Information Assurance Advisory Council

1
CYBER HOOD WATCH Empowering the Digital Citizen
Dr Andrew Rathmell CEO, IAAC
9 December 2002 E-Crime Congress
2
Who am I?

• Research Leader
• CEO, IAAC
• Not for profit, cross-sector membership
  organisation
• Approx 70 organisations from across sectors
  public private
• To promote a Safe Secure Information Society
  through Thought Leadership Influence
  Networking

3
IAACs Vision

• Public Policy
• Manifesto Protecting the Digital Society
• Corporate Governance
• Engaging the Board Corporate Governance
  Information Assurance
• Citizens
• Engaging the Digital Citizen

4
The Wired Society

• In the wired society, security is everyones
  problem
• Effective management of your own risks and
  enforcement of a security policy for your
  organisation is not enough
• With universal (broadband) access to public
  services and e-business, the critical
  vulnerabilities in the system are more than ever
  located out in society

5
The Intelligent Society

• Citizens need to recognize their responsibility
  for protecting themselves to become risk-aware
  risk literate
• Society needs to become an intelligent,
  self-aware and self-healing system

Ethical Digital Citizens
6
What do Citizens Need?

• Awareness via information in an accessible form
• From trusted sources
• Based on facts, not hype
• Solutions that are easy to apply
• Somewhere to turn to when things go wrong

7
What are others doing?

• USA National Cyber-Security Alliance FTC
  campaign
• Belgium e-Security Platform
• Netherlands Safe Surfing

8
Cyber Hood Watch
To create a culture of security amongst the UKs
citizens

•  

Empowerment
Information Advice
Ethical responsible behaviour
Self-help
Building trusted electronic communities
9
The Concept

• Combine awareness/education with warnings/alerts
  in user-friendly language

National Awareness Campaign
National Alerting System National Reporting System
10
A National Awareness Campaign

• Grassroots initiatives need to be supported by a
  national awareness campaign, including
• A citizen-friendly web-site
• Educational materials coordinated with schools
  and UK Online
• A telephone/email help-line?
• Innovative tools (e.g. online games for kids)

11
A National Awareness Campaign Next Steps

• Clear identification of demographic gaps
• Partnership of central, local govt with private
  sector bodies and firms
• Civil society institutions
• Models Action 2000, public safety, safe surfing,
  UK Online
• Materials can be rapidly adapted created

12
National Alerting System

• Realtime information needed by citizens in an
  understandable actionable format
• Analogous models (virus alerting, terrorist
  warnings, flood weather warnings)
• Cascade system operating across multiple nodes,
  using variety of channels
• Direct alerting
• Via intermediaries

13
National Reporting System

• Reports to NISCC, NHTCU, etc for incident
  response/investigation aggregate data for threat
  analysis
• Feedback to users in the form of trusted risk
  analysis data. Need to
• Improve standard rigour of reports
• Increase volume of reports in a useable manner

14
Cyber Hood Watch Network Think National,
Organise Local
Education Awareness
Police responders
Solutions
Local CHW coordinator
Warnings Alerts
WARP
15
NISCC Information Sharing
Warning, Advice Reporting Points (WARPs)
Functions

• Issue Alerts Warnings from CERT/WARP network
• Act as helpdesk for Advice on Internet/Infosec
  problems
• Gather, sanitise, and share Incident Reports

16
The WARP model
WARP
e-COMMUNITY
Trade association, interest group, local
authority, industry sector
17
CHW WARPs
WARP
WARP
WARP
WARP
WARP
e-COMMUNITY
e-COMMUNITY
e-COMMUNITY
18
Next Steps

• Background info
• IAAC guides on Information Sharing Public
  Education
• EU work on Warning Information Sharing
• NISCC advice on information sharing initiative
• Get the strategy right, then..
• Awareness Campaign
• Develop plan, bring together stakeholders, secure
  funding, roll out sustainable campaign
• CHW scheme WARP pilot
• CHW Feasibility study in January 2003
• WARP pilots in 2003

19
To Participate
Andrew Rathmell, IAAC 01223 307711 andrew.rathme
ll_at_iaac.org.uk
www.niscc.gov.uk
20
(No Transcript)