As a consequence of the work that the Oceania Cyber Security Centre (OCSC) has completed in the Pacific, a common theme has emerged.  From numerous cyber maturity assessments, cyber roadmaps to outcomes reports from conferences and workshops, it is clear that cybersecurity capacity building (CCB) is not a set and forget exercise. Just like the ever-changing threats that the cyber ecosystem aims to combat, CCB efforts must be continuously evaluated, adapted and customised to meet the specific challenges of each country and to ensure maximum value and effectiveness.

Consequently, OCSC has developed the Cybersecurity Capacity Lifecycle. This Lifecycle articulates the relationship between the Cybersecurity Capacity Maturity Model for Nations (CMM), the OCSC Cybersecurity Roadmap, external CCB activities, and provides an emphasis on continuous and subsequent re-evaluations to ascertain how a country’s cyber resilience and maturity is improving. Instead of interpreting each of the described elements as standalone projects or entities, the OCSC Cybersecurity Capacity Building Lifecycle seeks to evaluate them as interrelated parts in a holistic view of cyber capacity-building along the journey to improve cyber maturity.

Each stage of the Lifecycle is sequential as follows:

Stage 1 – the CMM as an initial benchmarking exercise

An initial CMM serves as the first stage of the Cyber Capacity Lifecycle. At the request of the recipient country, OCSC assesses the country’s cyber maturity across 5 Dimensions that together constitute a nation’s capacity to effectively deliver cybersecurity. The CMM empirically plots the recipient country’s cyber maturity across Policy and Strategy, People and Culture, Cybersecurity Knowledge and Capabilities, Legal and Regulatory Frameworks, and Standards and Technology. From this, a series of recommendations are provided where the country can commence their journey to improve their cyber resilience and capacity.

This initial CMM provides a benchmark on the recipient country’s cyber maturity, and an evidence base for ongoing CCB activities and is the entry point for the subsequent stages of the Cyber Capacity Lifecycle.

Stage 2 – The CMM report and its recommendations are reviewed by recipient country

The CMM report is then reviewed by the recipient country to ensure that all relevant stakeholders are represented, and all priorities are addressed. This collaborative approach ensures that the assessment is owned and led by the recipient country. The codesign of the journey forward is crucial to the success of cyber capacity building and in ensuring that the progress toward cyber maturity remains under  the recipient countries control.

Stage 3 – The OCSC Cybersecurity Roadmap is developed in partnership with the recipient country

The OCSC Cybersecurity Roadmap is informed by the outcomes of the CMM whereby further engagement and consultation can be conducted to test specific priorities and actions. Developed with the country’s unique circumstances and context in mind, the recommendations provided in the CMM are developed into short-, medium- and long-term priorities that together create an implementable Roadmap toward improved cyber resilience.

This process provides a sequential, time-bound process for organising the steps required by a country to progress in their Cyber Capacity Lifecycle. The Roadmap grounds subsequent activities and interventions into an evidence-base structure, saving on resources and inefficiencies later.

Stage 4 – CCB development programs are implemented, in coordination with donor partners and the wider CCB community

In line with the recommendations from the CMM and the subsequent Roadmap, the recipient country is then connected to the wider capacity building community, where the aim is for implementors to deliver CCB interventions addressing specific recommendations stemming from the Roadmap. Interventions should be selected for their suitability to address the country’s priorities as depicted in the Roadmap.

The objective of working with the wider CCB community is to ensure that projects are developed and delivered responsive to the needs of the recipient country, as articulated in the Roadmap. Therefore, programs should be considered together as part of the one ecosystem which enables better streamlining and needs-based allocation of funding and resources.

Stage 5 – Subsequent reevaluation using a CMM to empirically assess where progress has been made

Following the completion of the priorities identified in the OCSC Cybersecurity Roadmap, subsequent re-evaluation assesses the interventions conducted between the review period. This independently and objectively evaluates the effectiveness, impact, and value of CCB activities conducted in the interim period and outlines next steps to further progress. By using the same methodology, the CMM and Roadmap can consistently assess the success of both their own application, along with the application of any other CCB activities that might have been conducted. This not only improves the recipient country’s cyber maturity, but also provides an objective measurement of CCB projects more generally.

The Cyber Capacity Lifecycle then restarts, building on the knowledge gleaned from reassessment to further build a country’s cyber resilience which continues to grow as the cycle repeats. The OCSC Cyber Capacity Lifecycle, CMM Assessments and Cybersecurity Roadmap each evolve to incorporate new threats as they emerge. The cyclical and dynamic nature of the Cyber Capacity Lifecycle ensures that countries can remain responsive to the changing and evolving landscape of cybersecurity and can adjust accordingly to their own national contexts and priorities.

Despite geographic, cultural, and contextual differences, and irrespective of the location of a cyber capacity building (CCB) project, it is universally acknowledged that “one size does not fit all”. As such, CCB interventions must take into account the unique national context, priorities, and resources of the recipient country. The question then arises: how do CCB practitioners consider these unique dynamics, under the assumption that that one size indeed does not fit all? It is here that the Cybersecurity Capacity Maturity Model for Nations (CMM) Review provides direction. As an assessment of a country’s cyber maturity, the CMM provides an extensive, holistic, and rich understanding of the national context, and identifies priorities for improvement. However, a second crucial question remains: What happens next?

The CMM provides a comprehensive review of a country’s cyber capacity, through a series of stakeholder consultations and associated research. The review takes a holistic approach to cyber, looking beyond IT to include policy, legislation, culture, and more. The review process helps governments to engage with their stakeholders and identify their own priorities, supported by evidenced-based specific recommendations to address identified gaps across 5 key dimensions of a country’s national capacity. Subsequent reassessment identifies what actions based on these recommendations have been successful, but an impasse that many countries reach is how to in actual fact implement these recommendations.

The Oceania Cyber Security Centre (OCSC) Cybersecurity Roadmap was born out of this challenge. The Roadmap serves as a manner of providing a clear, evidence-based pathway for host and donor countries to direct and implement CCB priorities. This is done through the sequential mapping of the recommendations provided within the CMM report into short-, medium-, and long-term goals based on the unique context, resources, and priorities of the host nation. Following the completion of the CMM report, OCSC’s Research and Capacity Team conduct a series of consultations, and validation workshops with key stakeholders within the host country, identifying what actions to focus on across a phased timeline according to what is achievable for the country and subject to their own priorities.

The OCSC Cybersecurity Roadmap provides an evidence-based path for CCB activities, enabling host countries to gain a clear direction for their journey to improve their cyber maturity. It further empowers these countries to identify projects and implementors best suited to their unique needs and priorities, enabling them to refocus efforts on areas of importance and saving valuable time and resources. The codesigned nature of the CMM and the OCSC Cybersecurity Roadmap further ensures that the journey to improve cyber maturity remains led and owned by the recipient country.

Additionally, if recipient countries share their roadmap with their partners, then it can provide an evidence base for donor countries to direct their cyber capacity building programs. Instead of focusing on ad-hoc and siloed projects, programs can instead prioritise funding in a needs-based and streamlined direction, informed by the data and recommendations of beneficiary countries’ CMMs and Roadmaps. This can in turn reduce waste and inefficiencies within programs, enabling a more effective use of funding.

The cyber capacity building landscape presents a clear story: whilst there is no doubt of the good will in CCB programs, there are clear inefficiencies and challenges at hand. A more tailored, direct, and streamlined approach is possible to properly address the issue of “one size does not fit all”. The OCSC Cybersecurity Roadmap plots the chart through the challenging and ever-changing terrain of cybersecurity, guiding the pathway to improving a country’s cyber maturity.

The Post Quantum Cryptography in the Indo-Pacific Project (PQCIP) is providing free training to government organisations and businesses from across the Indo-Pacific to help them prepare for emerging quantum computing threats.

Currently we rely on traditional encryption methods as one of the tools in the digital toolbox to protect our information. However, with new advances in quantum computing technology, the protection offered by traditional encryption methods is at risk. Currently deployed cryptography is not strong enough to withstand attacks from future large-scale quantum computers, which will become a reality in the coming years. Post-quantum cryptography involves mathematical techniques for ensuring that information stays private, or is authentic, and resists attacks by both quantum and non-quantum (i.e. classical) computers.

The PQCIP is designed to help participants future-proof their systems with post-quantum cryptography. The program involves an assessment of each participant’s current cybersecurity capabilities followed by tailored educational programs conducted by cybersecurity experts that will train participants to deploy post-quantum cryptography. Each training module will be delivered by cryptography experts from Monash University, adapted to meet the local needs, and provided free of charge.
The team from Monash University and OCSC have more than 20 collective years of experience working in cybersecurity across a broad range of industries and regions. This includes working with post-quantum cryptography and cybersecurity standardisation, consulting in the public and private sectors, and providing advice on cyber strategy and policy to governments in the Indo-Pacific to strengthen their national cybersecurity resilience.

Participants will finish the program:

Registration for PQCIP is now open to interested individuals from businesses and government organisations in Malaysia, Indonesia and Pacific Island Nations.

The program is funded by the United States Department of State and will be provided free of charge to all approved participants. This program is not designed for military, intelligence, or law enforcement organisations. Applicants who are unsure of their eligibility are still encouraged to apply.

To register your interest, please provide your name, the name of the organisation you work for and your nationality in an email to: [email protected]

Associate Professor Ron Steinfeld from Monash University’s Faculty of Information Technology and Dr James Boorman from OCSC are available for interviews. Please visit the Program’s website for more information.