1. © 2015 ABI Research www.abiresearch.com The material contained herein is for the individual use of the purchasing Licensee and may not be distributed to any other person or entity by such Licensee including, without limitation, to persons within the same corporate or other entity as such Licensee, without the express written permission of Licensor. ITU Regional Development Forum for Europe on “Broadband for Sustainable Development” 20 – 22 April 2015, Bucharest, Romania Regional Initiative EUR4 Building confidence and security in the use of telecommunications/ICTs Tym Kurpeta kurpeta@abiresearch.com

2. © 2015 ABI Research www.abiresearch.com The material contained herein is for the individual use of the purchasing Licensee and may not be distributed to any other person or entity by such Licensee including, without limitation, to persons within the same corporate or other entity as such Licensee, without the express written permission of Licensor. Introduction Context o World Telecommunication Development Conference 2014 o EUR4 Building confidence and security in the use of telecommunications/ICTs ITU and Cybersecurity o The Global Cybersecurity Agenda & other initiatives o Child Online Protection ITU/ABI Research Global Cybersecurity Index o Measuring and Ranking Cybersecurity Commitment o Results and case studies Agenda.

3. © 2015 ABI Research www.abiresearch.com The material contained herein is for the individual use of the purchasing Licensee and may not be distributed to any other person or entity by such Licensee including, without limitation, to persons within the same corporate or other entity as such Licensee, without the express written permission of Licensor. Context The World Telecommunication Development Conference 2014 (WTDC-14) approved five Regional Initiatives for Europe (RI-EUR): EUR1 Spectrum management and transition to digital broadcasting; EUR2 Development of broadband access and adoption of broadband; EUR3 Ensuring access to telecommunications/ICTs, in particular for persons with disabilities; EUR4 Building confidence and security in the use of telecommunications/ICTs; EUR5 Entrepreneurship, innovation and youth.

4. © 2015 ABI Research www.abiresearch.com The material contained herein is for the individual use of the purchasing Licensee and may not be distributed to any other person or entity by such Licensee including, without limitation, to persons within the same corporate or other entity as such Licensee, without the express written permission of Licensor. ITU & Cybersecurity ITU Global Cybersecurity Agenda (GCA) is a framework for international cooperation aimed at enhancing confidence and security in the information society. The GCA is designed for cooperation and efficiency, encouraging collaboration with and between all relevant partners and building on existing initiatives to avoid duplicating efforts. The GCA has fostered initiatives such as: Child Online Protection (COP) The Global Cybersecurity Index (GCI) The ITU-IMPACT Partnership National CIRT Programme

5. © 2015 ABI Research www.abiresearch.com The material contained herein is for the individual use of the purchasing Licensee and may not be distributed to any other person or entity by such Licensee including, without limitation, to persons within the same corporate or other entity as such Licensee, without the express written permission of Licensor. Child Online Protection ABI Research is a key private sector partner in ITU’s Child Online Protection initiative

6. © 2015 ABI Research www.abiresearch.com The material contained herein is for the individual use of the purchasing Licensee and may not be distributed to any other person or entity by such Licensee including, without limitation, to persons within the same corporate or other entity as such Licensee, without the express written permission of Licensor. Child Online Protection Key areas: Legal measures Technical and Procedural Measures Organizational Structures Capacity Building International Cooperation Key objectives: ​ Identify risks and vulnerabilities to children in cyberspace Create awareness Develop practical tools to help minimize risks Share knowledge and experience

7. © 2015 ABI Research www.abiresearch.com The material contained herein is for the individual use of the purchasing Licensee and may not be distributed to any other person or entity by such Licensee including, without limitation, to persons within the same corporate or other entity as such Licensee, without the express written permission of Licensor. Global Cybersecurity Index A Joint Collaborative Project between the ITU and ABI Research

8. © 2015 ABI Research www.abiresearch.com The material contained herein is for the individual use of the purchasing Licensee and may not be distributed to any other person or entity by such Licensee including, without limitation, to persons within the same corporate or other entity as such Licensee, without the express written permission of Licensor. Aims of the Project Promote Government Strategies at a National Level Integrate Security into the Core of Technological Progress Foster a Global Culture of Cybersecurity Drive Implementation Efforts Across Industries and Sectors Goals Measure and Rank Each Nation State’s Level of Cybersecurity Commitment Objective

9. © 2015 ABI Research www.abiresearch.com The material contained herein is for the individual use of the purchasing Licensee and may not be distributed to any other person or entity by such Licensee including, without limitation, to persons within the same corporate or other entity as such Licensee, without the express written permission of Licensor. Conceptual Framework 1.Legal Criminal Legislation Regulation and Compliance 2.Technical CERT/CIRT/CSIRT Standards Certification 3.Organizational Policy Roadmap for Governance Responsible Agency National Benchmarking 4.Capacity Building Standardization Development Manpower Development Professional Certification Agency Certification 5.Cooperation Intra-state Cooperation Intra-agency Cooperation Public-private Partnerships International Cooperation Following the Global Cybersecurity Agenda Framework, the GCI identifies 5 indicators

10. © 2015 ABI Research www.abiresearch.com The material contained herein is for the individual use of the purchasing Licensee and may not be distributed to any other person or entity by such Licensee including, without limitation, to persons within the same corporate or other entity as such Licensee, without the express written permission of Licensor. Timeframe and Project Activities The project represents a combined effort of 18 months, from inception to publication. As well as a global rank, the GCI averages ranks in 6 regions: Arab States Europe Asia-Pacific Americas Commonwealth of Independent States Africa GCI Research Phases

11. © 2015 ABI Research www.abiresearch.com The material contained herein is for the individual use of the purchasing Licensee and may not be distributed to any other person or entity by such Licensee including, without limitation, to persons within the same corporate or other entity as such Licensee, without the express written permission of Licensor. Primary Research Arab States 73% Arab States 73% Africa 68% Asia-Pacific 64% Americas 37% Europe 37% CIS 25% Response Rate Surveys sent out to all ITU Member States Available in English, French, and Spanish 103 total responses received

12. © 2015 ABI Research www.abiresearch.com The material contained herein is for the individual use of the purchasing Licensee and may not be distributed to any other person or entity by such Licensee including, without limitation, to persons within the same corporate or other entity as such Licensee, without the express written permission of Licensor. GCI Results: Top 5 CountryIndexGlobal Rank United States of America0.8241 Canada0.7942 Australia0.7653 Malaysia0.7653 Oman0.7653 New Zealand0.7354 Norway0.7354 Brazil0.7065 Estonia0.7065 Germany0.7065 India0.7065 Japan0.7065 Republic of Korea0.7065 United Kingdom0.7065

13. © 2015 ABI Research www.abiresearch.com The material contained herein is for the individual use of the purchasing Licensee and may not be distributed to any other person or entity by such Licensee including, without limitation, to persons within the same corporate or other entity as such Licensee, without the express written permission of Licensor. GCI Results: Heat Map

14. © 2015 ABI Research www.abiresearch.com The material contained herein is for the individual use of the purchasing Licensee and may not be distributed to any other person or entity by such Licensee including, without limitation, to persons within the same corporate or other entity as such Licensee, without the express written permission of Licensor. URUGUAY Regulatory Framework on Cybersecurity Policy on Information Security in Public Sector Information Security Direction National Computer Incident Response Centre CERTuy Decree Personal data protection and habeas data action Act EU Commission decision on the adequate protection of personal data by Uruguay (2012) Uruguay became the first non-European state to join COE's personal data protection convention (2013). LEGAL MEASURES

15. © 2015 ABI Research www.abiresearch.com The material contained herein is for the individual use of the purchasing Licensee and may not be distributed to any other person or entity by such Licensee including, without limitation, to persons within the same corporate or other entity as such Licensee, without the express written permission of Licensor. OMAN TECHNICAL Oman National Computer Emergency Readiness Team (OCERT) Oman’s Information Security Management Framework is part of the overall ITA standards framework and is based on a structured collection of independent guidelines, processes, and practices, primarily from ISO 27001. Information Technology Authority (ITA) as a parent organization of OCERT is ISO 27001 certified and encouraging all organizations to adopt and implement the ISO 27001 framework. Through the cybersecurity professional development service, OCERT is providing professional cybersecurity training in different security domains by providing information security competency and capability courses and certifications. The training is categorized to three levels (Level 3, Level 2, and Level 1, with Level 1 being the most senior level).

16. © 2015 ABI Research www.abiresearch.com The material contained herein is for the individual use of the purchasing Licensee and may not be distributed to any other person or entity by such Licensee including, without limitation, to persons within the same corporate or other entity as such Licensee, without the express written permission of Licensor. TURKEY ORGANIZATIONAL The National Cybersecurity Strategy and Action Plan 2013-2014 The action plan consists of 29 main actions and 95 sub-actions and assigns responsibilities about legislation, capacity building, development of technical infrastructure, etc. The Cybersecurity Board was established in order to determine the measures regarding cybersecurity; to approve the prepared plans, programs, reports, procedures, principles, and standards; and ensure their application and coordination. In the last 3 years, three cybersecurity exercises were organized at the national level with participants from both the public and private sector. The exercises played a big role in raising awareness of cybersecurity and also were a great tool for measuring the development of cybersecurity.

17. © 2015 ABI Research www.abiresearch.com The material contained herein is for the individual use of the purchasing Licensee and may not be distributed to any other person or entity by such Licensee including, without limitation, to persons within the same corporate or other entity as such Licensee, without the express written permission of Licensor. AZERBAIJAN CAPACITY BUILDING Azerbaijan Ministry of Communications and High Technologies has officially recognized national or sector-specific research and development programs/projects for cybersecurity standards, best practices, and guidelines to be applied in the private and the public sector. The Technical Committee is to implement the preparation of national standards on the basis of international (regional) and interstate standards. Azerbaijan conducts short training courses on E-government and information security. AZ-CERT organizes capture-the-flag competitions to enhance professional competence in information security. The IT and Communications Department of the State Oil Company of Azerbaijan Republic (SOCAR) is certified under ISO 27001:2005. SOCAR IT and Communications Department is certified under ISO 27001:2005.

18. © 2015 ABI Research www.abiresearch.com The material contained herein is for the individual use of the purchasing Licensee and may not be distributed to any other person or entity by such Licensee including, without limitation, to persons within the same corporate or other entity as such Licensee, without the express written permission of Licensor. REPUBLIC OF KOREA KISA has in place a number of memorandums of understanding on cybersecurity cooperation with the following: OCSIA (United Kingdom), INCB (Israel), Australia, CNCERT (China), STS (Kazakhstan), CERT Romania, Korea-China-Japan CERT, and private sector cooperation with Microsoft, Checkpoint, and McAfee. Information Communications Infrastructure Protection Committee to decide and deliberate on protection of critical ICT infrastructure to guarantee national security and stabilize the life of the people National Cybersecurity Conference: Private/public/military response team (Article 8) organized and operated for decision-making on cyberthreats, situation monitoring, analyzing of threats, and joint investigation Cooperation and participation in meetings with APCERT (Asia-Pacific Computer Emergency Response Team), FIRST (Forum of Incident Response and Security Teams) COOPERATION

19. © 2015 ABI Research www.abiresearch.com The material contained herein is for the individual use of the purchasing Licensee and may not be distributed to any other person or entity by such Licensee including, without limitation, to persons within the same corporate or other entity as such Licensee, without the express written permission of Licensor. ROMANIA Romania ranked no.13 in Global Ranking, among Indonesia and Luxembourg. In Regional Ranking Romania ranked no. 10, ahead of inter alia Lithuania, Switzerland and Bulgaria. Legal: The Budapest Convention, Anti-Corruption Law, Cyber Security Strategy and the National Action Plan Technical: officially recognized national CIRT – CER-RO, as well as a few sectorial CERTs Organizational: Romania’s Cyber Security Strategy – officially recognized national strategy; The National Action Plan on implementation of the Romania’s Cybersecurity Strategy – national governance roadmap Cooperation: Romania is a member of the ITU-IMPACT initiative. Romania is affiliated with ENISA and TERENA. CERT-RO is a member of FIRST. Romania ranked no.13 in Global Ranking, among Indonesia and Luxembourg. In Regional Ranking Romania ranked no. 10, ahead of inter alia Lithuania, Switzerland and Bulgaria. Legal: The Budapest Convention, Anti-Corruption Law, Cyber Security Strategy and the National Action Plan Technical: officially recognized national CIRT – CER-RO, as well as a few sectorial CERTs Organizational: Romania’s Cyber Security Strategy – officially recognized national strategy; The National Action Plan on implementation of the Romania’s Cybersecurity Strategy – national governance roadmap Cooperation: Romania is a member of the ITU-IMPACT initiative. Romania is affiliated with ENISA and TERENA. CERT-RO is a member of FIRST. CASE STUDY

20. © 2015 ABI Research www.abiresearch.com The material contained herein is for the individual use of the purchasing Licensee and may not be distributed to any other person or entity by such Licensee including, without limitation, to persons within the same corporate or other entity as such Licensee, without the express written permission of Licensor. GCI 2.0 The Global Cybersecurity Index will have a 2.0 iteration The project will be open to participation with new partner organizations that wish to contribute to the GCI 2.0 research and development. Why Participate as a GCI Partner? Cooperation is an intrinsic element of cybersecurity and we encourage the sharing of information at this international level. Better measurement capabilities will provide better support for cybersecurity development at the nation state level.

21. © 2015 ABI Research www.abiresearch.com The material contained herein is for the individual use of the purchasing Licensee and may not be distributed to any other person or entity by such Licensee including, without limitation, to persons within the same corporate or other entity as such Licensee, without the express written permission of Licensor. Contact Information International Telecommunication Union Rosheen Awotar-Mauree, Cybersecurity Officerrosheen.awotar@itu.introsheen.awotar@itu.int Marco Obiso, Cybersecurity Coordinatormarco.obiso@itu.intmarco.obiso@itu.int Luc Dandurand, Head, ICT Applications and Cybersecurity Division luc.dandurand@itu.intluc.dandurand@itu.int ABI Research Tymoteusz Kurpeta, Project Manager kurpeta@abiresearch.comkurpeta@abiresearch.com Michela Menting, Practice Directormenting@abiresearch.commenting@abiresearch.com Aaron Boyd, Chief Strategy Officerboyd@abiresearch.comboyd@abiresearch.com Stuart Carlaw, Chief Research Officercarlaw@abiresearch.comcarlaw@abiresearch.com GCI Website http://www.itu.int/en/ITU-D/Cybersecurity/Pages/GCI.aspx