The president has put a cybersecurity strategy into effect by decree. Until now the country had no single state-level view of how to respond to threats in the information sphere.
To build a virtual shield around Ukraine, the relevant laws now have to be passed, people brought together and funding found.
On Wednesday, March 16, President Petro Poroshenko signed a decree approving the decision of the National Security and Defense Council (NSDC) of January 27 this year "On the Cybersecurity Strategy of Ukraine". The goal set by the document's authors is to create a secure cyberspace and use it in the interests of the individual, society and the state. This was announced by the presidential press service.
Officials have come to realize that various sectors of Ukraine's economy and public life "are becoming increasingly vulnerable to the intelligence and subversive activities of foreign special services in cyberspace", with the perpetrators "directly or indirectly linked to the Russian Federation".
The NSDC decided to set up a new working body within its structure, the National Cybersecurity Coordination Center, and also drew up a list of institutions that will form the backbone of national cybersecurity. These are the Ministry of Defense, the State Service of Special Communications and Information Protection of Ukraine (the State Special Communications Service), the Security Service of Ukraine (SBU), the National Police, the National Bank of Ukraine (NBU) and the intelligence agencies. These institutions are required to bring state cybersecurity policy in line with the relevant EU and NATO standards as quickly as possible.
The NSDC instructed the Cabinet of Ministers, the SBU, the Foreign Intelligence Service and the National Institute for Strategic Studies to approve, within two months, an action plan for 2016 to implement the strategy. The National Security and Defense Council decided to review such plans annually and to report on their implementation.
Experts interviewed by NV said that Ukraine has needed such a foundational document for a very long time.
"At last, attention has been paid at the highest government level to the fact that this component of security exists. And threats in this area are just as important as the threats in the east of the country or from any other armed conflict," said Volodymyr Zverev, former head of the State Special Communications Service.
According to him, approving the strategy is only the first step. The next is to build a collective security system, since cyberspace has no borders. Zverev said that Ukraine had already begun this process at the level of the countries of South-Eastern Europe.
He noted that until recently Ukraine had only one computer emergency response team — CERT-UA, attached to the State Special Communications Service. This unit provides information protection primarily to government bodies. At the beginning of this year a private center, CYS-Centrum, appeared, focusing on cybersecurity services for the civilian sector. In Zverev's view, Ukraine needs to create similar sector-specific structures in the energy, financial and transport industries.
The former head of the State Special Communications Service believes that every effort must be made within the two months allotted by the presidential decree to pass a law on cyber defense. This will make it possible to begin work on secondary legislation. Government bodies will then have a basis for coordinated work and will be able to counter threats in the information space.
Viktor Valeev, director of the IT Ukraine Association, welcomed the fact that the authorities had introduced the concept of critical infrastructure facilities into legislation. Last year's hacker attack on a number of Ukrainian regional power distribution companies showed that power plants and dams need information protection, he noted.
"It is very right that the strategy sets out the division of powers between the government bodies that will be responsible for cybersecurity," stressed the head of the IT Ukraine Association. Valeev was surprised, however, that critical infrastructure facilities had been assigned to the State Special Communications Service. "It is a military structure. It is unclear how the military will develop recommendations for private companies, since the owners of the regional power companies are civilians," he said.
According to Hennadiy Hulak, deputy director for information security at IQusion (who previously worked on information protection at the SBU), the authorities have taken up the cybersecurity strategy very late. He pointed out that the US government adopted a similar document back in 2003.
In his words, until recently Ukraine did not have a unified cyberspace, because the country inherited much of its equipment and many of its networks from Soviet times. "Now the strategy unties the hands of the relevant state bodies to improve national legislation," Hulak stressed.
In his opinion, the state should now work more closely with society in the information space. After all, attackers build networks of infected computers using, among other things, the home devices of our fellow citizens. Cybercriminals then use these botnets to attack government bodies or infrastructure facilities. Conditions need to be created in which the adoption of cyber defense systems becomes part of Ukrainians' culture. "We need to carry out awareness-raising work among the population and distribute free versions of security software," the IQusion deputy director for information security is convinced.