Cyber security implementation within an organization

1. Cyber security implementation within an organization Ltn Andri Rebane Estonian MoD CIO

2. Estonian Ministry of Defence • Ministry of Defence • Defence Forces • CCDCOE • CIRC • Cyber Lab • Defence League • Cyber Unit • Defence Resources Agency • Information’s Agency • Estonian War Museum • Seli Health Center

3. Basis documents for MoD National Defence Strategy National Military Defence Development Plan National Security Policy National Cyber Security Strategy NATO Policy on Cyber Defence NATO directives

4. MoD Cyber Space Strategy • Defines cyber space as independent domain • Covers following areas of Cyber Space: • Leadership of MoD through information technology • Cyber Defence of MoD • Cyber Operations of MoD • Other important issues: • Cooperation • Personnel • Technology

5. Cyber defence • Cyber hygene • Inside threats • Outside threats • Monitoring • Prevention, detection, response, recovery • Forensic • etc

6. Cyber operations • Legal and law enforcement • Public relations • Gathering and analyzing electronic information • Using “red” teams in exercises • etc

7. Subordinate documents • Documents in subordinate establishments • ICT Development Plan (for leadership in an establishment) • Cyber Defence Development Plan • Cyber Operations Development Plan • etc

8. Cyber space implementation

9. Organization • ICT consolidation to Defence Forces • Cyber Defence • Defence Forces (CIRC) • Defence League (Cyber Unit) • Cyber Operations • MoD • Defence Forces • Defence League • Information’s Agency

10. Defence League Cyber Unit • Voluntary ogranization • Mission is to protect Estonia’s high-tech way of life, including protection of information infrastructure and supporting broader objectives of national defence • development of cooperation among qualified volunteer IT specialists • education and training in information security • participation in international cyber security training events

11. Personnel • Mixed environment of civilians and military personnel • Different nations in CCDCOE • Recruits with ICT education serve in Signal Battalion

12. Infrastructure • Inside communication through MoD owned infrastructure • Defence Forces is a Provider Independent ISP • Basic capability to maintain own infrastructure • Cyber Lab (exercise environment)

13. Technological areas • Intrusion detection/prevention systems • Antivirus • Data loss prevention • Removable media encryption • Web filtering • Mobile device security • Log collection and correlation

14. Resource allocation • ICT Development Council • Large investments • Projects that influence entire MoD governance area • Resources for cyber defence and cyber operations mainly in Defence Forces and Defence League • Resource sharing between establishments • R&D with universities

15. Domestic cooperation • Government coordination • Estonian Information System’s Agency • CERT-EE • Universities • “Cyber Security” masters programe • Coming soon: “e-Governance Innovation” and “Cyber Forensic” (not yet confirmed)

16. Foreign cooperation • Mainly NATO and NATO members • NCIA • NCIRC • Nordic countries • Finland • Sweden

17. Thank you