GOVERNMENT of KENYA CYBERSECURITY STRATEGY Government of Kenya Ministry of Information Communications and Technology Telposta Towers 10th Floor Kenyatta Ave Nairobi Kenya ii February 2014 Executive Summary Global information and communication technology ICT growth has transformed how individuals businesses and governments produce and receive information Adoption of ICT into everyday life is widespread in Kenya The Government of Kenya is proud of this development and is actively encouraging its continued growth through national initiatives such as Kenya’s Vision 2030 ICT Master Plan and the recent deployment of nationwide fiberoptic network infrastructure Such efforts provide a dramatic increase in interconnectivity among businesses and individuals throughout Kenya Kenyan public and private sector organizations are now using this increased bandwidth and ICT capabilities to efficiently deliver services conduct business transactions and share information across organizational social and geographic boundaries As Kenya matures into an information society the nation faces an increasingly evolving cyber threat landscape Nation states criminal organizations and hacktivists from all over the world are—and will continue—to exploit ICT vulnerabilities in Kenya This is simply a reality that every nation with robust ICT infrastructure faces While these actors seek to illicitly access alter disrupt or destroy sensitive personal business and government information we are working diligently to evolve our means of protecting information in order to counter today’s threats as well as those coming from over the horizon In response to these threats and in direct support of the national priorities and ICT goals defined in Vision 2030 Kenya’s ICT Ministry developed a National Cybersecurity Strategy Strategy The Strategy defines Kenya’s cybersecurity vision key objectives and ongoing commitment to support national priorities by encouraging ICT growth and aggressively protecting critical information infrastructures The Government of Kenya is committed to the safety security and prosperity of our nation and its partners We see cybersecurity as a key component in that commitment providing organizations and individuals with increased confidence in online and mobile transactions encouraging greater foreign investment and opening a broader set of trade opportunities within the global marketplace Successful implementation of the strategy will further enable Kenya to achieve its economic and societal goals through a secure online environment for citizens industry and foreign partners to conduct business Cybersecurity is a shared responsibility The Government of Kenya will continue to partner with government private sector academia and other non-government entities to implement our Strategy in the most efficient and effective way possible We have every confidence that we will meet these challenges together and increase recognition of Kenya as a trusted partner and cybersecurity leader in the East African Community EAC Africa and the world February 2014 1 MINISTRY OF INFORMATION COMMUNICATIONS AND TECHNOLOGY INTRODUCTION The Importance of Cyberspace Cyberspace is more than just the Internet and information and communications technology ICT It is a domain similar to the domains of land air sea and space but with its own distinct characteristics and challenges The cyber domain is characterized by the digital storage modification and exchange of data via networked systems and supported by critical information infrastructures It has national and international dimensions that include industry commerce intellectual property security technology culture policy and diplomacy As such cyberspace plays a critical role in the global economy Similar to other nations with a robust ICT infrastructure Kenya’s conducts its social economic and national security activities in this digital interconnected environment For example the Government of Kenya relies on common infrastructure information technology IT platforms and new technologies to increase the efficiency and effectiveness of government services One of the main priorities of the Government of Kenya towards the realization of national development goals and objectives for wealth and employment creation as stipulated in the Kenya Vision 2030 is to achieve an e-Government capability At the same time the development implementation and adoption of technologies such as mobile computing mobile banking and broadband communications enables Kenyans to connect with a speed and ease—unthinkable only five years ago However these same technologies can present new risks that can cause widespread damage to national security economic growth and critical infrastructures Moreover the reach and impact of cyberspace is accelerating across the national and international boundaries making it a complex challenge for any government to address alone For this reason the Government of Kenya considers securing its national cyberspace a national priority to continue to facilitate economic growth for the country and its citizens 2 February 2014 Government of Kenya Cybersecurity Implementation Hierarchy ICT growth is particularly prevalent in Africa where technological advancement and innovation are driving progress in key sectors e g agriculture education financial services government and health In 2009 the regional fiber-optic underwater cable increased ICT mobilization and interconnectedness across Kenya and much of East Africa With the rapid growth of technology the Kenyan people have quickly become accustomed to and dependent on the services provided to them through government and business websites banking connectivity with central banks and other individuals and ease of communications These advances continue to bring new and exciting opportunities to businesses and individuals across Kenya February 2014 According to statistics released by The Communications Authority of Kenya CAK Kenya had an estimated 16 4 million Internet users and 30 7 million mobile network subscribers as of the second quarter of fiscal year 2012 2013 source http www cck go ke resc downloads Sector_statistics_for_ Quarter_2_-_2012-2013 pdf 3 MINISTRY OF INFORMATION COMMUNICATIONS AND TECHNOLOGY THE CYBERSECURITY CHALLENGE The Evolving Threat Landscape Aggressively supporting the technological advancements in Kenya has resulted in a more open interconnected nation which can offer adversaries avenues for exploiting computer networks Cyber attacks are continuously evolving—to a great extent faster than cyber defences—resulting in an ever-increasing frequency of attacks and the probability of success over time Figure 1 provides a snapshot of the sophistication of cyber-attacks from 1980-2012 These cyber attacks may come from hacktivists seeking to publicize political views from criminal organizations seeking financial gain from terrorist groups seeking to inflict economic or political damage or from state-sponsored intelligence and security organizations advancing their own economic or national security aims Many attacks involve extremely sophisticated technological and social engineering techniques however low-technology penetrations—such as insider threats—remain a danger Figure 1 Compounding Cyber Attack Progression 4 February 2014 Cybersecurity—a National Priority The expansive and dynamic nature of ICT creates a wide and deep range of challenges The Government of Kenya is addressing these challenges to provide for cybersecurity at the national level enabling economic growth and protecting the interests of the Kenyan people In evaluating the potential paths forward the Government of Kenya identified several key challenges resulting directly from emerging risk areas inside Kenya the East Africa Community EAC and internationally By addressing these risks and understanding the impact of Kenya’s cybersecurity efforts technology growth and economic development will be significantly enabled by cybersecurity implementation Both financial and non-financial institutions need high awareness of the need for secure online systems This will ensure a secure online environment for conducting business and other economic activities Encourage the use of security standards while designing building and deploying IT systems source http www ict go ke docs MasterPlan2017 pdf Risks and challenges can manifest from various sources—even from those areas where technology is enabling significant growth and prosperity For example—by providing people with the ability to access and exchange information they become dependent on that information to socialized with family and friends conduct business and feel connected in our modern world The National Cyber Security Master Plan addresses emerging cyber risks and the challenges that the ICT may face in the future Recognizing this and understanding the critical role ICT plays in Kenya’s economy the Government of Kenya developed the National Cybersecurity Strategy Strategy The Strategy supports the three pillars of the Vision 2030 and supports other national initiatives such as the National ICT Master Plan1 see Figure 2 The purpose of the Strategy is to clearly define Kenya’s cybersecurity vision goals and objectives to secure the nation’s cyberspace while continuing to promote the use of ICT to enable Kenya’s economic growth Figure 2 Cybersecurity Strategy Benefits 1 The National ICT Master Plan strategic goals are 1 every citizen connected 2 Kenya is Africa’s ICT hub 3 public service for all and 4 a society built on knowledge February 2014 5 MINISTRY OF INFORMATION COMMUNICATIONS AND TECHNOLOGY NATIONAL CYBERSECURITY STRATEGY To promote the Government’s commitment to cybersecurity the Strategy includes four strategic goals 1 Enhance the nation’s cybersecurity posture in a manner that facilitates the country’s growth safety and prosperity 2 Build national capability by raising cybersecurity awareness and developing Kenya’s workforce to address cybersecurity needs 3 Foster information sharing and collaboration among relevant stakeholders to facilitate an information sharing environment focused on achieving the Strategy’s goals and objectives 4 Provide national leadership by defining the national cybersecurity vision goals and objectives and coordinating cybersecurity initiatives at the national level The subsequent sections outline specific objectives for each goal Goal 1 Enhance the Nation’s Cybersecurity Posture Objective Protect Critical Information Infrastructure The Government of Kenya is promoting ICT usage to both the government and the Kenyan public through an undersea and terrestrial cable and network installations increased availability of mobile wireless technology and a movement towards e-government services However the increased use of and reliance on ICT exposes Kenya to increased cyber risks Threat actors can exploit ICT vulnerabilities to perpetrate crimes against the Government of Kenya and Kenya’s citizens who rely on ICT to perform electronic transactions or obtain key critical government services Also natural disaster may pose a threat by causing potential damage critical information infrastructure and disrupting communications As such it is imperative that as the Government of Kenya protect critical information infrastructure Its cybersecurity activities should also be flexible enough to counter and mitigate the increasingly complex threats and vulnerabilities to ICT infrastructures The Government of Kenya is taking steps to increase the security and resilience of its critical information infrastructure to protect its government citizens and residents and corporations from cyber threats and to reap the social and economic benefits of cyberspace The government is doing this through a coordinated 6 February 2014 effort with other countries to increase the security of global cyberspace as a whole This includes securing critical infrastructures applications and services Additionally the Government of Kenya is working with relevant stakeholders to build cybersecurity capabilities focused on operations infrastructure and mission assurance Within the National Cybersecurity Master Plan the Government has identified a governance and capability structure Figure 3 which will support scalable growth of cybersecurity within the public and private sectors Goal 2 Build National Capability Objective Awareness and Training Inform and educate the Kenyan public and workforce to secure the national cyberspace As part of building national capability goal the Government of Kenya is informing and educating the public and workforce on how to secure the national cyberspace This includes partnering with other government organizations the private sector and academia to ensure that people with cybersecurity responsibilities possess the appropriate level of cyber qualifications and competencies This effort incorporates human capital management leadership development education and training and strategic communication and change management to develop a nation-wide workforce for the future Additionally the Government of Kenya is Figure 3 Kenya Cybersecurity Goals and Objectives ■ Working with academia to develop cybersecurity curriculums for higher education and specialized training programs to ensure competency building for cybersecurity professionals and ■ Developing promoting and implementing incentive programs to increase the appeal of cybersecurity career paths to attract and retain Kenyans into this critical field Objective Communications and Outreach Elevate cybersecurity awareness for government private sector and the Kenyan public The Government of Kenya is developing launching and promoting targeted awareness programs to inform the general public and workforce of common cybersecurity threats and counter measures Through targeted communications and outreach activities the Government of Kenya is ■ Increasing the understanding of cyber threats and empower the Kenyan public to be safer and more secure online and ■ Communicating approaches and strategies for the public to keep themselves and their families and communities safer online February 2014 7 Goal 3 Foster Information Sharing and Collaboration Objective Develop a comprehensive governance framework to leverage resources reduce conflict and duplication of effort and work toward Kenya’s long-term cybersecurity goals Cybersecurity is a complex multidisciplinary challenge that requires coordination across a wide array of stakeholders Therefore implementing the Strategy requires developing a comprehensive governance model that includes meaningful participation by relevant stakeholders working together toward the common goal of securing Kenya’s cyberspace Through this governance framework the Government of Kenya intends to ■ Develop the required laws regulations and policies required to secure the nation’s cyberspace ■ Solicits stakeholder input and feedback as appropriate and ■ Balance information security privacy considerations and economic priorities Cultivate a culture of information sharing that facilitates the real time exchange of cybersecurity information Successful implementation of the Strategy requires the sharing of cybersecurity information crossorganizational and cross-sector in a trusted and structured manner The Government of Kenya will develop and manage a secure information-sharing capability to promote knowledge and lessons learned among relevant stakeholders Goal 4 Provide National Leadership Objective Develop and Coordinate Implementation of the National Cybersecurity Strategy and Master Plan Enhancing Kenya’s cybersecurity posture is a top priority for the Government of Kenya As such the Government of Kenya will continue to provide a single unified agenda that will guide all relevant national stakeholders Specifically the ICT Ministry will ■ Continue to refresh the Strategy vision goals and objectives as required and establish a tactical roadmap for achieving national cybersecurity objectives and ■ Use the Strategy and complementary Cyber Security Master Plan to identify and implement relevant cybersecurity initiatives in conjunction and in collaboration with relevant stakeholders 8 February 2014 MINISTRY OF INFORMATION COMMUNICATIONS AND TECHNOLOGY KEY BENEFITS The Government of Kenya expects to see considerable benefit from the development of a holistic national cybersecurity strategy These benefits will be realized not only within ICT circles but across social and economic areas by all Kenyans These benefits clearly impact and improve the Pillars of Growth established by Kenya Vision 2030 The Economic Pillar The Social Pillar and The Political Pillar by directly supporting the goals of increasing prosperity improving the quality of life and moving to the future as one nation Benefit Area Private Sector Growth Details of Benefits Resulting from Improved Cybersecurity ■ Added e-commerce applications due to a more secure environment ■ Growth in the quantity of e-commerce transactions ■ Lower business risk and uncertainty ■ More competition among firms as secure e-commerce grows ■ Financial sector growth as the number of financial transactions grow ■ More sustainable economic growth through sustained security and increased confidence in e-commerce ■ Through e-markets suppliers are able to interact and transact directly with buyers thereby eliminating the costs related to intermediaries and distributors Businesses can increase revenues and margins Greater Cooperation with Relevant International Organizations February 2014 ■ Increased incentives to participate in the formation of international rules including intellectual property rights contract law electronic signatures and authentication consumer protection jurisdiction and others secure electronic commerce issues are addressed in international for a such as WIPO World Intellectual Property Organization UNCITRAL United Nations Commission on International Trade Law the Hague Conference on Private International Laws ISO International Standard Organization including COPOLCO Consumer Policy Committee OECD and others 9 Benefit Area Improved Organizational Performance and Reduced Transactions Cost Details of Benefits Resulting from Improved Cybersecurity ■ Lower costs due to improved efficiency of transactions ■ Lower cost leads to an increase in the number of firms in the market ■ Provides avenues for firms to enter into the business-to-business and businessto-government global supply chains ■ Easier marketing of agricultural products and local sourced goods in the global market ■ Reduction of search costs as buyers and sellers are together in a single online trading community ■ Reduction in the costs of processing transactions e g invoices purchase orders and payment schemes with the automation of transaction processes ■ Efficiency in trading processes and transactions as sales can be processed through online auctions ■ Online processing improves inventory management and logistics Promote AntiCorruption in Government and Industry ■ Increase in price transparency as the gathering of a large number of buyers and sellers in a single e-market reveals market price information and transaction processing to participants the publication of information on a single purchase or transaction makes the information readily accessible and available to all members of the e-market ■ Increased price transparency can exert downward pressure on price differentials in the market buyers are provided much more time to compare prices and make better buying decisions ■ Expansion of borders for dynamic and negotiated pricing wherein multiple buyers and sellers collectively participate in price-setting and two-way auctions prices can be set through automatic matching of bids and offers the requirements of both buyers and sellers can be more easily aggregated to reach equilibrium price levels which are lower than those resulting from individual actions A More Competitive Business Environment ■ Trade liberalization as cross-border transactions costs decline ■ Resolution of patent issues    international programs will contribute to achieving harmonized patent protection for progress and developments  in secure transactions ■ Enhanced public welfare through improved access to online goods and services ■ Greater social cohesion as wage and income disparities lessen due to improved communication and information sharing i e a better functioning labor market ■ More options for consumer transactions more reliable distribution channels ■ Lower transactions costs ■ Lower prices in longer term Transparency and Efficiency in Government 10 ■ Expedited government financial transactions enabling greater efficiency and expediency in resource allocation ■ Improved communications February 2014 MINISTRY OF INFORMATION COMMUNICATIONS AND TECHNOLOGY CONCLUSION As Kenya’s remarkable ICT growth continues ensuring the confidentiality integrity and availability of public and private sector information across Kenya’s ICT infrastructure is of significant importance Kenya’s National Cybersecurity Strategy serves to demonstrate the government’s commitment to improving Kenya’s cybersecurity posture and share overarching vision goals and objectives Implementation of the strategy is supported by an evolving national Cybersecurity Master Plan which has been developed to define and ultimately govern a prioritized roadmap of discreet cybersecurity projects Both the strategy and master plan are critical to securing the online environment for citizens industry and foreign partners increasing the Kenyan people’s confidence in online transactions data security fraud protection and privacy encouraging greater foreign investment and enhancing trade opportunities and enabling Kenya’s broader economic and societal goals February 2014 11 MINISTRY OF INFORMATION COMMUNICATIONS AND TECHNOLOGY ssiblolegy o p E HEtRh techno E G A IMsiness wi me user bu use or ho in TERMS AND DEFINITIONS 12 Term Definition Broadband A type of high-capacity telecommunications especially as used for access to the Internet Computer Incident Response Team The personnel responsible for coordinating the response to computer security incidents within an organization Critical Infrastructure A term used to describe assets that are essential for the functioning of a society and economy e g electrical grid telecommunications water supply Cybersecurity The processes and mechanisms by which computer-based equipment information and services are protected from unintended or unauthorized access change or destruction Cyberspace The notional environment in which communication over computer networks occurs e-Government Short for electronic government it is digital interactions between a government and citizens government and businesses government and employees and also between two governments Globalization Growth to a global or world-wide scale Governance Consistent management cohesive policies guidance processes and decision-rights for a given area of responsibility Information and Communication Technology ICT The applications of computers and telecommunications equipment to store retrieve transmit and manipulate data February 2014 Term Definition Insider Threat A malicious individual who is also an employee or officer of a business institution or government Social Engineering A non-technical kind of intrusion or “hack” that relies heavily on human interaction and often involves tricking other people to break normal security procedures February 2014 13 'Iii - ii F HAMMER GOVERNMENT of KENYA CYBERSECURITY STRATEGY