Cyber defence

• .

Highlights

• Cyber defence is part of NATO’s core task of collective defence.
• NATO has affirmed that international law applies in cyberspace.
• NATO's main focus in cyber defence is to protect its own networks (including operations and missions) and enhance resilience across the Alliance.
• In July 2016, Allies reaffirmed NATO’s defensive mandate and recognised cyberspace as a domain of operations in which NATO must defend itself as effectively as it does in the air, on land and at sea.
• Allies also made a Cyber Defence Pledge in July 2016 to enhance their cyber defences, as a matter of priority. Since then, all Allies have upgraded their cyber defences.
• NATO reinforces its capabilities for cyber education, training and exercises.
• Allies are committed to enhancing information-sharing and mutual assistance in preventing, mitigating and recovering from cyber attacks.
• NATO Cyber Rapid Reaction teams are on standby to assist Allies, 24 hours a day, if requested and approved.
• At the Brussels Summit in 2018, Allies agreed to set up a new Cyberspace Operations Centre as part of NATO’s strengthened Command Structure. They also agreed that NATO can draw on national cyber capabilities for its missions and operations.
• In February 2019, Allies endorsed a NATO guide that sets out a number of tools to further strengthen NATO’s ability to respond to significant malicious cyber activities.
• NATO and the European Union (EU) are cooperating through a Technical Arrangement on Cyber Defence, which was signed in February 2016. In light of common challenges, NATO and the EU are strengthening their cooperation on cyber defence, notably in the areas of information exchange, training, research and exercises.
• NATO is intensifying its cooperation with industry through the NATO Industry Cyber Partnership.
• NATO recognises that its Allies stand to benefit from a norms-based, predictable and secure cyberspace. 

• NATO Policy on Cyber Defence

  To keep pace with the rapidly changing threat landscape and maintain robust cyber defences, NATO adopted an enhanced policy and action plan, which were endorsed by Allies at the Wales Summit in September 2014. An updated action plan has since been endorsed by Allies in February 2017. The policy establishes that cyber defence is part of the Alliance’s core task of collective defence, confirms that international law applies in cyberspace, seeks to further develop NATO’s and Allies’ capabilities, and intensifies NATO’s cooperation with industry. The top priority is the protection of the networks owned and operated by the Alliance.

  The policy also reflects Allied decisions on issues such as streamlined cyber defence governance, procedures for assistance to Allied countries, and the integration of cyber defence into operational planning (including civil preparedness).  In addition, the policy defines ways to take forward awareness, education, training and exercise activities, and encourages further progress in various cooperation initiatives, including those with partner countries and international organisations. It also foresees boosting NATO’s cooperation with industry, including on information-sharing and the exchange of best practices. Allies have also committed to enhancing information-sharing and mutual assistance in preventing, mitigating and recovering from cyber attacks. 

  NATO’s cyber defence policy is complemented by an action plan with concrete objectives and implementation timelines on a range of topics from capability development, education, training and exercises, and partnerships.

  At the Warsaw Summit in 2016, Allies reaffirmed NATO’s defensive mandate and recognised cyberspace as a domain of operations in which NATO must defend itself as effectively as it does in the air, on land and at sea. As most crises and conflicts today have a cyber dimension, treating cyberspace as a domain enables NATO to better protect and conduct its missions and operations.

  At Warsaw, Allies also pledged to strengthen and enhance the cyber defences of national networks and infrastructures, as a matter of priority. Together with the continuous adaptation of NATO’s cyber defence capabilities, as part of NATO’s long-term adaptation, this will reinforce the cyber defence and overall resilience of the Alliance.

  Developing the NATO cyber defence capability

  The NATO Computer Incident Response Capability (NCIRC) based at SHAPE in Mons, Belgium, protects NATO’s own networks by providing centralised and round-the-clock cyber defence support. This capability is expected to evolve on a continual basis and maintain pace with the rapidly changing threat and technology environment.

  To facilitate an Alliance-wide and common approach to cyber defence capability development, NATO also defines targets for Allied countries’ implementation of national cyber defence capabilities via the NATO Defence Planning Process.

  Cyber defence has also been integrated into NATO’s Smart Defence initiatives. Smart Defence enables countries to work together to develop and maintain capabilities they could not afford to develop or procure alone, and to free resources for developing other capabilities. The Smart Defence projects in cyber defence include the Malware Information Sharing Platform (MISP) and the Smart Defence Multinational Cyber Defence Capability Development (MN CD2) project. The Multinational Cyber Defence Education and Training (MN CD E&T) project recently concluded its work.

  NATO is also helping its Allies by sharing information and best practices, and by conducting cyber defence exercises to help develop national expertise. Similarly, individual Allied countries may, on a voluntary basis and facilitated by NATO, assist other Allies to develop their national cyber defence capabilities.

  NATO has established a Cyberspace Operations Centre in Mons, Belgium. The Centre supports military commanders with situational awareness to inform the Alliance’s operations and missions. It also coordinates NATO’s operational activity in cyberspace, ensuring freedom to act in this domain and making operations more resilient to cyber threats.

  Increasing NATO cyber defence capacity

  Recognising that cyber defence is as much about people as it is about technology, NATO continues to improve the state of its cyber defence education, training and exercises.

  NATO conducts regular exercises, such as the annual Cyber Coalition Exercise, and aims to integrate cyber defence elements and considerations into the entire range of Alliance exercises, including the Crisis Management Exercise (CMX). NATO is also enhancing its capabilities for cyber education, training and exercises, including the NATO Cyber Range, which is based at a facility provided by Estonia.

  To enhance situational awareness, an updated Memorandum of Understanding (MOU) on Cyber Defence was developed in 2015. This updated MOU is being concluded between NATO and the national cyber defence authorities of all Allies. It sets out arrangements for the exchange of a variety of cyber defence-related information and assistance to improve cyber incident prevention, resilience and response capabilities.

  The NATO Cooperative Cyber Defence Centre of Excellence (CCD CoE) in Tallinn, Estonia is a NATO-accredited research and training facility dealing with cyber defence education, consultation, lessons learned, research and development. Although it is not part of the NATO Command Structure, the CCD CoE offers recognised expertise and experience.

  The NATO Communications and Information Systems School (NCISS) in Oeiras, Portugal provides training to personnel from Allied (as well as non-NATO) nations relating to the operation and maintenance of NATO communications and information systems. NCISS also offers cyber defence training and education.

  The NATO School in Oberammergau, Germany conducts cyber defence-related education and training to support Alliance operations, strategy, policy, doctrine and procedures. The NATO Defense College in Rome, Italy fosters strategic thinking on political-military matters, including on cyber defence issues.

  Cooperating with partners

  Because cyber threats defy state borders and organisational boundaries, NATO engages with a number of partner countries and other international organisations to enhance international security.

  Engagement with partner countries is based on shared values and common approaches to cyber defence. Requests for cooperation with the Alliance are handled on a case-by-case basis founded on mutual interest.

  NATO also works with, among others, the European Union (EU), the United Nations (UN) and the Organization for Security and Co-operation in Europe (OSCE).

  Cyber defence is one of the areas of strengthened cooperation between NATO and the EU, as part of the two organisations’ increasingly coordinated efforts to counter hybrid threats. NATO and the EU share information between cyber crisis response teams and exchange best practices. Cooperation is also being enhanced on training, research and exercises.

  Cooperating with industry

  The private sector is a key player in cyberspace, and technological innovations and expertise from the private sector are crucial to enable NATO and Allied countries to effectively respond to cyber threats.

  Through the NATO Industry Cyber Partnership (NICP), NATO and its Allies are working to reinforce their relationships with industry. This partnership includes NATO entities, national Computer Emergency Response Teams (CERTs) and NATO member countries’ industry representatives. Information-sharing activities, exercises, training and education, and multinational Smart Defence projects are just a few examples of areas in which NATO and industry have been working together.

• The NATO Policy on Cyber Defence is implemented by NATO’s political, military and technical authorities, as well as by individual Allies. The North Atlantic Council (NAC) provides high-level political oversight on all aspects of implementation. The NAC is apprised of major cyber incidents and it exercises principal authority in cyber defence-related crisis management.

  The Cyber Defence Committee, subordinate to the NAC, is the lead committee for political governance and cyber defence policy in general. At the working level, the NATO Cyber Defence Management Board (CDMB) is responsible for coordinating cyber defence throughout NATO civilian and military bodies. The CDMB comprises the leaders of the policy, military, operational and technical bodies in NATO with responsibilities for cyber defence.

  The NATO Consultation, Control and Command (NC3) Board constitutes the main committee for consultation on technical and implementation aspects of cyber defence. The NATO Military Authorities (NMA) and the NATO Communications and Information Agency (NCIA) bear the specific responsibilities for identifying the statement of operational requirements, acquisition, implementation and operating of NATO’s cyber defence capabilities. Allied Command Transformation (ACT) is responsible for the planning and conduct of the annual Cyber Coalition Exercise.

  NCIA, through its NCIRC Technical Centre in Mons, Belgium, is responsible for the provision of technical cyber security services throughout NATO. The NCIRC Technical Centre has a key role in responding to any cyber incidents affecting NATO. It handles and reports incidents, and disseminates important incident-related information to system/security management and users. The NCIRC Coordination Centre is a staff element responsible for the coordination of cyber defence activities within NATO and with member countries, and for staff support to the CDMB.

• Although NATO has always protected its communications and information systems, the 2002 Prague Summit first placed cyber defence on the Alliance’s political agenda. Allied leaders reiterated the need to provide additional protection to these information systems at the Riga Summit in 2006.

  Following the cyber attacks against Estonia’s public and private institutions in 2007, Allied defence ministers agreed that urgent work was needed in this area.  As a result, NATO approved its first Policy on Cyber Defence in January 2008.

  In the summer of 2008, the conflict between Russia and Georgia demonstrated that cyber attacks have the potential to become a major component of conventional warfare.

  NATO adopted a new Strategic Concept at the Lisbon Summit in 2010, during which the North Atlantic Council (NAC) was tasked to develop an in-depth NATO cyber defence policy and to prepare an action plan for its implementation. 

  In June 2011, NATO defence ministers approved the second NATO Policy on Cyber Defence, which set out a vision for coordinated efforts in cyber defence throughout the Alliance within the context of the rapidly evolving threat and technology environment. This was accompanied by an action plan for implementation.

  In April 2012, cyber defence was introduced into the NATO Defence Planning Process. Relevant cyber defence requirements are identified and prioritised through the defence planning process.

  At the Chicago Summit in May 2012, Allied leaders reaffirmed their commitment to improving the Alliance’s cyber defences by bringing all of NATO’s networks under centralised protection and implementing a series of upgrades to the NCIRC – NATO’s cyber defence capability.

  In July 2012, as part of the reform of NATO’s agencies, the NATO Communications and Information Agency (NCIA) was established.

  In February 2014, Allied defence ministers tasked NATO to develop a new, enhanced cyber defence policy regarding collective defence, assistance to Allies, streamlined governance, legal considerations and relations with industry. 

  In April 2014, the NAC agreed to rename the Defence Policy and Planning Committee/ Cyber Defence as the Cyber Defence Committee.

  At the Wales Summit in September 2014, Allies endorsed a new cyber defence policy and approved an action plan that, along with the policy, contributes to the fulfilment of the Alliance’s core tasks.  Cyber defence was recognised as part of NATO’s core task of collective defence, and Allies agreed that international law applies in cyberspace.

  On 17 September 2014, NATO launched an initiative to boost cooperation with the private sector on cyber threats and challenges. Endorsed by Allied leaders at the Wales Summit, the NATO Industry Cyber Partnership (NICP) was presented at a two-day cyber conference held in Mons, Belgium, where 1,500 industry leaders and policy makers gathered to discuss cyber collaboration. The NICP recognises the importance of working with industry partners to enable the Alliance to achieve its cyber defence policy’s objectives. 

  On 10 February 2016, NATO and the EU concluded a Technical Arrangement on Cyber Defence to help both organisations better prevent and respond to cyber attacks. This Technical Arrangement between NCIRC and the Computer Emergency Response Team of the EU (CERT-EU) provides a framework for exchanging information and sharing best practices between emergency response teams.

  On 14 June 2016, Allied defence ministers agreed to recognise cyberspace as a domain at the NATO Summit in Warsaw in July. This recognition does not change NATO’s mission or mandate, which is defensive. As in all areas of action, NATO will exercise restraint and act in accordance with international law. The Alliance also welcomed efforts undertaken in other international fora to develop norms of responsible state behaviour and confidence-building measures to foster a more transparent and stable cyberspace.

  At the Warsaw Summit in July 2016, Allied Heads of State and Government reaffirmed NATO’s defensive mandate and recognised cyberspace as a domain of operations in which NATO must defend itself as effectively as it does in the air, on land and at sea. This improved NATO’s ability to protect and conduct its missions and operations.

  Allies also committed through a Cyber Defence Pledge to enhancing the cyber defences of their national networks and infrastructures, as a matter of priority. Each Ally will honour its responsibility to improve its resilience and ability to respond quickly and effectively to cyber attacks, including as part of hybrid campaigns.

  On 6 December 2016, NATO and the EU agreed on a series of more than 40 measures to advance how the two organisations work together – including on countering hybrid threats, cyber defence, and making their common neighbourhood more stable and secure. On cyber defence, NATO and the EU will strengthen their mutual participation in exercises, and foster research, training and information-sharing. 

  On 16 February 2017, Allied defence ministers approved an updated Cyber Defence Action Plan, as well as a roadmap to implement cyberspace as a domain of operations. This increased Allies’ ability to work together, develop capabilities and share information. 

  Also on 16 February 2017, NATO and Finland stepped up their engagement with the signing of a Political Framework Arrangement on cyber defence cooperation. The arrangement allows NATO and Finland to better protect and improve the resilience of their networks.

  On 8 November 2017, NATO defence ministers expressed their agreement in principle on the creation of a new Cyberspace Operations Centre as part of the outline design for the adapted NATO Command Structure. The aim is to strengthen NATO’s cyber defences and help integrate cyber into NATO planning and operations at all levels. Ministers also agreed to allow the integration of Allies’ national cyber contributions into Alliance operations and missions. Allies will maintain full ownership of those contributions, just as Allies own the tanks, ships and aircraft in NATO missions.

  On 5 December 2017, NATO and EU ministers agreed to step up cooperation between the two organisations in a number of areas, including cyber security and defence. Analysis of cyber threats and collaboration between incident response teams is one area of further cooperation; another is the exchange of good practices concerning the cyber aspects and implications of crisis management.

  At the Brussels Summit in 2018, Allied leaders agreed to set up a new Cyberspace Operations Centre as part of NATO’s strengthened Command Structure. The Centre will provide situational awareness and coordination of NATO operational activity within cyberspace.  Allies also agreed that NATO can draw on national cyber capabilities for its missions and operations.  Allies also took stock of their progress to enhance national resilience through the Cyber Defence Pledge.

  In February 2019, NATO defence ministers endorsed a NATO guide that sets out a number of tools to further strengthen NATO’s ability to respond to significant malicious cyber activities. NATO needs to use all the tools at its disposal, including political, diplomatic and military, to tackle the cyber threats that it faces. The response options outlined in the NATO guide will help NATO and its Allies to enhance their situational awareness about what is happening in cyberspace, boost their resilience, and work together with partners to deter, defend against and counter the full spectrum of cyber threats.

  On 3 June 2020, the North Atlantic Council issued a statement condemning the destabilising and malicious cyber activities taking place in the context of the coronavirus pandemic. The statement expressed Allied solidarity and mutual support for those dealing with the consequences of these malicious cyber activities, including healthcare services, hospitals and research institutes. The statement also called for respect for international law and norms of responsible state behaviour in cyberspace.