International Cyber Warfare and Security Conference

1. International Cyber Warfare and Security Conference Cyber Defence Germany's Analysis of Global Threats 19th November 2013, Ankara

2. Motivation for the new german cyber security strategy: Changed Security Situation BusisnessProcesses on the Internet Interconnection Military Intelligence Services Complexity of IT Systems Cyber Security Crime Underground Economy Short Innovation Cycles Hacker, Cracker Convergency of Networks IP Competition Espionage

3. Shared ResponsibilityJoined Action Fed. Gov. Fed. States LocalAuthorities Operators of CII Industry Citizens

4. Framework ConditionsIssues and Action Lines Internet as a Public Good Internet as a Public Space Security in Cyberspace • Secure Action in Cyberspace • Authenticity, Integrity, Confidentiality of Data and Networks • Legal Security Legal Obligation • Security against Crime • Security againstMaliciousActivities Cyberspace Security Resilience of Infrastructure IntegrityandAvailability (failuresafety) of Systems and Data

5. Cyber-security-strategygoals and measures National Cyber Security Council National Cyber Response Center Critical IT Infrastructure IT of Citizens IT in the Public Administration Use of ReliableandTrustworthy Information Technology International Cooperation (EU, worldwide) Response toCyber- Attcks Effective Crime Control PersonneldevelopmentFed. Gov.

6. Participants in the National Cyber Response Center Supervision CIIP LBA BKA Bw BAFin EBA ZKA BSI, BfV, BBk BND DWD BPol BNetzA … Federal States

7. National Cyber Response CenterInformation is supplied by … Cyber Response Center Implementation Plan KRITIS(incidents, counter-measures) .: Implementation Plan Federation/Federal Gov (incidents, counter-measures) .: Supervisoryauthorities (routineandincident-related) .: Hard- andsoftwaresuppliers (vulnerabilities, counter-measures) .: BSI CERT, Command centre int. CERTAssociation(monitoring/reports) .: BKA (modusoperandi, crimetrends) .: Federal ArmedForces (intelligence; ownexperience/ findings) .: Federal Intelligence Service (intelligence; ownexperience/ findings) .:

8. National Cyber Response CentreInformation is supplied to … Nat. Cyber Response Centre BSI-CERTand Command Centre (coordinatedevaluations/recommendations) Hard- andsoftwaresuppliers (vulnerabilitiesandrecommendations) IP KRITIS / IP Federation/Fed. Gov. (vulnerabilities, alerts, reecommendations) Industry in general (alerts, recommendations) BKA, ZKA, Bundeswehr, BND (all typesofintelligence) National Cyber Security Council (periodicreports, recommendations) Crisismanagementstaff (support in timesofcrisis) Federal statesdepending on structure General public(alerts)

9. Company 1 Company 2 Communication Architecture in the Implementation Plan kritis Single Points of Contact Cyber Response Center companies SPOC Sector 1 ... SPOC Sector n Company 3 ... Company x CERTS Industry

10. Federal Office for Information Security (BSI) &National Cyber Response CentreFindings after the first year • More than 900 incidents analysed • 80/20 rule confirmed:About 80% of cyber attacks could be prevented if the basic 20% of known counter-measures were consistently applied! • Among the remaining 20% there is a growing number of very sophisticated attacks – for all we know by special forces

11. National Cyber Security Council - Tasks

12. The National Cyber-Security CouncilCoordinates Instruments andOverlapping Policy Making Goals and Tasks • Coordination of Cyber Security Policy Stances • Identification und Correction of Structural Trouble Spots • Discussion of Cyber Security Issues, new technologies • Transparency in Collaboration • Recommendations to the Cyber Response Center

13. Next steps – key questions • Ongoing implementation of strategy • This includes, e.g.: • Enhancing and extending cooperation on critical infrastructure protection • Creating more PC security by increasing provider responsibility • Intensifying cooperation both at home and abroad • Establishing norms of state behaviour in Cyberspace in international fora (G8, United Nations)

14. Draft IT Security Act- Draft provisions to improve the protection of Critical National Infrastructure (CNI) - • Legal obligation to meet minimum organizational and technical IT security standards in the field of CNI; state of the art. • Industries to work out standards. Federal Office for Information Security (BSI) to recognize suitable standards, after consultation with supervisory authorities. • Security audits to be conducted every two years; list of audits and identified deficiencies to be forwarded to BSI; BSI may require operators to remedy problems immediately. • Major IT incidents to be reported to BSI directly. • Purpose of reports: BSI to compile situation reports and to inform CNI operators when necessary.

15. Draft IT Security Act- Draft provisions governing ICT providers/operators - ICT industry: Key role in cyber security • Telecommunications network operators and providers of telecommunications services for the general public • should always take into account the state of the art when seeking to guarantee IT security. • should report IT security incidents, even if they have not caused direct disruptions of telecommunications networks/services. • should inform users about failures caused by their systems and point out technical remedies for such problems. • Telemedia service providers (acting on a commercial basis and, as a general rule, for payment) should safeguard state-of-the-art IT security to the extent technically possible and reasonable.

16. Thank you • http://www.bmi.bund.de