“If you look at history, innovation doesn’t come just from giving people incentives; it comes from creating environments where their ideas can connect” – Steven Johnson.
Almost two years since its inception, the NATO Industry Cyber Partnership (NICP) has enabled NATO to mainstream and enhance industry engagement across a number of initiatives on cyber defence. Information sharing activities, exercises, training and education, and multinational Smart Defence projects are just a few examples of areas in which the private sector and NATO have been working together. Ambassador Sorin Ducaru, Assistant Secretary General for Emerging Security Challenges at NATO Headquarters takes stock of the progress to date and looks to the future.
When Heads of State and Government at the 2014 NATO Summit agreed to intensify cooperation with industry through NICP, they recognised that technological innovations and expertise from the private sector are crucial to enable NATO and Allies to achieve the objectives of the Enhanced NATO Policy on Cyber Defence. The protection of NATO networks is a key priority for the Alliance, and as the majority of Allied networks are owned and operated by the private sector, enhancing our cooperation on innovation activities in the field of cyber defence is particularly important. Cooperation, notably information sharing on threats, can reinforce the resilience of networks and help to prevent, respond to, and recover from cyberattacks.
The NICP stimulated the review of existing initiatives on cyber defence, and stakeholders including industry were consulted to identify gaps and shortfalls, to learn from their experiences, and to determine what approach could best deliver on NATO’s cyber defence policy’s objectives. A snapshot of current NICP activities follow three main strands of work:
- Information sharing to enhance our mutual situational awareness – cyber experts agree that the exchange of information on cyber threats is key in enhancing cyber defence. To this end, in the first quarter of 2016 a pilot project was carried out for the development of an information sharing capability dedicated to interaction with Allied industry partners in the field of cyber defence. This capability was developed based on the experience gained with the NATO Malware Information Sharing Platform (MISP), which is used to share technical characteristics of malware between NATO and NATO nations. The NICP MISP is part of a broader collaborative workspace that is dedicated to the exchange of knowledge and ideas with industry and academia.
- Education, training and exercises – in November 2015, a total of sixty-five industry representatives participated for the first time to NATO’s flagship cyber defence exercise Cyber Coalition Exercise 2015. This exercise held in Estonia tested the ability of Allies and partners to defend their networks from a series of complex security challenges. Also this year industry and academia have been invited to participate in Cyber Coalition 2016. In sharing cyber defence best practices with industry, several cyber Threat Vector Analysis Workshops were conducted at the technical level in February 2016. Also, for two consecutive years Smart Defence Projects workshops were held in Portugal with a strong emphasis on industry cooperation and cyber defence. As industry is interested in capability development for NATO, these workshops are a great venue to show the breadth of activities that NATO is engaged in and the opportunities these present.
- Innovation: research and development – during the Cyber Defence Committee Away Days in 2015 and 2016 to United Kingdom, France, Netherlands, Estonia and Romania cyber representatives from Allied nations engaged in extensive direct interaction with industry representatives and received demonstrations of innovative tools to address the latest and most advanced cyber threats. Furthermore, in the framework of the NICP, the NATO Communications and Information (NCI) Agency recently invited industry to provide innovative proposals in the areas of: Cyber Defence, the Internet of Things, Military Applications of Blockchains, and Cognitive Computing and Machine Learning. A number of the proposals were showcased at the 2016 NCI Agency Industry Conference and AFCEA TechNet International (NITEC16), demonstrating that industry and academia are well positioned to propose emerging solutions to security challenges in NATO.
A question that I have received frequently over the past years has been how industry and academia can sign up for the NICP. Allow me to use this opportunity to explain that the NICP is foremost a framework that facilitates interaction between NATO and private entities. As such an industry partner or academic institution has no need to sign up in order to participate in the NICP. NATO however has formalized its cooperation with some Allied industry partners through Industry Partnership Agreements (IPAs). A total of eight IPAs have been signed by industry and NATO since 2014. The Industry Partner Roster, available under “Related Activities” includes approved industry points of contact provided by Allies.
New activities in the framework of the NICP have been considered and implementation for some of these is already underway. Allies will continue to explore new ways to facilitate the involvement of the most innovative and capable enterprises and academia in an open, transparent and inclusive manner. Ultimately these activities will reinforce the security of NATO networks and our collective resilience. In this regard the Warsaw Summit offers a great opportunity to reflect on NATO’s cyber defence and reaffirm Allied commitment to cyber defence.
A specific area in which I believe we could think of doing more is the cyber defence of our supply chain. I also see value in intensifying our interaction with academia. Further development of the NICP collaborative workspace and a potential “innovation exchange” at the NCI Agency could be valuable environments in this regard. I also encourage industry and academia to come up with new ideas on how we could increase our cooperation. For example, relevant news you would like to share could be made available on the NICP website.
Let me close by thanking Allies, industry, academia, and colleagues for your support. The NICP is a great example of a NATO partnership, helping us identify how to better integrate emerging technologies and new concepts into our cyber defence. We have made progress, but there is still more we can achieve.
– Ambassador Sorin Ducaru