thank you for joining us today
just a very a few quick reminders before
we get started
all attendees are on mute if you're
using the event app
we encourage you to check into the
session update your activities and be
sure to complete the session
survey at the end this session is tlp
white and is being recorded recordings
will be available within 24 hours via
the app
and with that i'd like to introduce you
to your session moderator graciela
martinez
graciela take it away hello good morning
good afternoon good evening wherever you
are
welcome to the conference and thank you
for joining
the session new age new rules your
speakers will be
dr sheriff hashem and martin von
horinbeck
dr sheriff hashem is a visiting
professor of computer and information
sciences at the
suny polytechnic institute at new york
usa
martin fong foreign beck is chief
information security officer
at zendesk and the board member of the
forum of incident response and security
teams
first so we can start
the talk just right now thank you both
of you
thank you very much glacier and thank
you very much everyone for attending the
talk today
so sharif and i are here today to talk a
little bit about
governments and how they see incident
response specifically
at a very international level when you
think about incident response i think
many of us on the call
or on the presentation come from a world
where
a lot of incident response was purely
technical we reacted to an incident
we worked with a variety of stakeholders
to address those issues
um but overall like we took technical
actions and quite often we were not
really very
very much scrutinized by governments and
some of our government stakeholders
that has changed in the last few years
with big incidents such as notpetya
stuxnet and triton or crisis what we're
seeing is that governments have taken a
really really big
interest in what is actually happening
in the incident response realm
and it's very important for us to
understand that those governments and
those stakeholders
that come more from the policy world
have a very different perspective of
what we do
than we actually have within our
community quite often when you talk to
these people you actually hear that they
think of us a little bit as the police
department
because when someone does a forensic
investigation that's typically a police
officer
so that's often something that comes to
mind and in this talk today
we'll share with you a little bit about
how governments have been thinking and
organizing
what first and other organizations are
doing to provide input
and also maybe a little bit why we need
to help those
diplomats and policy makers understand
why perhaps the police
isn't the best analogy for a c-cert and
with that i'll hand it off to sharif who
will introduce us to some
of these intra-intergovernmental
processes
that have been taking place in the last
few years
sharif you may be on mute if you're
speaking
can you hear me now yes hi
thanks martin uh well the united nation
realized uh
in 2004 that that
i mean the immense use of ict across
different
applications across different sectors uh
requires some coordination and the un
general assembly in 2004 established
one of the really important groups that
are quite relevant to our talk today
which is the un
group of governmental experts to examine
the impact of
i mean the development of ict on
international peace
basically there are these are groups of
governmental experts
one expert per country initially the
group started with like
15 countries only so imagine like 15
experts only dealing with this issue i
had the privilege of being
a part of this group in 2012 2013 i was
the only one
from africa and the middle east actually
so it's about 60 countries and and
and then i mean we lobbied to expand the
group
we love it to have more inclusion of
non-governmental i mean organizations
i mean professional entities and as such
that group expanded to include now 25
members there were six group of
governmental experts since 2004
however only six three of the six groups
uh
ended up with a consensus on a report
that was
later on adopted by the general assembly
of the united nations the u.n
general assembly is important because
that's where you have membership
of all countries there at equal footage
we also lobbied for
openness in this discussions and as such
uh the un agreed to a recommendation to
establish an open-ended working group
where we invite
non-governmental uh representatives
first was invited to the launching event
i had the privilege and martin uh also i
had the privilege to address uh the
group in different capacities
uh uh i think this is very important to
continue
i would like to emphasize here that the
unge
falls under the un uh first committee
which is the main committee of the
general assembly
and as such it's very important to
engage with them
this is really a highway to reach the un
at the
highest possible level um when it comes
to
the two groups i need to emphasize
really the membership and that would
reflect on the type of work that
is being done at this point now we have
a ungge group
a group of governmental experts that
started off in
2019 and the mandate
is to produce a report based again
hopefully on consensus
by 2021 the group focus on norms
rules and principles for building
confidence
and confidence building measures and
capacity building
at large while the open-ended working
group
which is chaired by the swiss diplomat
uh
it has more membership ngos are there
businesses are there academia and of
course government is there also
and they started off in 2019 the mandate
was to develop a report by 2020 by
but due to the covet uh pandemic
that was extended to 2021
i encourage all members of first to
really engage with the representatives
whether
at the country level like uh what we
lobbied for
uh with the ungge uh situation
uh uh because that's i mean the highway
really
to the un assembly as i mentioned before
and that's how we can have more uh
really hands-on uh experience especially
from this from first being a forum for
instance
response and security teams people who
are uh
first responders people who really know
about
how to handle incidents and how to deal
with escalations
with diplomats i remember in my earlier
experience with the ungge
i was the only non-diplomat among 15
experts and you see the discussions
there i mean many of the diplomats
wanted to use
articles that were used for weapons of
mass destruction in nuclear and chemical
cases and and of course some of these uh
uh discussions are not relevant when it
comes to
uh cyber security uh or uh dealing with
instance uh cyber incidents uh uh
specifically there are two issues that
i'd like to
raise uh i mean awareness of discussions
about attribution how to relate
uh really a certain incident to uh
certain actors
whether they are state actors or
non-state actors uh i mean in a
traditional
attack with i mean traditional weapons
it is easier to do the investigation
as opposed to in cyber space where you
have you know
proxies and you have really ways of
spoofing addresses
and so on and so forth so having some
liability
articles there without proper other
properly addressing attribution could be
dangerous and again this is
an area where uh i mean instant
responders
can help educate decision makers and
their countries and their
agencies uh and hopefully representative
in
both groups of of this situation another
point
that could have reflected negatively on
really
some of the articles is the concept of
or the interpretation of the concept of
proportionality when it comes to uh
really retaliation or really a state
taking measures against an attack in in
a cyber space an attack can
really escalate because of
interdependencies
an attack on infrastructure can affect
hospitals can affect banks can
affect individuals in different
capacities so again
we need to educate decision makers again
when it comes to accepting such norms
that proportionality and
interdependences in the cyber world are
are
quite different than in the physical
world
another concept that was also discussed
uh uh
several times and still uh really
pops up every now and then is the the
right
to have pre-emptives strikes uh uh
cyber offensive capabilities you'll see
some
voices lobbying for this to happen uh
this is not something
uh that should be taken easily
and definitely uh it would have
an impact on international peace your
role as
instant responders could be really
instrumental in educating decision
makers about the consequences of actions
and reactions
uh in our discussion of norms you know
there are
rules of the highways and
there are legal implications as well as
agreements that are not legally binding
but they are i mean shared among
stakeholders like norms at this point
cyber norms are discussed
at a level of consensus between
governments and would be a basis for
how we behave in cyber space whether
as individuals as professionals or at
large
or between states this is one step below
having an international treaty when it
comes to
dealing with the cyber security i'll
share quickly with you some norms uh
for those of you who are interested
there are uh we can have
i mean the presentation is there and
there are links that would
guide you to to see where the
discussions are heading the last
i mean the new ngge that came up with a
consensus report was in 2015
and it states uh certain norms uh that
were accepted
by the way this is has been accepted by
the u.n general assembly so this is the
basis for many of the discussions all
going on
right now i mean
you you can agree that they are logical
and the way they are set
uh there i mean it is quite a good basis
of how states should do and should not
do
this it should not engage in harmful uh
acts that would uh threats international
peace and security
uh that uh states should consider all
relevant information and share it
in an open transparent way and shouldn't
encourage
uh illegal actors to use their
infrastructure
again there is a mention of really the
rights to privacy
uh the uh really some measures uh
against attacking critical
infrastructure
and and uh uh
attacking the integrity of supply chain
uh
one norm really is directed to asserts
you'll see
number 11 here about states should not
attack uh i mean emergency response
teams or certain
capabilities this is something that we
negotiated in 2012 2013 so i'm
really pleased to have this and i mean
inside because
i mean the perception that these certs
are
uh for i mean mostly uh for civilian
uh support and to protect uh really
a general usage of icts is is very
important
confidence building measures are
important are parallel to the norms
where
you have the focus on really
agreeing on a basis to build
confidence ahead of having a crisis
it is not really appropriate really to
try to build new relationships during a
crisis time
probably it's too late however
working on confidence building measures
and i believe first
could be the one of the form that would
help build this
confidence uh among key players uh
establishing points of contacts
establishing uh
support for voluntarily sharing
information
on incidents mechanisms for cooperation
should be set ahead of time
all these norms are confidence building
measures uh rather are
important to strengthen international uh
peace and security
uh certs are in the middle of all this
uh so again i would encourage you
by engaging to uh the two modalities uh
within the u.n whether the open-ended
uh working group or at the governmental
level with the ungge
to emphasize the importance of
confidence-building measures and to
emphasize the importance of government
supporting this role
and really opening up because i mean the
work of certs and i have my experience
in my home country egypt
where our cert would collaborate with
certs all around the world to
prevent cyber attacks ddos attacks and
others
and and that is instrumental in the
success
of our mission as incident responders uh
back to you martin
thank you very much sharif so a really
interesting question is how do these
norms actually come to be
is it just someone who makes them up and
then discusses them or is this something
that actually has
a process attached to it and there's a
definition of norms that's widely
accepted to be the one that most people
use today it comes from a researcher
called katzenstein who in 1996 wrote
that a norm
is a collective expectation for the
proper behavior
of actors with a given identity so for
instance
things that we expect states to do it
might not always be described but if we
expect them to do it
that is often a norm or an indication
that we expect that's
the states to adhere to a particular
norm they're often identified by people
that perceive a need
or when they are contested and i'll
actually use an example of that
so for instance when there was an attack
or
a cyber incident at sony pictures
entertainment a few years ago
and it was attributed by several
governments to be initiated by
a state at that point in time there was
a lot of discussion that it would not be
appropriate for a state
to attack a private sector company now
that isn't
necessarily one of the norms that is
currently being discussed at those very
high levels but it was clearly something
where
a lot of individuals and organizations
stood up
and engaged in what we call noise
entrepreneurship to make it clear that
this was something that they were not
willing to
accept from states so when you have
norms they come to be
and they grow in a very specific process
that requires some time
they first emerge some individuals start
noticing that something is happening
which they do not agree with
and they start contesting that
particular behavior and saying this
should not happen
and that can be true legal complaints it
can be by
um just activism against that idea
it can be by proposing language that
actually makes clear something like this
shouldn't happen
the next thing is that the idea starts
cascading or not
what that means is that the um idea that
is suggested by a number of different
organizations and people that is
emerging ends up moving to the system
and more and more actors start stating
that they agree or disagree
with that particular norm and finally
as it is widely accepted by different
actors
those actors start internalizing it so
for instance
if a whole group of governments agree
something shouldn't happen
they might start putting together
processes implementations
organizations to make sure that that
specific activity will never take place
next slide sharif so
sharif mentioned two very specific
processes the un group of governmental
experts and the open-ended working group
that are happening at an interstate
level today in the case of the oewg
also involves some other organizations
and even gave an opportunity
for instance the first to provide some
input to that group
but there are also other places where
norms development and norms
entrepreneurship takes place
and in the next slide i'll show you
briefly what
type of organizations have really
engaged in this
next slide thank you so these are three
examples of proposed dorms by three
different bodies
there's the ungge who propose the norm
that states should
never knowingly support activity to harm
sea certs of another state there's a
proposal by the global
community commission on the stability of
cyberspace
which stated that states should not
pursue support
or allow cyber operations intended to
disrupt technical infrastructure related
to elections
and finally there's a very old proposal
from microsoft
that was actually one of the first real
examples of norms entrepreneurship from
a private sector company
that stated that global ict companies
should issue patches
to protect i.t users regardless of the
attacker and their motives
and we've actually seen development of
these types of norms in many many
different communities
and it's a very interesting space
because i think most people look at the
gge
as sort of the top level normative
organization as in they are proposing
norms that are actually seeing
widespread acceptance
by states which has a lot of influence
there's also a lot of work happening in
these other bodies
and sometimes you see ideas from there
bubbling up and getting more credibility
in other bodies as well
for instance the gcse had a very
interesting norm to protect the public
core of the internet which is one that
is widely looked at
by many different organizations and
proposed to many different bodies as an
actual
cyber norm moving into the next slide
i wanted to start sharing with you a
little bit of what first has done in
this space
so first as an organization we have a
lot of
incident response teams that are members
of first what was very interesting to us
was a few years ago
we had a couple of talks at the
conference where we actually talked
about that sea cert related norm that i
just showed and that was also on
sharif's slides
in the very beginning of the talk and it
was very interesting to realize that
most c-certs
actually had no idea that that norm
existed
so in order to address this we're doing
two things
first of all we're bringing content from
these organizations to all of you
as part of the conference as part of
emails as part of a special interest
group that we are launching
and at the same time we're also bringing
content from all of you
and ideas from all of you uh that has
collected truly special interest group
back to these bodies like the united
states so we actually engaged we went to
new york
sharif and i did a lot of work to
provide input to these bodies
and in the next slide we'll talk a
little bit about what that looks like
we have 10 minutes left thank you
graciela
so um what we're really doing is we're
having informal conversations with
individual participants in the ungge
because we don't necessarily have direct
access there
we're formally participating in the
open-ended working group as a civil
society
organization that went to their civil
society meeting to provide
input and finally we also contributed
both directly and as part of feedback
that was actually compiled by other
civil society
and technical community organizations
directly to these bodies
now the next slide will show you what
our key message
really is and it's very simple it is
that sea certs are not the police
they're more like fire departments
when an incident happens we need to have
the independence the ability to work
across
borders to deal with the incident
effectively and
fire departments do that all the time
like they go to different jurisdictions
to help
other fire departments take out really
really big fires and that's really
what we want these diplomats to see us
as
and on the next two slides we'll show
you a little bit about the key things
that we're focusing on
the first one is that we want these
organizations and in particular
the states within the united nations to
emphasize
partnership and inclusion and we want
them to double down on capacity building
so we want them to focus on
collaboration and enabling different
organizations
not just states and national incident
response teams
but all incident response teams to build
a community
and sharif you um you can speak to the
last two
okay well uh and raising awareness is
key to the success of such efforts
raising awareness at all levels the
community level then i mean
uh at all levels basically
we can impact uh
uh i mean policymakers diplomats i've
given talks
uh and workshops where diplomats are
there decision makers
uh ngos professional talks like what
we're
doing now at first everybody needs to
really share
to be open about norms and and share
about
experiences about their impact and what
really certs
are uniquely positioned uh to do this
is really uh could be an efficient way
of making these norms a reality
not just the statement
thank you and then finally we don't just
provide
input on the norms process we also
actually provide some
input directly on policy that we think
is important
the very first statement that we shared
with these organizations is that we
believe it's very important to adopt
practical measures
to make sure that everyone understands
each other's roles and responsibilities
and we actually used ethics first which
was initiated and developed within first
as an example of an initiative that
actually accomplishes this
for incident responders we also ask
governments to think about how policy
can negatively affect sea certs
for instance when technical expertise is
criminalized or you can't use tools
across borders that makes it very
difficult for us to be successful
third we ask them to think about
allowing sharing of defensive cyber
security information
across borders within first we've seen
quite a bit in the last few years how
sanctions
and export restrictions have made our
life a lot more difficult
in fact as first we're spending more and
more money on figuring out
how we can actually allow incident
responders from across the world to
participate
and that's not something that will scale
or work for us because we need to work
at incidents at the speed of the
incident
which is almost always immediate and we
can't take days or weeks to try and get
licenses
to work with another incident response
team and
we also encourage these governments to
look beyond the work that they have done
and look at work that has happened
within the technical community and a
good example here is actually the global
commission on the stability of
cyberspace
and they're norm to protect the public
core of the internet
when there's a norm that you should not
be attacking the certificate authority
or web pki system
that is actually helpful to us because
it makes incidents a lot more
predictable and a lot more isolated
and doesn't create as much um outcome
for the rest of the internet that we're
trying to protect
and then sharif actually came up with
this very last one which i think
summarizes really very very well
what it is that we as a community want
to create
cyber security is a shared
responsibility we
would like to promote this really a
common understanding across different
stakeholders they need to understand the
roles it is not
a technology or a technical problem
handled by
by the third so ict professionals
otherwise it will become our problem
rather than the global problem or the
government problem of the people problem
it is
our shared responsibility to secure uh
cyberspace to make sure that uh i mean
illicit
activities are cornered are investigated
properly and and as such
they are not the norm what uh martin
just mentioned about export control we
have faced this in in
numerous ways we're developing capacity
in our certain egypt where certain
technologies were limited in terms of uh
exports and and as such criminals have
access
of within the underground uh networks to
such uh really technologies it is the
instant responders that suffer the most
from
regulations that hinder their ability to
get access to the technology
uh uh definitely the civil society the
professional
the the ngos need to be part of this
effort it's a shared responsibility that
need to be understood
and addressed by one now
with this i would like to thank you all
for uh following and maybe we have a few
minutes for questions
okay thank you very much sheriff
martin and we have a
participant that she would like to
she raised her hand and
i think that she would like to
participate so
to ask a question
[Music]
sorry i have to look at her
okay and have to allow her the speaker
to speak
it looked like they had raised the head
but i have just power cleaned somewhere
so
so we have some two minutes left
so please uh you can ask your question
just right now
thank you marie
hi i tried to say that i didn't really
click it this must be some mistake i saw
that
i really didn't have any questions and
so i'm sorry
i'm so sorry no it's okay uh i chatted
i told you okay okay i have one question
um
no more question in the uh yes young
mcdonald is talking how re
receptive our organizations being to
first
effort so i can take that one if you
want i think they're actually being very
receptive
in a sense that one thing that i always
learn from diplomats is that they're
actually
always looking for input from the
technical community and from civil
society and
they have often been challenged by the
fact that they didn't really find people
that were willing to sort of take them
through the problems
and explain them in more detail and i
think people like sharif were actually
the trailblazers like they came into
that community and started sharing uh
things as part of the gge
and now it's really up to all of us to
continue to take on the tone
and actually start taking these
diplomats with us
as we work through technical issues so
overall my perspective is that they're
very very open to it
but we do have to take a step back when
we explain something we can't
immediately dive into the details
we have to kind of start with what we're
trying to achieve and where we're trying
to go
so that's my perspective maybe you have
some other thoughts
yeah it's a learning process for old we
have to realize when we address
like different communities that the
language might be different the
background
i mean we need to understand about their
background my experience being part of
the ungge a group of all diplomats
so the room was full like of diplomats
they are debating things
they have common background however they
were extremely supportive extremely
receptive
and when i mentioned for instance the
first
uh we had a lot of support for such
effort but we need to understand the
language where they are coming from
as i mentioned some of the articles that
they they want to use
need to be adjusted the process of the
open-ended working group was
proposed it took several years for this
to materialize
i've been following the ungge since 2012
so for
eight years the language has changed uh
the open-ended working group has been
established we are lobbying now for
the open-ended working group to continue
in a different formula moving forward
with the support of professionals like
the incident responders here attending
this conference
is very important really for the success
of such efforts
we have one quest one more question and
i'm going to read something that raman
jitsin
chima wrote on the chat box as an
organization that participates in the
un cyber processes and the first member
i just wanted to share from access now
how much
we appreciate first trying to do more
here
and how important it is to engage we
have stressed
how engaging first another technical
expert
on rinsing the response is key and we
hope
we can do more to help and i'm going to
read the following and the last question
because we
don't have uh unfortunately
unfortunately more time in the und ge
do you see people pushing back against
these common norms that are being
developed
if so can you talk to that as to how you
address their
issues
well my experience with the ungg you
find always like
people bringing in articles that are
related to their background so that
happens
however these norms the ones that i
shared is already agreed upon
they have been accepted by the general
assembly nobody is
i mean really working against them the
the challenge is how to make them
uh practical how to apply them to so
it's the operational aspects of how to
make this norm a reality
and how to make sure for us uh belonging
to this
uh a community a community of t-shirts
part of this process a part of the
solution
and and that really should be our
effort across different disciplines
martin would you like to add
so you know i think you covered that
very well sharif thank you
okay so thank you
to everybody for participating in this
talk and
thank you to martin and sheriff for this
great
talk i hope i see
we can see each other soon and a
reminder to all to please
stop by gather for a networking event at
the end of this call
this the url is
on the chat box so i see you in a
few minutes bye thank you very much
everyone
bye