{"id":20874,"date":"2016-10-11T15:06:23","date_gmt":"2016-10-11T22:06:23","guid":{"rendered":"https:\/\/www.paloaltonetworks.com\/blog\/?p=20874"},"modified":"2016-10-11T15:06:23","modified_gmt":"2016-10-11T22:06:23","slug":"gov-poland-expands-leadership-role-on-cybersecurity","status":"publish","type":"post","link":"https:\/\/www2.paloaltonetworks.com\/blog\/2016\/10\/gov-poland-expands-leadership-role-on-cybersecurity\/","title":{"rendered":"Poland Expands Leadership Role on Cybersecurity"},"content":{"rendered":"<p>At the end of September, I had the opportunity to attend the second annual <a href=\"http:\/\/cybersecforum.eu\/en\/\" rel=\"nofollow,noopener\"  target=\"_blank\">CYBERSEC EU conference<\/a> in Krakow, Poland. Organized by the Kosciuszko Institute (a prominent think tank), with support from Poland\u2019s Ministry of Foreign Affairs and NATO, the conference drew more than 700 attendees, including more than 100 speakers spanning government officials, industry experts and practitioners.\u00a0 While many speakers and participants were Polish, many also came from other central and eastern European countries\u2014such as Hungary, Slovakia and the Czech Republic\u2014as well as France, Germany, Belgium, the United Kingdom and the United States, among others.<\/p>\n<p>The focus of CYBERSEC EU was first and foremost on policy. Organizers emphasized the desire to develop and shape cybersecurity policy proposals for Poland and beyond. The conference\u2019s topics and themes represented multiple dimensions of Poland\u2019s efforts on cybersecurity policy, including domestic policies and its roles as a member of the European Union (EU) and a member of NATO.<\/p>\n<p>On a domestic level, the Polish government emphasized support for the \u201cfourth industrial revolution\u201d in the country, securing the ever-expanding government and private-sector services offered online, protecting citizens from data breaches, and driving an innovative Polish economy underpinned by leading-edge technical skills. Opening remarks delivered by State Secretary Krzysztof Szczreski on behalf of President Andrzej Duda made clear that Poland desires to be a leader in cybersecurity, both in terms of driving domestic and regional policy and of building up and leveraging its technical capacity.<\/p>\n<p>Various speakers described recent and planned activities under President Duda, who took office in 2015. The Ministry of Justice highlighted a more active and effective prosecutor\u2019s office to tackle cybercrimes. In July 2016, the Ministry of Digitalization launched a new National Cybersecurity Center (NCC), part of the Research and Academic Computer Network (NASK), Poland\u2019s leading data networks operator. The NCC will be active in four areas: research, operational tasks, training and analytics. Its mandates include coordinating cybersecurity efforts with various sectors such as banking, transportation, energy, and telecommunications. Poland also has strengthened its longstanding CERT, which has existed as part of NASK, expanding its availability from business hours to 24\/7. A multi-government agency \u201cState Administration Cluster\u201d also has been formed, aiming to de-silo and centralize IT operations and services, including those related to cybersecurity.<\/p>\n<p>More recently, the Ministry of Digitalization released on September 29 a <a href=\"https:\/\/mc.gov.pl\/files\/strategia_v_29_09_2016.pdf\" rel=\"nofollow,noopener\"  target=\"_blank\">new high-level cybersecurity strategy<\/a> (content is in Polish) that aims to achieve numerous goals within four years. The strategy still needs internal approval following discussions involving a range of stakeholders, but the topics covered in this version include:<\/p>\n<ul>\n<li>A new national CERT that will collect cyberthreat information from the government and publicly owned companies, redistributing this threat information to sub-CERTs;<\/li>\n<li>Securing critical infrastructure with an emphasis on energy, finance, transportation and healthcare;<\/li>\n<li>Creation of security clusters for selected verticals: energy, telecommunications, finance and local administration; and<\/li>\n<li>Education and training.<\/li>\n<\/ul>\n<p>In terms of government systems, the strategy emphasizes the need to invest in the security of the L7 (application) layer, which needs improvements. It also states that the Polish government will cooperate with public and private institutions, including vendors and telecom operators.<\/p>\n<p>If the strategy is accepted, further steps will commence: a final version, to be released later this year, will serve as a blueprint for a new law that Parliament will begin to craft in early 2017. The Polish government also will need to estimate expenditures and allocate additional financing for some efforts, such as the planned establishment of security operations centers (SOCs) and cybersecurity training and awareness. The forthcoming law also is meant to help Poland implement the EU\u2019s Network and Information Security (NIS) Directive (described in <a href=\"https:\/\/www.paloaltonetworks.com\/blog\/2016\/07\/passage-of-eu-nis-directive-is-a-milestone-but-next-steps-matter-even-more\/\" target=\"_blank\">my July 2016 blog post<\/a>), although with the items listed above, as well as expected provisions related to public-private partnerships mentioned by some speakers, the law will likely go beyond the framework outlined in the NIS (a scenario envisaged under the Directive).\u00a0 Some private-sector speakers stressed that Polish critical infrastructure sectors want to increase their cyber resilience (a goal of the NIS Directive) but that more efforts were needed to help inform Polish industry of how important cybersecurity is to their operations.<\/p>\n<p>The NIS Directive was the primary focus of the discussions around EU-wide efforts. \u00a0As a milestone law (the EU\u2019s first cybersecurity-specific legislation) that all EU member states must implement by May 2018, this was not a surprise per s\u00e9. \u00a0It was interesting, however, that much of the focus on NIS at this conference was on its provisions <a href=\"http:\/\/europa.eu\/rapid\/press-release_MEMO-16-2422_en.htm\" rel=\"nofollow,noopener\"  target=\"_blank\">calling for a pan-EU strategic Cooperation Group<\/a> comprised of representatives from the member states, the European Commission, and the European Union Agency for Network and Information Security (ENISA). Per the Directive, the Cooperation Group is to support and facilitate strategic cooperation and share information and best practices on risks, incidents, awareness-raising, training, and research and development (R&amp;D) among member states and to develop trust and confidence.<\/p>\n<p>Multiple speakers stressed the imperative of correctly launching and empowering this Cooperation Group to ensure it effectively facilitates the pan-EU coordination envisioned in the Directive. Some speakers voiced that EU member states more advanced in cybersecurity efforts should commit to share threat information with those member states at earlier stages of cybersecurity readiness. Speakers also urged the Cooperation Group to help to ensure the NIS Directive is implemented consistently across member states, noting the strong interconnectedness and interdependencies of so much critical infrastructure (CI) within the EU, whether in transportation, energy, banking, or other industry sectors.\u00a0 Finally, some Polish and other central and eastern European country speakers voiced support for the Directive\u2019s role in raising awareness of cybersecurity within their countries and driving changes in domestic policy and operational efforts they wanted to make.<\/p>\n<p>Finally, Poland\u2019s central role in NATO, and NATO\u2019s evolving role in cybersecurity, particularly following the NATO Warsaw Summit in July, was another primary discussion topic. The NATO Warsaw Summit had two main cyber-related outcomes.\u00a0 First, NATO Allied ministers formally <a href=\"http:\/\/www.nato.int\/nato_static_fl2014\/assets\/pdf\/pdf_2016_07\/20160708_160708-joint-NATO-EU-declaration.pdf\" rel=\"nofollow,noopener\"  target=\"_blank\">agreed to recognize cyberspace<\/a> as a war domain along with air, land, and sea operation. \u00a0They <a href=\"https:\/\/ccdcoe.org\/nato-recognises-cyberspace-domain-operations-warsaw-summit.html\" rel=\"nofollow,noopener\"  target=\"_blank\">also reaffirmed<\/a> the applicability of international law and NATO\u2019s defensive mandate for cyberspace; pledged to further develop NATO-EU cyber defense cooperation; and pledged to commit more resources to cyber defense capabilities.\u00a0 A question raised at CYBERSEC EU was how NATO countries would implement these commitments. One speaker opined that, despite a robust technical platform to support cyberthreat sharing, larger NATO member nations needed to increase actual threat sharing with smaller ones. Private sector entities can also play an important role here in expanding the cyber threat information sharing environment across NATO. As one such example, Palo Alto Networks has partnered with NATO\u2019s Malware Information Sharing Platform (MISP) to share cyber threat information and enhance the collective malware knowledge base among participating NATO country members.<\/p>\n<p>A strong theme running throughout CYBERSEC EU, voiced often by Polish officials, was the importance and value of partnerships in cybersecurity\u2014both among EU governments and NATO members as described above, as well as between the public and private sectors. Conference speakers emphasized that the private sector develops most of the technologies to combat cyberattacks, and also owns and operates most critical infrastructures on which economies depend.\u00a0 During the conference wrap-up, organizers played a video stating, \u201cthe role of business in delivering answers to some of the most pressing cybersecurity questions is absolutely crucial.\u201d One Polish industry speaker noted that partnerships are starting to emerge in Poland, albeit slowly.<\/p>\n<p>Poland\u2019s steps to date and plans for leadership as well as partnership in cybersecurity\u2014domestically, regionally, and globally\u2014are commendable. Palo Alto Networks believes strongly in the value of such partnerships, working with governments and others worldwide to develop and implement effective cybersecurity policies that protect our way of life in the digital age.\u00a0 We look forward to contributing to Poland\u2019s efforts to raise the level of cybersecurity and cyber resilience in Poland and beyond.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>At the end of September, I had the opportunity to attend the second annual CYBERSEC EU conference in Krakow, Poland. Organized by the Kosciuszko Institute (a prominent think tank), with support from &hellip;<\/p>\n","protected":false},"author":182,"featured_media":20199,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[155,484],"tags":[2772],"coauthors":[1873],"class_list":["post-20874","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity-2","category-government","tag-cybersec"],"jetpack_featured_media_url":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-content\/uploads\/2016\/09\/government-web-banner-650x300.jpg","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts\/20874","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/users\/182"}],"replies":[{"embeddable":true,"href":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/comments?post=20874"}],"version-history":[{"count":5,"href":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts\/20874\/revisions"}],"predecessor-version":[{"id":20892,"href":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts\/20874\/revisions\/20892"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/media\/20199"}],"wp:attachment":[{"href":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/media?parent=20874"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/categories?post=20874"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/tags?post=20874"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/coauthors?post=20874"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}