Creation of a Global Culture of Cybersecurity

A/RES/57/239View PDF

Who adopted this document and its mandates?

A Resolution of the General Assembly, under agenda item 84c Science and technology for development, published in 2003.

What subjects does this mandate have?

12 subjects

Capacity Building Confidentiality Cybersecurity Data Protection Developing Countries Freedom of Information Information Systems Information Technology International Organizations Risk Assessment Security Management Technology Transfer

What’s in this document?

5 operative paragraphs

Takes note of the elements annexed to the present resolution, with a view to creating a global culture of cybersecurity;

Invites all relevant international organizations to consider, inter alia, these elements for the creation of such a culture in any future work on cybersecurity;

Invites Member States to take into account these elements, inter alia, in their efforts to develop throughout their societies a culture of cybersecurity in the application and use of information technologies;

Invites Member States and all relevant international organizations to take, inter alia, these elements and the need for a global culture of cybersecurity into account in their preparations for the World Summit on the Information Society, to be held at Geneva from 10 to 12 December 2003 and at Tunis in 2005;

Stresses the necessity to facilitate the transfer of information technology and capacity-building to developing countries, in order to help them to take measures in cybersecurity.

Elements for creating a global culture of cybersecurity

Rapid advances in information technology have changed the way Governments, businesses, other organizations and individual users who develop, own, provide, manage, service and use information systems and networks (“participants”) must approach cybersecurity. A global culture of cybersecurity will require that all participants address the following nine complementary elements:

Awareness. Participants should be aware of the need for security of information systems and networks and what they can do to enhance security;

Responsibility. Participants are responsible for the security of information systems and networks in a manner appropriate to their individual roles. They should review their own policies, practices, measures and procedures regularly, and should assess whether they are appropriate to their environment;

Response. Participants should act in a timely and cooperative manner to prevent, detect and respond to security incidents. They should share information about threats and vulnerabilities, as appropriate, and implement procedures for rapid and effective cooperation to prevent, detect and respond to security incidents. This may involve cross-border information-sharing and cooperation;

Ethics. Given the pervasiveness of information systems and networks in modern societies, participants need to respect the legitimate interests of others and recognize that their action or inaction may harm others;

Democracy. Security should be implemented in a manner consistent with the values recognized by democratic societies, including the freedom to exchange thoughts and ideas, the free flow of information, the confidentiality of information and communication, the appropriate protection of personal information, openness and transparency;

Risk assessment. All participants should conduct periodic risk assessments that identify threats and vulnerabilities; are sufficiently broad-based to encompass key internal and external factors, such as technology, physical and human factors, policies and third-party services with security implications; allow determination of the acceptable level of risk; and assist in the selection of appropriate controls to manage the risk of potential harm to information systems and networks in the light of the nature and importance of the information to be protected;

Security design and implementation. Participants should incorporate security as an essential element in the planning and design, operation and use of information systems and networks;

Security management. Participants should adopt a comprehensive approach to security management based on risk assessment that is dynamic, encompassing all levels of participants’ activities and all aspects of their operations;

Reassessment. Participants should review and reassess the security of information systems and networks and should make appropriate modifications to security policies, practices, measures and procedures that include addressing new and changing threats and vulnerabilities.

Who adopted this document and its mandates?

What subjects does this mandate have?

What’s in this document?

Table of contents