The federal cabinet is likely to approve the first ‘National Cyber Security Policy 2021’ on Tuesday.
Federal Minister for Information Technology and Telecommunication Syed Amin Ul Haque told ProPakistani that the Cabinet meeting scheduled for Tuesday would consider two agenda items of the Ministry. The Cabinet would deliberate on National Cyber Security Policy 2021 and policy directive for the auction of NGMS spectrum in Pakistan, Azad Jammu & Kashmir and Gilgit-Baltistan.
The Ministry of Information Technology and Telecommunication has drafted National Cyber Security Policy 2021, with guiding principle regard a cyber-attack on Pakistan as an act of aggression against national sovereignty and will defend itself with appropriate response measures and will act in accordance with national and international laws and expect reciprocal respect of our national digital sovereignty.
ALSO READ
Mobile Phone Imports Increase by Over 50% in FY21
The draft policy envisages developing secure and resilient cyber systems and networks for national cybersecurity and response.
The policy framework envisaged to secure the entire cyberspace of Pakistan including all information and communication systems used in both public and private sectors.
- The objective of the policy is to establish a governance and institutional framework for a secure cyber ecosystem
- Create protection and information sharing mechanisms (CERTs/ SOCs) at all tiers capable to monitor, detect, protect and respond against threats to national ICT/CII infrastructures
- Protect National Critical Information Infrastructure by mandating national security standards and processes related to the design
- Acquisition, development, use, and operation of information systems
- Enhance the security of government information systems and infrastructure
- Create an information assurance framework of audits and compliance for all entities in both public and private sectors
- Ensure the integrity of ICT products, systems, and services by establishing a mechanism of testing, screening, forensics and accreditation
- Develop public-private partnerships and collaborative mechanism through technical and operational cooperation
- Create a countrywide culture of cybersecurity awareness through mass communication and education programs
- Develop and create skilled cybersecurity professionals through capacity building, skill development and training programs.
To mitigate cyber threats the country faces today and to improve the national cybersecurity outlook, it is imperative to undertake the strengthening of national cybersecurity capabilities through the development of essential and well-coordinated mechanisms, implementation of security standards and regulations under a policy and legislative framework, it added.
The guiding principles to achieve policy objectives are;
- All actions will be driven by the need to protect people and enhance national and public prosperity
- Respective public and private organizations will be responsible to ensure the cybersecurity of their online data, services, ICT products, and systems, in case of any incident, the government will lead the national response with support from both public and private sector, will regard a cyber-attack on Pakistan CI/CII as an act of aggression against national sovereignty and will defend itself with appropriate response measures and will act in accordance with national and international laws and expect reciprocal respect of our national digital sovereignty.
ALSO READ
Pakistan’s IT Exports Cross $2 Billion Mark For The First Time
To achieve the objectives, an implementation framework shall be developed by a designated organization of the federal government, dealing with the subject of cybersecurity. This organization shall also act as the central entity at the federal level for coordination and implementing all cybersecurity-related matters.
National Level
The Central Entity along with its National Computer Emergency Response Team (nCERT) and National Security Operation Center (nSOC).
Sectoral Level
Sectoral Regulator(s)/ CERTs (Defense, Telecom, Banking and finance, Power, Federal and Provincial public sector).
Organizational Level
Enterprises, entities and individual users.
The Central Entity will also undertake specific actions which including but are not limited to the following:
- Working with Internet Service Providers (ISP) and telecom operators to block malware attacks
- By restricting access to specific domains or websites that are known sources of malware (known as Domain Name System (DNS) blocking/filtering)
- Preventing email phishing and spoofing activity on public networks, promoting security best practices through internet governance organizations; such as Internet Corporation for Assigned Names and Numbers (ICANN), the Internet Engineering Task Force (IETF), European Regional Internet Registry (RIPE) and UN Internet Governance Forum (IGF) etc;
- Work with international law enforcement channels to protect Pakistan citizens from cyber-attacks from unprotected infrastructure overseas;
- Work towards implementation of controls to secure the routing of internet traffic for government departments to avoid illegitimately re-routed by malicious actors;
- Investing in capabilities enhancement programs of law enforcement agencies (LEAs) and concerned ministries/divisions to enable them to respond against state-sponsored and criminal cyber activities targeting Pakistan networks and systems.
The Central Entity will initiate actions, including but not limited to:
- Develop an Internet Protocol (IP) reputation service to protect government digital services (this would allow online services to get information about an IP address connecting to them
- Helping the service get more informed on risk management decisions in real-time)
- Seek to install products on government networks to ensure that software is running correctly and not being maliciously interfered
- Look to expand beyond the gov.pk domain into other digital services measures that notify users who are running out-of-date browsers.
To achieve this critical objective, the Central Entity will;
- Operate requisite technical platforms to protect National Critical Information Infrastructure and work as nodal organization in the country;
- Institute processes for identification, prioritization, assessment and protection of Critical Information Infrastructure
- Ensure secure ICT environment including mobile systems and cloud-based solutions through state of the art security measures, mandate implementation of national security standards by all critical sector entities, to reduce the risk of disruption
- Develop a mechanism for protection of Critical Information Infrastructure and its integration at the entity level through relevant sectoral CERTs, establish and enforce risk management methodologies according to international standards inter alia ISO/IEC 27005:2008 and ISACA RISK IT etc, mandate all operators of national, provincial and organizational Critical Information Infrastructure to hire qualified information security individuals and add an appointment of Chief Information Security Officer (CISO).
To cater to the specific needs of public sector information infrastructure, the Central Entity will
- Define and enforce a robust Government Authentication and Data Protection Framework
- Create vulnerability assessment and patch management processes for all government technical systems
- Work with relevant government entities to ensure mandatory allocation of a certain percentage of ICT project budget for Information Security Assurance
- Formulate a mechanism for the creation and enforcement of staff vetting and clearance schemes across the government
- Improve security in government outsourcing and procurement through vetting of suppliers and enforcement of security clauses in contracts.
The implementation mechanism provided for this policy may require considerable time in order to be completely functional.
ALSO READ
WorldCall to Launch Careem/Uber Competitor Next Year
Therefore, during this interim time period, the capacities and capabilities which state organizations and institutions currently have and are supportive of the implementation of this policy will be utilized and their continued use will be integrated with an all-encompassing implementation mechanism.
The Pakistan Telecommunication Authority as per Telecom Act 1996, Telecommunications Policy 2015 and PECA 2016 will implement a telecom sector technical platform (sectoral CERT as provided herein) in collaboration with the telecom industry.
The post Cabinet to Approve National Cyber Security Policy 2021 Tomorrow appeared first on .
