{"id":9440,"date":"2013-09-18T14:00:04","date_gmt":"2013-09-18T04:00:04","guid":{"rendered":"http:\/\/www.aspistrategist.ru\/?p=9440"},"modified":"2013-09-19T13:58:17","modified_gmt":"2013-09-19T03:58:17","slug":"collaborating-for-a-stronger-region-cyber-security-capacity-building-within-the-arf","status":"publish","type":"post","link":"https:\/\/www.aspistrategist.ru\/collaborating-for-a-stronger-region-cyber-security-capacity-building-within-the-arf\/","title":{"rendered":"Collaborating for a stronger region \u2013 cybersecurity capacity building within the ARF"},"content":{"rendered":"

In my previous post<\/a>, I looked at the polarised geopolitical, technological and economic situation that provides the backdrop to ASEAN states’ deliberations on cyberspace. During the course of the ARF meeting there was a focus on practical ways in which states in the region can begin to create a more even playing field, and begin to create a common understanding of the language, vulnerabilities and responses to cyber threats. My talk focused on what measures the ARF could take to assist in capacity building in the region to bolster the capabilities of those states capabilities that are severely lagging behind.<\/p>\n

Capacity building can take place at both the policy and the technical levels; it’s a fact that having the technical cyber capabilities to respond to a crisis is of no use if policy mechanisms aren’t in place to enable them. And it’s important to recognise that the private sector and civil society are key parts of the equation for the most comprehensive and constructive capacity building.<\/p>\n

Bearing that in mind, I proposed five key areas for capacity building for the ARF to consider. None of this is rocket science, but failure to act could lead to a regional cyber domain that’s akin to the Wild West.<\/p>\n

1) Sharing approaches to cyber policymaking<\/strong><\/p>\n

A relatively easy place to start, it’s already taking place within the ARF in some respects, but it needs reinforcing. Exposure to one another’s policies can help those nations less confident of their mechanisms to learn from the best practice of others, and to pick and choose the best ideas to adopt for themselves. This process serves two purposes. First, it builds nations policy understanding of each other and, second, it also acts as a confidence building measure. Peering into one another’s doctrinal approaches creates more certainty about how a nation will respond in times of crisis.<\/p>\n

2) Building Regional Cybersecurity Baselines<\/strong><\/p>\n

There’d be great advantage in the ARF defining a baseline of cybersecurity for its member states. However rudimentary this baseline might end up being, it could help countries identify and then reach minimal technical and policy standards. It’s in all parties interests for ASEAN members to have sound cybersecurity policies and mechanisms in place. One particular area where much assistance is needed is critical national infrastructure protection\u2014many highly developed nations struggle to understand their own vulnerability, a problem magnified many times when a country has difficulties with the most basic elements of cyber capability.<\/p>\n

To begin this process the ARF could make a statement supporting the raising of cybersecurity standards across the region, including an outline of the mutual benefits this would bring to member states. However, I strongly suspect this fell on deaf ears as making such a statement would take quite a while to negotiate between ARF member states.<\/p>\n

3) Training and Simulation<\/strong><\/p>\n

Training people is one of the most effective ways of raising the bar in cybersecurity. If the ARF were to begin raising expertise within government about simple measures they can take to improve cybersecurity this would be an extremely positive move. They would do well to look closely at the Australian Signals Directorate’s award winning ‘Top 35 mitigation strategies<\/a>‘. Introducing just the top four<\/a> can prevent 85% of targeted cyber intrusions.<\/p>\n

Live simulations can demonstrate to policymakers and the uninitiated what a cyber crisis actually is, and give a fuller understanding of the different elements of crisis management and incident response.<\/p>\n

4) Learn from and reinforce Good Policing and CERT (Computer Emergency Response Team)\/CSIRT (Computer Security Incident Response Team) Relations<\/b><\/p>\n

There are already strong working relationships between police forces, CERT and CSIRTs within ASEAN, predominantly related to fighting cybercrime. These areas of cooperation could helpfully be extended to the political level, where many areas of division still exist. Bureaucrats could learn from the practical approach that these groups take in achieving a common goal, and apply their no-nonsense approach to other areas of government.<\/p>\n

5) Utilise the private sector creatively<\/strong><\/p>\n

The private sector is often described as having a vital role in addressing cybersecurity issues, but little explanation is offered. In the ARF context, member states should invite key areas of the relevant industry sectors to share their best practices as, in many cases, they have more sophisticated cyber capabilities than governments. For example, the capabilities of many of the banking sectors’ CERTs exceed those of many nations in the ARF. Above I mentioned critical national infrastructure as a key area for understanding vulnerabilities\u2014here the private sector would be invaluable in assisting capacity building efforts, as a vast majority of the CNI is already in private sector hands. The ARF should also encourage existing industry groupings that already share threat data to further expand their networks across the region, thus spreading the understanding of threats beyond their normal jurisdictions.<\/p>\n

There was a great deal of discussion of an ARF Workplan, intended to produce more practical work on building cybersecurity across the region. The workplan included some of the suggestions outlined above, and there appeared to be support for the initiative. However, as is often the case with multilateral groupings, enthusiasm for practical initiatives can be stalled when political agendas come into play, and this became evident during the course of the ARF. The glaring divide between certain states in terms of their political positions became crystal clear, as did the way in which this could derail the positive practical suggestions that were made. That will be the topic of my final piece on the ARF.<\/p>\n

Tobias Feakin is a senior analyst at ASPI.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"

In my previous post, I looked at the polarised geopolitical, technological and economic situation that provides the backdrop to ASEAN states’ deliberations on cyberspace. During the course of the ARF meeting there was a focus …<\/p>\n","protected":false},"author":49,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_mi_skip_tracking":false,"footnotes":""},"categories":[1],"tags":[189,95],"class_list":["post-9440","post","type-post","status-publish","format-standard","hentry","category-general","tag-asean","tag-cyber-security"],"acf":[],"yoast_head":"\nCollaborating for a stronger region \u2013 cybersecurity capacity building within the ARF | The Strategist<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.aspistrategist.ru\/collaborating-for-a-stronger-region-cyber-security-capacity-building-within-the-arf\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Collaborating for a stronger region \u2013 cybersecurity capacity building within the ARF | The Strategist\" \/>\n<meta property=\"og:description\" content=\"In my previous post, I looked at the polarised geopolitical, technological and economic situation that provides the backdrop to ASEAN states’ deliberations on cyberspace. During the course of the ARF meeting there was a focus ...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.aspistrategist.ru\/collaborating-for-a-stronger-region-cyber-security-capacity-building-within-the-arf\/\" \/>\n<meta property=\"og:site_name\" content=\"The Strategist\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/ASPI.org\" \/>\n<meta property=\"article:published_time\" content=\"2013-09-18T04:00:04+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2013-09-19T03:58:17+00:00\" \/>\n<meta name=\"author\" content=\"Tobias Feakin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@ASPI_org\" \/>\n<meta name=\"twitter:site\" content=\"@ASPI_org\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Tobias Feakin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.aspistrategist.ru\/#website\",\"url\":\"https:\/\/www.aspistrategist.ru\/\",\"name\":\"The Strategist\",\"description\":\"ASPI's analysis and commentary site\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.aspistrategist.ru\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-AU\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.aspistrategist.ru\/collaborating-for-a-stronger-region-cyber-security-capacity-building-within-the-arf\/\",\"url\":\"https:\/\/www.aspistrategist.ru\/collaborating-for-a-stronger-region-cyber-security-capacity-building-within-the-arf\/\",\"name\":\"Collaborating for a stronger region \u2013 cybersecurity capacity building within the ARF | The Strategist\",\"isPartOf\":{\"@id\":\"https:\/\/www.aspistrategist.ru\/#website\"},\"datePublished\":\"2013-09-18T04:00:04+00:00\",\"dateModified\":\"2013-09-19T03:58:17+00:00\",\"author\":{\"@id\":\"https:\/\/www.aspistrategist.ru\/#\/schema\/person\/84f461839f3f37e79509040ae4eeedcd\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.aspistrategist.ru\/collaborating-for-a-stronger-region-cyber-security-capacity-building-within-the-arf\/#breadcrumb\"},\"inLanguage\":\"en-AU\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.aspistrategist.ru\/collaborating-for-a-stronger-region-cyber-security-capacity-building-within-the-arf\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.aspistrategist.ru\/collaborating-for-a-stronger-region-cyber-security-capacity-building-within-the-arf\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.aspistrategist.ru\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Collaborating for a stronger region \u2013 cybersecurity capacity building within the ARF\"}]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.aspistrategist.ru\/#\/schema\/person\/84f461839f3f37e79509040ae4eeedcd\",\"name\":\"Tobias Feakin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-AU\",\"@id\":\"https:\/\/www.aspistrategist.ru\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/a8346dd3562a4d00483b16ff7e8b8df6?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/a8346dd3562a4d00483b16ff7e8b8df6?s=96&d=mm&r=g\",\"caption\":\"Tobias Feakin\"},\"url\":\"https:\/\/www.aspistrategist.ru\/author\/tobias-feakin\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Collaborating for a stronger region \u2013 cybersecurity capacity building within the ARF | The Strategist","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.aspistrategist.ru\/collaborating-for-a-stronger-region-cyber-security-capacity-building-within-the-arf\/","og_locale":"en_US","og_type":"article","og_title":"Collaborating for a stronger region \u2013 cybersecurity capacity building within the ARF | The Strategist","og_description":"In my previous post, I looked at the polarised geopolitical, technological and economic situation that provides the backdrop to ASEAN states’ deliberations on cyberspace. During the course of the ARF meeting there was a focus ...","og_url":"https:\/\/www.aspistrategist.ru\/collaborating-for-a-stronger-region-cyber-security-capacity-building-within-the-arf\/","og_site_name":"The Strategist","article_publisher":"https:\/\/www.facebook.com\/ASPI.org","article_published_time":"2013-09-18T04:00:04+00:00","article_modified_time":"2013-09-19T03:58:17+00:00","author":"Tobias Feakin","twitter_card":"summary_large_image","twitter_creator":"@ASPI_org","twitter_site":"@ASPI_org","twitter_misc":{"Written by":"Tobias Feakin","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebSite","@id":"https:\/\/www.aspistrategist.ru\/#website","url":"https:\/\/www.aspistrategist.ru\/","name":"The Strategist","description":"ASPI's analysis and commentary site","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.aspistrategist.ru\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-AU"},{"@type":"WebPage","@id":"https:\/\/www.aspistrategist.ru\/collaborating-for-a-stronger-region-cyber-security-capacity-building-within-the-arf\/","url":"https:\/\/www.aspistrategist.ru\/collaborating-for-a-stronger-region-cyber-security-capacity-building-within-the-arf\/","name":"Collaborating for a stronger region \u2013 cybersecurity capacity building within the ARF | The Strategist","isPartOf":{"@id":"https:\/\/www.aspistrategist.ru\/#website"},"datePublished":"2013-09-18T04:00:04+00:00","dateModified":"2013-09-19T03:58:17+00:00","author":{"@id":"https:\/\/www.aspistrategist.ru\/#\/schema\/person\/84f461839f3f37e79509040ae4eeedcd"},"breadcrumb":{"@id":"https:\/\/www.aspistrategist.ru\/collaborating-for-a-stronger-region-cyber-security-capacity-building-within-the-arf\/#breadcrumb"},"inLanguage":"en-AU","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.aspistrategist.ru\/collaborating-for-a-stronger-region-cyber-security-capacity-building-within-the-arf\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.aspistrategist.ru\/collaborating-for-a-stronger-region-cyber-security-capacity-building-within-the-arf\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.aspistrategist.ru\/"},{"@type":"ListItem","position":2,"name":"Collaborating for a stronger region \u2013 cybersecurity capacity building within the ARF"}]},{"@type":"Person","@id":"https:\/\/www.aspistrategist.ru\/#\/schema\/person\/84f461839f3f37e79509040ae4eeedcd","name":"Tobias Feakin","image":{"@type":"ImageObject","inLanguage":"en-AU","@id":"https:\/\/www.aspistrategist.ru\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/a8346dd3562a4d00483b16ff7e8b8df6?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/a8346dd3562a4d00483b16ff7e8b8df6?s=96&d=mm&r=g","caption":"Tobias Feakin"},"url":"https:\/\/www.aspistrategist.ru\/author\/tobias-feakin\/"}]}},"_links":{"self":[{"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/posts\/9440"}],"collection":[{"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/users\/49"}],"replies":[{"embeddable":true,"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/comments?post=9440"}],"version-history":[{"count":4,"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/posts\/9440\/revisions"}],"predecessor-version":[{"id":9447,"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/posts\/9440\/revisions\/9447"}],"wp:attachment":[{"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/media?parent=9440"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/categories?post=9440"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/tags?post=9440"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}