INTRODUCTION

The 2017 Italian Cybersecurity Action Plan is intended to outline the actions required to meet the guidelines set forth by the National Strategic Framework for Cyberspace Security.

While updating the 2013 Action Plan, the current document aims at realizing a major step toward the full implementation of the Italian cybersecurity system.

The Plan outlines eleven action items, together with their associated objectives and implementing lines of effort, as required by article 3.1c of Prime Minister Decree February 17th 2017 on “guide-lines for cyberspace protection and IT national security”.

The Plan provides priority measures for the correct deployment of the National Strategic Framework for Cyberspace Security, involving all cybersecurity relevant stakeholders on a proactive and iterative basis.

The Plan was reviewed by CISR Ministries (Foreign Affairs, Interior/ Homeland Security, Defense, Justice, Economy and Finance, Economic Development) as well as cyber delegates from the Agency for Digital Italy and from the National Cybersecurity Management Board (established within the Prime Minister’s Military Advisor Office until February 2017).

NATIONAL STRATEGIC FRAMEWORK FOR CYBERSPACE SECURITY

Strategic guidelines

1. Strengthening national Critical Infrastructures and other strategic players’ defense capabilities.
2. Improving cyber actors’ technological, operational, and analytic capabilities.
3. Encouraging public-private cooperation.
4. Fostering cybersecurity culture.
5. Supporting international cooperation on cybersecurity.
6. Reinforcing counter-action capabilities against online criminal activities.

ITALIAN ACTION PLAN

Action items (AI)

AI 1. Reinforcing intelligence, law enforcement, and defence capabilities.

AI 2. Strengthening public-private cooperation.

AI 3. Fostering IT security culture. Education and training.

AI 4. International cooperation and cyber exercises.

AI 5. Incident prevention, response and remediation.

AI 6. Updating cybersecurity legislation and managing compliance at international level.

AI 7. Security protocols and standards compliance.

AI 8. Supporting industrial and technological development.

AI 9. Strategic and operational communication.

AI 10. Resources.

AI 11. Implementing national cyber risk management.

The review focused in particular on the following:

• AI 5 (Incident prevention, responseand remediation) which includes provisions to strengthen the existing CERTs, to create the structures required by the NIS Directive (CSIRT, national single point of contact, National Authorities) and to establish efficient coordination procedures among all current and future cybersecurity framework’s stakeholders (CERT, CSIRT, intelligence, law enforcement, defense, Agency for Digital Italy, etc.).
• AI 1 (Reinforcing intelligence, law enforcement, and defense capabilities) which, once updated according to the experience gained during the previous two years, aims at boosting national cybersecurity response capability.CORE TASKS
  • Review governance and responsibilities of the National Cybersecurity Management Board.
  • Simplify decision making procedure for cyber crises’ management.
  • Reduce complexity within the national cybersecurity framework through organizations’ suppression/merger.
  • CERTs’ gradual unification.
  • Creation of a national cybersecurity evaluation and certification center.
  • Creation of a venture capital fund or foundation.
  • Creation of a National Cybersecurity R&D Center.
  • Creation of a National Cryptographic Center.
  In order to ease a quick improvement of the national cybersecurity framework, a series of core tasks to be pursued with priority was identified (see box below). Tasks were chosen according with the review of the previous strategy and taking into account developments occurred both at national and international level.ITALIAN CYBERSECURITY CORE TASKS
  The Action Plan details the initiatives needed to achieve a step change in increasing national information system and network security levels, as required by Prime Minister Decree February 17th 2017.In spite of 2014-2015 efforts, the efficacy of measures adopted to protect networks and systems showed a patchy picture, with discrepancies persisting both horizontally —between public and private stakeholders— and vertically, within the same domain.National security sensitive information is not just a government business. Private entities operating in strategic sectors must be considered as key assets and included into a holistic approach to national cybersecurity that provides for the implementation of minimum security requirements for Country-critical systems.On these premises, the core tasks were selected for their systemic relevance due to the fact that they:
• Leverage the competences and responsibilities of all relevant stakeholders (public sector, private sector, research and academia).
• Refer to the most relevant activities aimed at consolidating the national cyber defense system including: as-sets’ common protection (CERT); SW/HW certification; identification of critical functions; info-sharing requirements in case of relevant cyber events; etc.Pending the transposition of the “EU Directive 2016/1148 concerning measures for a high common level of security of networks and information systems across the Union” into national legislation, the 2013 Italian cybersecurity framework has been revised and optimized through:
• The simplification of both ordinary and emergency management procedures (see AIs 1, 2, 5).
• The reorganization of the National cybersecurity framework (suppres-sion of the cyber NISP, new role for the National Cybersecurity Management Board/NSC, etc.) (see. AI 1).

• The simplification of the decision making for cyber crises’, aimed at facilitating prompt and efficient re-sponse and remediation (see AI 5).Of particular relevance are the measures intended to:
  • Assign to the Director General of the Security Intelligence Department a central role among the entities composing the National cybersecurity NATIONAL CYBER SECURITY FRAMEWORK National digital agendaCISRInter-ministerial Committee for Security of the RepublicCybersecurity National StrategyMinistry of InteriorMinistryT-CISR of Defence CNAIPIC National Anti-crime Computer Centre for the Protection of Critical Infrastructure DISPA-CERTITA-CERT Agency for Digital Italy Ministry of Economic Development NSCCIOC Joint Command for Cyber Operations AISE AISIENTERPRISESPA Through the Security Intelligence Unit of the Defence General StaffArt-7 bis Leg. Decree 30 Oct. 2015 n. 174 Prime Minister National Center for Evaluation and Certification ecosystem.
• Suppress the cyber NISP and relocate the National Cybersecurity Management Board within the Security Intelligence Department. The board will be responsible for cybersecurity crises’ management and will be supervised by a Security Intelligence Department Deputy Director.
• Promote close interaction between the National CERT and the Public Administration CERT in order to facilitate their operational coordination and guarantee a single detection capacity, alert, and first cyber incidents’assessment (see AIs 5, 6, 7).
• Establish a national evaluation and certification center, within the Ministry of Economic Development, responsible for security and reliability check of ICT components for Critical Infrastructures (see AI 7).
• Enlarge and better define the number of actors operating in security relevant sectors (Operators of Essential Services and Digital Service Providers) required to notify serious cyber incidents or else to pay effective, proportionate, and dissuasive penalties (see AIs 2, 5, 6).Italian Cybersecurity Core Tasks
  A real improvement of the Italian cybersecurity landscape cannot be achieved without full commitment of public and private stakeholders. For this reason, the Plan aims at engaging relevant private companies, academia and research centers (see AI 8).As far as the research sector is concerned, specific initiatives —possibly backed by a legal entity (eg. founda-tion)— aim to (see AIs 2, 6, 7):
  • Support start-ups or other relevant entrepreneurial activities (through venture capital funds).
    UPDATED CYBERSECURITY CRISIS MANAGEMENT SYSTEM
  • Create a National Cybersecurity R&D Center responsible —among other things— for developing malware analysis, security governance, Critical Infrastructures’ protection, threat analysis, etc.
  • Create a National Cryptographic Center responsible for codes/algo-rithms and blockchain development and security assessments.Regarding the public sector, key institutions are called upon to take part in a systemic, coherent, and detailed intervention to improve national cybersecurity.In particular, the new National Cybersecurity Management Board, at the center of the Italian cybersecurity framework, aims at facilitating governance simplification by cutting decision-making processes short and rationalizing both ordinary and emergency procedures.The Ministry of Interior (in particular, the National Anti-crime Computer Centre for the Protection of Critical Infrastructure CNAIPIC) plays a key role in protecting IT Critical Infrastructures thanks to its investigative and forensic capabilities.
    The Agency for Digital Italy’s responsibilities are equally relevant. The Agency is in charge of defining IT security guidelines and technical rules, setting standards, monitoring quality of public networks’ security and Public Administration’s ICT programs.The Ministry of Defense (MoD) developed specific cyber capabilities —to protect its networks at both national and international/operational level— which are also a significant asset for the National Cybersecurity Management Board’s improvement process.The Action Plan also aims at supporting the MoD on the following initiatives:
• Creation of a Joint Command for Cyber Operations in charge for MoD networks and systems protection, and cyber operations.
• Establishment of a virtual cyber range—to be located in Chiavari (Genova area) within the Armed Forces’ TLC School facility.Intelligence Community and MoD agreed on a specific protocol to align their strategies and tactics on cybersecurity in order to facilitate the consolidation of the perspective Joint Command for Cyber Operations in compliance with NATO recent posture.The Action Plan aims to secure national assets according to the following priorities:
• Level 1 — National security [Intelligence Community, Ministry of Defense, Ministry of Interior, Ministry of Foreign Affairs, Ministry of Justice, Ministry of Economy and Finance, Ministry of Economic Development].
• Level 2 — National Critical Infrastructures [TLC, utilities, financial Sector, transports] and other relevant Public Administrations (eg. Ministry of Health).
• Level 3 — National production system and population.

ACTION ITEM 1

REINFORCING INTELLIGENCE, LAW ENFORCEMENT, AND DEFENSE CAPABILITIES

National cyber protection and ICT security require an in-depth knowledge of both technological and human vulnerabilities as well as of the threat that exploit them.

ACTION ITEM 2

STRENGTHENING PUBLIC-PRIVATE COOPERATION

Cooperation among public stakeholders, as well as cooperation among public and private stakeholders, should be strengthened taking into account that Critical Infrastructures are managed and operated by private organizations. That is why interoperability among actors should be fortified at national and international level.

ACTION ITEM 3

FOSTERING IT SECURITY CULTURE. EDUCATION AND TRAINING

Until now cybersecurity education and training have been directed only to experts and cyber operators. There is now a need to promote the culture of cyber security among citizens, businesses and public administrations.

1. Develop, test, and validate cyberspace operational activities through simulation tools, joint exercises and trainings on-the-job.
2. Concentrate cyber training capacities in education excellence hubs, consolidating existing centers and facilitating direct involvement of private organizations (from Italy and abroad), EU and NATO members, and other partner Nations.
3. Develop partnerships with universities and research centers to set up trainings and specific courses for Public Administration and private compa-nies’ personnel.
4. Map national cybersecurity excellence centers.

ACTION ITEM 4

INTERNATIONAL COOPERATION AND CYBER EXERCISES

Cyber threats are transnational by definition. A common level of competence and interoperability is needed in order to counter them.

ACTION ITEM 5

INCIDENT PREVENTION, RESPONSE AND REMEDIATION

Computer Security Incident Response Team (CSIRT) —as defined by the NIS Directive— is responsible for actively support public and private operators in case of cyber attacks and disturbances. In the process of transposing the Directive, current public Computer Emergency Response Teams (National CERT and PA-CERT) will merge their tools and procedures in a coordinated cyber-incident management effort.

ber incident management model —with a specific focus on triage phases.

ACTION ITEM 6

UPDATING CYBERSECURITY LEGISLATION AND MANAGING COMPLIANCE AT INTERNATIONAL LEVEL

Uninterrupted growth and persistent progress of ICT solutions require continuous updates and high-paced legislation improvements in order to maximize national cybersecurity.

ACTION ITEM 7

SECURITY PROTOCOLS AND STANDARDS COMPLIANCE

High levels of network and information systems’ security require compliance with national and international standards and protocols

ACTION ITEM 8

SUPPORTING INDUSTRIAL AND TECHNOLOGICAL DEVELOPMENT

Security of hardware and software components, especially those adopted by Critical Infrastructures and national strategic operators, depends on security measures implemented on the entire value chain.

ACTION ITEM 9

STRATEGIC COMMUNICATION

Communication of an occurred cyber-event and about its consequences has a strategic value. Public and private stakeholder –when public awareness is needed– have to share precise, correct, and transparent information without generating unnecessary alarms nor increasing economic and social impacts.

ACTION ITEM 10

RESOURCES

Analysis of costs related to cyber events is a useful baseline for financial planning and allocation of resources, since risk relevance is proportional to event probability and impact. Adequate costs’ evaluation can also support intervention activities over specific vulnerabilities and redirect investments within both the public and the private sector.

ACTION ITEM 11

IMPLEMENTING NATIONAL CYBER RISK MANAGEMENT

Protection of data authenticity, integrity, confidentiality, availability —main target of cyber attacks— is a key task of the Plan.