Bridging the Standardization Gap: Lessons from EU and US Cybersecurity Initiatives

1. ITU Regional Workshop on Bridging the Standardization Gap (Yangon, Myanmar, 28-29 November 2013) Cybersecurity-Related Standardization Initiatives in the EU and the U.S.: Lessons for Developing Countries Nir Kshetri Professor, The University of North Carolina—Greensboro nbkshetr@uncg.edu

3. The EU and US cybersecurity strategies (CSS) Kshetri & Murugesan (2013).

5. Key Concerns EU CSS Appropriateness of pan-European rules Compliance costs : concerns of the private sector’s confidentiality, extra costs and possible damage to reputation. Obligation to report cyberattacks: “vague”/ little to protect EU citizens' data stored outside the EU Misdirection of funds away from the police into intelligence agencies US EO Voluntary standards may turn into mandatory regulations (de facto requirements). Too much focus on information sharing/ little to address problems related to insecure system. Firms outside of critical infrastructure: EO does little to enhance CS.

6. Effects on the Private Sector EU CSS Further development of European PPP for resilience/ cooperation/ info. sharing with pub. authorities. Investment on CS/dev. of best practices- TDL/other initiatives. Robust/user-friendly security features in products/services. Cloud providers: reduce reliance on foreign suppliers. Members: compel firms (transport, telecoms, finance energy, health, online infra.) to disclose details of cyberattacks to the national CERT. US EO Defense and intelligence agencies would share classified cyberthreats data with companies. Incentives to follow security standards. Companies are not required to publically disclose breaches unless identifying information (e.g., credit card or Social Security numbers) is involved.

7. Effects on Privacy and Security Interests of Consumers EU CSS Defensible and preferable in promoting privacy and security interests of consumers. US EO White House: shared information would be limited to cyberthreats and would not contain the contents of private emails. The flow of data is one-way: Private-sector firms not required to release information about clients. Better protect privacy than the CISPA (ACLU). “privacy-neutral way to distribute critical cyber information”

8. Discussion of EU and US CSS • Both incomplete/lackteeth and legitimacy • Companies’ failure to spend sufficient resources/efforts to protect networks: • Bloomberg Government study: to prevent 95% of potential cyberattacks, 172 organizations need to spend $47b: 774% higher than current spending. • Absence of regulatory requirements: no incentive to spend on cybersecurity.

9. Discussion of EU and US CSS • Fail to acknowledge: lack of CS professionals. • The U.K.’s National Audit Office: 20 years to bridge CS skills gap. • NIST: > 700,000 new CS professionals needed in the U.S. by 20 • Both inward-oriented • Huawei: importance of working globally • US-China Business Council: asked US and Chinese governments to work together

10. Lessons for DevelopingCountries • Sound cybersecurity standard/ regulatory framework: participation of governments, business, IT industry, law enforcement agencies and the public • Common goal: cyberspace safe and secure, leaving their • Working with other national govts, political parties: • beyond vested national or political party interests

11. Conclusions and Recommendations • Increasing importance of CSS for developing countries • National security, economic growth, trade and investment politics, international relations and other implications • Higher degree of vulnerability • Manpower challenges a higher concern