In recent years, Ukraine has received immense amount of assistance in the field of cybersecurity ranging from equipment and targeted financial assistance to training and retraining.
At present, critical infrastructure protection capacity is much better than a few years ago. In particular,
- almost all facilities have officers responsible for cybersecurity;
- basic processes and procedures exist almost everywhere: from security policies to rules for the use of information system resources;
- cases of purchasing and updating protection equipment are no longer exceptional – they have become a standard practice;
- specialists are continuously improving their knowledge and skills through professional development and training opportunities, in particular to pass certification exams;
- etc.
It should be noted that the assistance provided by donors and international organizations over a certain period was focused on retraining and training of specialists. Thanks to the OSCE, CRDF Global, IFES, USAID and other donors, representatives of government authorities, relevant law enforcement agencies, National Bank of Ukraine and critical infrastructure facilities participated in professional competitions and hackathons, lectures and presentations, workshops and seminars. However, the lack of coordination in actions of donors has led to the situation that over time, the same individuals begin to participate in different activities, as the number of specialists is still limited. Therefore, one of the solutions to this situation is coordination among government officials, international donors and assistance recipients. The first steps have already been taken: the National Coordination Center for Cybersecurity, responsible for control and coordination, was created at the National Security and Defense Council. On the other hand, such platform as the National Cybersecurity Cluster allows international organizations to discuss and synchronize their activities for maximum effect. Thus, it can be concluded that there are already platforms designed to facilitate dialogue and coordination of efforts, and all that remains is to establish a relationship of trust between the parties, which is the most difficult task.
But what should we focus our efforts on? It is clear that retraining of specialists for public authorities and critical infrastructure facilities should contribute to the transition from episodic and unique operations to a continuous and controlled process that meets required efficiency standards. In order to achieve this goal, the state should determine what competencies it needs, or what skills and knowledge its specialists lack. The same issues also arise when it comes to creating training and professional development programs. Specialties and specializations are reasons why there exists a gap between the list of competencies, skills and abilities and the content of educational programs. There is currently only one relevant specialty in Ukraine – 125 Cybersecurity. And it is according to its standards that higher education institutions train specialists. However, the industry is developing rapidly with new areas, specializations, etc. emerging. Therefore, the proposal for updating and revising both the list of training programs and their content looks quite reasonable. And it is in this activity that donor assistance can be extremely effective as a result of drawing on international expertise. Prestigious universities, government agencies in developed countries and leading professional companies are the sources that can and should be used to adopt the best practices in developing training programs for specialties and specializations in the field of cybersecurity.
As already mentioned, the Ukrainian cybersecurity market is becoming more and more mature. Purchasing and upgrading protection tools and cybersecurity systems are a standard process for many public authorities, institutions and agencies That is, purchases are budgeted, competitive procurements are conducted, deliveries and shipments are arranged. But the criticism, that comes from the community of professionals, sometimes centers on the choice of solutions, hardware or software products. This stems from the lack of argumentation and explanation on the one hand and insufficient transparency in the use of purchased resources on the other. And the second factor is perhaps most widely criticized. In turn, this undermines confidence in the state on the whole and in its ability to protect its resources in cyberspace in particular. Any distrust in an institution can be reduced by the transparency of processes on the one hand and by an objective assessment of the operational efficiency and use of resources on the other. The existing regulatory framework of Ukraine provides no standards and procedures for assessment and self-assessment of the level of cybersecurity across organizations or institutions such as the Federal Information Security Management Act (FISMA) in the United States. The development of such framework is an extremely important and difficult task, and in this context the assistance of the international community could hardly be overestimated. Access to international legislative practices, explanation of the relationship between regulations and approaches to their implementation, methods and tools for monitoring assessment progress, etc. would be instrumental in building an effective system for assessing and managing cybersecurity of government agencies.
Thus, the following conclusions can be drawn:
- assistance from the international community plays an extremely important role in increasing the level of protection of state information resources, both through direct financial and material assistance, and through training and retraining of specialists;
- security of state information systems and critical infrastructure facilities can no longer be described as a zero level, but it still remains unsatisfactory;
- cybersecurity of public institutions, like any system at the stage of development, should make the transition from the initial formation of the structure and acquisition of capacities to effective management and governance where the experience and knowledge of international organizations are incredibly important;
- the lack of qualified personnel on the market can be addressed by improving the quality and appropriate specialization of training programs, as well as developing the education sector as a whole.
Issues and problems related to cybersecurity of national information resources are of particular relevance, so only combined efforts of the state, professional community and international organizations can ensure sustainable development of the post-industrial information society.
