ITU ranks USA most secure nation on Global Cyber Security Index, UK in tie for second with Saudi Arabia
- Reference: 1625033137
- News link: https://www.theregister.co.uk/2021/06/30/itu_global_cyber_security_index_2020/
- Source link:
The index ranks nations using 82 questions developed by a panel of experts. ITU members are asked to nominate a person to participate in the process, and the organisation conducts desk research on nations that choose not to play. All ITU members are then ranked on a 100-point scale.
The [1]report opens with good news: the median score for the 2020 index is 9.5 per cent higher than in the 2018 edition. Small nations also did well, and there were some big improvers.
[2]
Estonia, for example, ranked third. South Korea, Singapore and Spain tied or fourth, while Russia, United Arab Emirates and Malaysia shared fifth, followed by Lithuania, Japan, Canada, France and India.
[3]
[4]
India rose from 47th place to tenth.
[5]UK tells UN that nation-states should retaliate against cyber badness with no warning
[6]United States' plan to beat China includes dominating tech standards groups – especially for 5G
[7].org owner Internet Society puts its money where its mouth is with additional IETF funding
[8]UN warns of global e-waste wave as amount of gadgets dumped jumps 21% in 5 years
Another positive finding from the Index is that the number of governments that formed a national computer incident response team (CIRT) rose by 11 per cent since 2018, meaning around half of ITU members now have a CIRT (or CERT). Sixty-four per cent have adopted a national cybersecurity strategy (NCS), up from 58 per cent, and 70 per cent conducted cybersecurity awareness campaigns in 2020, up from 66 percent.
Thirty-eight nations scored 90 per cent or better.
The Index also addressed the need for individual training programs in various sectors. Despite a projected global shortage of half a million cybersecurity professionals for 2021, the report said countries weren’t developing sector-specific training. Over half do not have programmes tailored towards specific sectors or professions — like law enforcement, legal actors, SMEs, private companies, and government officials.
[9]
Indices ranking national cybersecurity are like buses: none for ages, then two at once — earlier this week British think tank The International Institute for Strategic Studies [10]published its own assessment and determined that the USA is the sole cyber superpower. ®
Get our [11]Tech Resources
[1] https://www.itu.int/en/ITU-D/Cybersecurity/Pages/global-cybersecurity-index.aspx
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YNxAwvrmrhSxafmXzoHItAAAAIM&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YNxAwvrmrhSxafmXzoHItAAAAIM&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YNxAwvrmrhSxafmXzoHItAAAAIM&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://www.theregister.com/2021/06/11/uk_ungge_cyber_norms_submission/
[6] https://www.theregister.com/2021/04/12/us_strategic_competition_act_tech_sections/
[7] https://www.theregister.com/2020/12/03/internet_society_ietf/
[8] https://www.theregister.com/2020/07/02/united_nations_warns_of_global_ewaste_wave/
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YNxAwvrmrhSxafmXzoHItAAAAIM&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[10] https://www.theregister.com/2021/06/29/international_institute_for_strategic_studies_cyber_study/
[11] https://whitepapers.theregister.com/
Putting Israel in the Europe region makes this report and the ITU a bit questionable.
To avoid having a Middle East or West Asia section, where Israel belongs to, they created an Arab States region. Well, Tunisia is not an Arab state, and neither is Morocco.
I wondered about that myself
Is there some sort of anathema around the words Middle East ?
Is it because the news has been referring to conflicts in the Middle East for the past fourty years (if not more) ?
Like it or not, it's the Middle East. Isreal is not part of Europe. It's not even guaranteed that the movements of tectonic plates will ever make that happen.
All about policies
The questions that this survey is based on asks questions about whether countries have plans and organisations in place.
For example, the first question about Technical measures is "Is there a National/Government CIRT/CSIRT/CERT?" and follow-ups are in the form of "Are the above mentioned CIRTs (CSIRT or CERT) affiliated with FIRST?"
There is no requirement for any of these processes or bodies to actually be effective. Just that there is a office door with a title on it.
As thereport is nothing more that an administrative exercise full of YES/NO questions. It does not address any realistic issues about the actual security of internet users or the number of hacks that succeeded or tried.
You get the impression that if these people were surveying national health services, they would be asking questions like "Do you have hospitals?" rather than inquiring about the diseases that affect people or the ages that they die.
Re: All about policies
I also get the impression that they've looked at how the US handles the issues and this is to check how like America's strategy the rest of the world is.
The proof of the pudding is usually in the eating so there should also be stats about the number of successful attacks/intrusions but I doubt most governments would be truthful about those....
El Dorado.... King Solomon Mines Minings Sourcing Leads in COSMIC Travel/Magical AIMystery Tours
IT's a Novel and Noble Wild West out there, with Injuns and Cowboys Morphed into Code Junkies and SMARTR Cookies Presenting Future Tested ProVision for Current Supply of Live Realisations for Universal Hosting.
Please note that is not a question requiring an answer or futile denial.
"Estonia, for example, ranked third"
Fourth surely?
They decided to give countries with the same score the same rank, so no, Estonia ranks 3rd because both the UK and Saudi Arabia rank 2nd.
Then you have Korea, Singapore and Spain that all rank 4th.
Once you understand the process, it becomes logical.
How would you rank the difference between the UK and Saudi Arabia given that they have the same score of 99.54 ?
Uhhh... you count the number of countries that have a higher score and add one. That is what the words "Estonia is 4th" mean: they mean there are 3 countries with a higher score. Whether some of those three have the same score or not is irrelevant - how could the ranking of Estonia change if the ITU discovered they had got the Saudi score wrong and added 0.01 to it?
Is this misunderstanding of ranking the reason the median appears to have increased?
Given the enormous farce that was the Aramco hack; and comes out a high-scoring country; really, this index serves no purpose. It is little more than an acknowledgement that some areas are more dreadful than others.
I would hazard a guess the results reflect those that have been on the receiving end of cyber attacks; and a therefore minimal number of outfits have reactively responded to them at a low level.
In industry I still see every major consumer OS launched from 1990 onwards in widespread circulation. Default passwords being used on industrial computers, routers and managed switches; and god knows what else.
The malpractise won't end until something is hit people really give a hoot about. Clever "theoretical" attacks like the side channel stuff causing so much consternation are great for academics, but until basic hygiene is dealt with it's rather redundant when there are much easier things to hit.
Sloppy report, worth the paper it's printed on.
Looked up the local country (AUS): the scatter-plot of the results is clearly buggy, so what else is wrong? We were pipped on "Technical Measures" by Mauritius, Khazakstan and Azerbaijan, so that's making a lot of sense, especially since we have essentially the same sorts of CERT bodies and reporting schemes as all of the other early-internet players. Scroll down a bit further and by the time you get to Serbia they've stopped bothering to score their dimensions out of 20, and are just making the numbers up. Reading a bit more deeply, it seems that the person in Australia who answered their questionnaire was someone at ASPI, a defense-industry funded think-tank who were among the loudest voices shouting down Huawai's role in 5G, not an actual government body or representative of any sort.
In short: don't bother. And treat anyone who makes reference to it in any forum with deep suspicion.
On the other hand, perhaps they're paying attention to our nationally-legislated ability to overrule mathematics and decrypt messages by official fiat.
Yeah, just in case Americans didn't already have a "come hack me bro" bullseye on their collective shirts, there's this.