What to learn from the leading countries in cybersecurity

The United States, the United Kingdom and Estonia are the most cybersecure countries in the world, according to the 2020 Global Cybersecurity Index of the International Telecommunications Union (ITU). What can we learn from them?

The hacking of the Secretariat of National Defense (Sedena) by the Guacamaya cyberactivists is too serious to limit the debate in disqualifications to the 4T government and the institutions for not giving importance to an issue that deserves it by itself.

Mexico is located in position 52 of the ITU index and has a regulatory, institutional and coordination chaos in the matter that seeks to be resolved through a Federal Cybersecurity Law. Before that, Mexico has not defined how to address its approach to cybersecurity, so it should open the debate to all interested parties before imposing legislation.

The hacking of Sedena should serve and be a lesson to strengthen cybersecurity in the country.

The rapid development of digital technologies has contributed to the advancement of the economy, competitiveness, the well-being of the population and the improvement of public services. But with greater connectivity and dependence on the Internet, new challenges arise, one of them being cybersecurity.

The United States addresses cybersecurity through statutes, regulations and, above all, requirements to private industry. The Cybersecurity Information Exchange Act (CISA) allows for the exchange of Internet traffic information between the federal government and technology companies.

At the federal level, numerous agencies enforce cybersecurity standards. The goal is for health care organizations, financial institutions, and federal agencies to protect their systems and information.

An interesting aspect of the US is its local laws. State governments have taken steps to improve cyber security after various incidents by sharing public-private information.

In California, companies that process personal data of citizens who suffer a privacy violation must notify the attack and disclose the details of the event. Local regulation punishes companies for cybersecurity failures. Companies proactively invest in cybersecurity to avoid reputational and financial loss.

The UK has not one but many cyber laws based on statutes and backed by civil actions in common law (customs, practices and beliefs accepted as binding community norms).

The Data Protection Law and the Privacy and Electronic Communications Regulation for telecommunications service providers stand out. There are relevant sanctions for both negligent managers, non-compliance and the lack of adequate security measures to protect personal data.

Cybersecurity regulations oblige all companies and organizations that process data of the inhabitants. The legislation adopts a risk-based approach and cooperation between the authority and the private sector.

The government addresses this risk through a National Cyber ​​Security Center (NCSC) that is required to protect critical services, manage major incidents, and enhance security with technology and advice.

The NCSC devises a five-year National Cyber ​​Security Strategy to educate, develop digital skills, raise awareness, assist small businesses and organizations, enhance cybersecurity safeguards, defend against, deter, mitigate the risks and effects of attacks, and develop cyber defense.

The National Cyber ​​Security Strategy 2017-2021 had a budget of 1.9 billion pounds sterling, more than double that of the first strategy (2011-2016). The NCSC just published the third generation of the National Cyber ​​Security Strategy.

Estonia addresses cybersecurity as part of comprehensive security, in the context of the North Atlantic Treaty Organization (NATO) and national security. The NATO Cyber ​​Defense Cooperative Center of Excellence is located in Tallinn, the capital of Estonia.

Estonia embraced technology, the Internet and innovation as part of its nation project. It has an identification and digital identity for each citizen that allows access to online public services. Therefore, it invests money and resources to guarantee the resistance of its networks.

Understands the global nature of threats in cyberspace and the need for coordinated international and multilateral action. Estonia is an international role model and its strategy is to build international cybersecurity standards, rules of behavior in cyberspace, promote international cooperation in cybersecurity with allies and technological, legislative and diplomatic partners. It seeks to apply international law to conflict and cyber warfare.

Estonia has both a National Cyber ​​Security Strategy and a Cyber ​​Security Law, as well as a Cyber ​​Diplomacy Department located in the Ministry of Foreign Affairs.

Estonia’s focus is cyber diplomacy, international cooperation, exchange, investment, legal entrepreneurship and innovation.

These three countries have taken cybersecurity as a serious, strategic and national security issue. Today they are leaders in cybersecurity because at the time they knew how to react after serious cyberattacks on their institutions and infrastructures. Each one has different approaches, so Mexico must make an accurate diagnosis of what it wants to protect in cyberspace and what its approach to cybersecurity is.

Twitter: @beltmondi