cyberspace.
As we become more and more dependent on cyberspace so it is increasingly subjected to malicious attacks with potentially ever-greater catastrophic consequences.
Critical infrastructures are particularly targeted as they underpin the operations of vital services and without which countries would be severely disrupted, creating life-threatening situations.
One of the most important types of critical infrastructures are the industrial control systems (ICSs) that supervise and control processes in industrial infrastructures. Many are still running with legacy equipment that was not designed with security in mind.
Security was of little concern when these were isolated systems but increasingly they are being interconnected to the global grid and without the authentication, encryption or intrusion mechanisms in place to protect them they are open to attack.
It is vital to a nation's interests, and its socio-economic well being, that its critical infrastructures are secure, resilient to threats, and able to quickly recover from attacks.
Although there is a growing awareness of the risks associated with transitioning to digital control systems, the consequent need for investment in resources to adapt to these challenges is often lacking.
Ladies and gentlemen,
In some countries, critical infrastructure is government-owned, but in many it is owned and maintained by the private sector. So although the protection of critical infrastructures is a national responsibility, public-private partnership is vital to the success of any effort to increase security.
Ensuring the effective protection of such infrastructures requires collaborative and coordinated actions for the prevention, response, and recovery from incidents on the part of everyone – government authorities, the private sector, and citizens.
Three key areas to be addressed in order to improve the national cybersecurity posture and better protect critical infrastructures are:
- The formulation and implementation of a national strategy for cybersecurity and critical infrastructure protection led by government but with active engagement of all relevant national stakeholders.
- The establishment of dedicated capabilities, such as Industrial Control Systems – Computer Incident Response Teams (ICS-CIRTs) to ensure immediate response in case of disruption of services caused by cyber attacks.
- Information and threat sharing with the national, regional and international security community, to allow exchange of security practices and measures as well as to foster international cooperation.
Solutions must include technical, public policy and regulatory aspects, and require dialogue and close cooperation amongst all stakeholders working in the area – including governments, the private sector, academia, civil society and international organizations.
As the lead UN agency for ICTs ITU is particularly active in this area, which is why ITU is happy to support conferences such as this. Improving cybersecurity and securing critical infrastructures at national level can be significantly boosted through the exchange of know-how and internationally recognized best practices as there will be here today.
Let mention some other activities ITU has in this area:
Within the framework of ITU's Global Cybersecurity Agenda, and in partnership with other UN agencies, international organizations and private sector entities, ITU offers capacity-building and other cybersecurity services to its 193 Member States. In fact ITU has now conducted assessments to determine the cybersecurity readiness of 65 countries, with the specific focus on Computer Incident Response Teams (CIRTs).
ITU has assisted eleven countries with the establishment of national CIRTs and is currently assisting four other countries to do so.
However, establishing CIRTs it is not enough, if it is not complemented by programmes aimed at building competencies to deal with emerging threats.
Which is why ITU is partnering on a regular basis with industry to undertake cyber-drills in a simulated but realistic operational context. More than 90 countries have benefited from these regional cyber-drills since ITU in partnership with ASEAN organized the first of such drills for Cambodia, Lao PDR, Myanmar and Viet Nam.
To help participants here build capacity in the awareness and decision making processes, a cyber drill will be held here today as part of this conference which will simulate cyber-attacks to national critical infrastructures and provide practical advice on how to respond.
ITU's Global Cybersecurity Index allows every country to assess their cybersecurity readiness, and enables them to track their progress in the area.
ITU is also embarking on a global project in partnership with other international and intergovernmental institutions to harmonize existing efforts to assist countries in developing National Cybersecurity Strategies.
ITU's technical study groups provide a neutral, global platform for all stakeholders to come together and develop security-related technical standards on a variety of topics, and ITU conducts workshops on these ICT security standards, guidelines, methodologies, and practices to enable critical infrastructure providers to achieve the resilience required.
Ladies and gentlemen,
In conclusion, the security and economic development of nations now relies very much on the critical national infrastructures that use ICTs and as such special care must be put in place to ensure their protection. This will require an investment in resources at the national level but above all collaboration with all national, regional and international stakeholders.
Recent trends in organized crime, both national and transnational, have dramatically changed with globalization and the increased use of sophisticated and advanced ICTs. Today's criminals are exploiting cyberspace and policy makers, regulators, law enforcers and CIRTs are facing serious challenges to combat them. This makes it increasingly important for major players and stakeholders to work together to build the capacity to better understanding the unique aspects of these increasingly complicated cyber crimes and how best to combat them.
It is not a task for one country or one organization, it is a task for all and ITU stands ready and willing to help and contribute to the global effort to combat this global threat.
I wish you an enjoyable and rewarding conference.
Thank you for your attention.
Ka Ka Khun !