IGF 2024 Day 0 Event #35 Empowering consumers towards secure by design ICTs

This interactive workshop was opened by Wout de Natris who is the coordinator of the IGF’s Dynamic Coalition on Internet Standards, Security and Safety (IS3C). Wout explained that IS3C’s overarching aim is to make online activity and interaction more secure and safer by achieving more widespread and rapid deployment of existing security related Internet standards and ICT best practices. Further information about IS3C is available at https://www.intgovforum.org/en/content/internet-standards-security-and-safety-coalition-is3c and https://is3coalition.org/ .  

IS3C’s policy research and best practice analysis since its launch in 2020 has focussed on three priority areas: i. security policies for the Internet of Things; ii. education and skills gaps relating to cybersecurity; and iii. public and private sector procurement practice as a driver for deploying security standards. It is now time to put theory into practice through creating capacity building programmes so that the guidelines, policy recommendations and tools developed by IS3C based on its research analysis, can be implemented worldwide.

With this aim in mind, IS3C working group leaders presented in this session the following proposals for action:

1. the establishment of a Cybersecurity Hub that will bring together industry and education experts to address gaps in cybersecurity skills;
2. the dissemination of a list of the most important security-related Internet standards, and a narrative for promoting the adoption of RPKI and DNSSEC;
3. the creation of a new IS3C workstream to examine the role of consumer protection agencies in advancing greater security online, and make recommendations;
4. the roll out of a project to analyse the societal impacts of ubiquitous secure by design Internet of Things (IoT) and post-quantum cryptography (PQC).

i. IS3C’s Cybersecurity Hub proposal

Janice Richardson, Chair of IS3C’s Working Group 2 on Education and Skills (read here for IS3C WG 2 plan and mission statement: https://is3coalition.org/working-groups/) explained the background to the proposal to establish the Cybersecurity Hub.  There has been a tectonic switch in the cybersecurity landscape with the growth of cyberattacks and the rise of generative AI has made it much easier to attack many of the applications that are used daily.  Organisations have increasingly moved their business to the cloud and this has also created points of fragility and identity-based attacks are growing considerably.  It is important therefore to educate Internet users about how to address these risks.

IS3C’s study on education and skills, published in 2023 (https://is3coalition.org/docs/study-report-is3c-cybersecurity-skills-gap/), showed that industry was increasingly concerned that young people are graduating from tertiary education without the necessary cybersecurity skills. Industry looks to the tertiary education sector to act in addressing these skills gaps.

Furthermore, all Internet users need to be made much more aware of the fundamentals of effective cybersecurity. Young people need to understand the architecture of the Internet and the architecture of the cloud, if they are really going to help find innovative solutions.

Educational curricula need to address these needs and it is important to improve the collaboration and the sharing of resources between industry and the tertiary education sector in order to do this. It is also necessary to address the lack of diversity and gender balance in the cybersecurity sector: if we do not have more women and people from different racial and cultural backgrounds involved in cybersecurity, it will not be possible to understand fully where the security breaches are occurring and how to address them.

IS3C’s solution for addressing the security skills and knowledge gaps, the lack of collaboration between industry and the education sector, and the low level of diversity in the cybersecurity industry, is to establish a Cybersecurity Hub as a place where people from all walks of life, including young people, who are interested and involved in the cybersecurity system, can meet, exchange ideas and develop solutions to address these skills gaps. IS3C extended at IGF 2024 an open invitation, with a promotional video https://is3coalition.org/cybersecurity-hub/ to join the IS3C team in January 2025 when they will be holding meetings in preparation for establishing the Cybersecurity Hub during 2025. 

ii.  IS3C’s tool for promoting the deployment of RPKI and DNSSEC

Bastiaan Goslings of the .nl registry SIDN and a leading expert in IS3C’s Working Group 8 on RPKI and DNSSEC deployment presented this new IS3C tool which provides a non-technical narrative for decision-takers on the need to deploy operationally these two key standard (see: https://is3coalition.org/docs/how-to-convince-your-boss-to-deploy-dnsse…). This IS3C workstream was supported ICANN and RIPE NCC.

Although RPKI and DNSSEC have been available for several years as fundamental standards for the secure routing of Internet traffic, deployment is not optimal. While there has been some growth in their deployment, the level of implementation has been inconsistent and variable across different operators and geographical regions. In order for these two standards to achieve greater impact globally in increasing Internet security, their deployment needs to be increased substantially and more consistently worldwide. 

Bastiaan emphasised that addressing this problem is fundamental to the security of the global routing of Internet traffic across the Internet’s domain name system which all Internet users, corporate businesses and public organisations rely on for trusted online communications and secure access to online services and content. IS3C’s Working Group 8 chaired by David Huberman of ICANN aimed to do this through developing a different positive narrative for decision-takers that would augment the existing supporting technical documentation.

Bastiaan explained that the IS3C working group identified several barriers to adoption and implementation that this new narrative would need to overcome. These  include a widespread perception of technical complexity associated with these standards, and the expectation of additional major costs if they were adopted with resulting pressure on corporate resources. There are also assumptions that there are major knowledge and expertise requirements in order to operate these standards, as well as the need for additional management and control software and hardware.

Many of these barriers and constraints are due to lack of proper informed awareness raising, education and training of engineers. Moreover, ICT managers often fail to understand the strategic security considerations and objectives for both public and private sector organisations, consistent with national security priorities, which RPKI and DNSSEC are instrumental in supporting. It needs to be better understood that the reputation of organisations as trusted partners for secure online services and related infrastructure, depends on the deployment of these key standards.

The IS3C narrative setting out the benefits of RPKI and DNSSEC is therefore a tool for creating a better understanding of the long-term strategic value of adoption and implementation, and of the significant contribution they make to creating a safer and more secure online society. 

iii. New IS3C workstream proposal on the role of consumer protection in advancing greater online security.

Wout de Natris explained that in the previous 12 months IS3C has consulted experts in the consumer protection field on the merits of examining how consumer protection bodies and regulators could actively contribute to achieving greater security online,  through for example labelling schemes and testing of Internet-related consumer products. The feedback from these preliminary discussions has been that this would be a valuable workstream for IS3C to establish, with the potential aim of developing guidelines, toolkits for consumer organisations, and recommendations for best practice.

Kristina Mikoliuniene of the Lithuanian communication regulatory authority RTT  explained the regulator’s role in Lithuania in resolving consumer disputes about security, in child protection and in acting as an independent auditor for trust services and electronic identification. RTT operates one of the ten national safer Internet hotlines and has a cooperation agreement with Interpol. They have also engaged collaboratively with Internet platforms and service providers, including Google, YouTube and Tiktok.

Steven Tan of the Singapore cyber security agency CSA, emphasised that it is important to work with industry on promoting cybersecurity awareness, for example to push ICT providers in adopting stronger security measures.  He explained that if the national regulatory framework sets minimum security expectations, providers and developers of devices and services have no choice but to comply. This helps make security a standard practice rather than providing a competitive edge for individual suppliers in the market. 

Adopting this approach of balancing national regulation and industry recognition, Singapore for example launched an Internet hygiene portal and a cybersecurity scheme for IoT products, alongside initiatives such as industry certification and security labelling of devices. Steven said that such schemes drive greater compliance with cybersecurity standards which can exceed minimum security requirements while also enabling businesses to develop market advantage. He said that this mix of regulatory requirements and incentives motivates industry to keep adding improvements to the security of devices and applications.

Kristina agreed that over-regulation can stifle market investment and inhibit innovation: RTT supports this broad approach of balancing regulation with incentives for industry.

With regard to international cooperation, Steven Tan said that in addition to common security standards and more effective and faster responses to cybersecurity incidents, governments can play a crucial role in sharing cyberattack information, coordinating responses, and collaborating in joint initiatives. These cooperative initiatives help to build collective resilience and ensure that no country is left vulnerable due to being isolated from cybersecurity responses.

CSA for example has developed a close working relationship with industry players such as Microsoft, Google, APNIC and the Internet Society. This kind of collaboration, coupled with government-led information sharing efforts, enhances cybersecurity capacities through information sharing, training and joint research initiatives.  For example, working together to make IoT devices more secure will lead to the alignment of common security baselines which in turn ensures that consumers have access to safer products.

These international partnerships also help to address cross-border cyberattacks more effectively, making it harder for attackers to exploit gaps in security levels between different regions. Such international cooperation leads to better protection, greater trust, and more resilient digital services for everyone; governments need to work with industry to create a united front in creating greater digital trust. 

Kristina agreed that international cooperation is vital for creating greater consumers safety on the Internet, through for example learning from the mistakes of others so that the same mistakes are not repeated in every country because of separately held views or attitudes to the same issues. The market analysis which RTT undertakes includes researching the experience of other countries, as well as sharing Lithuania’s experience with responding to cyberattacks etc.  

In terms of a model for such cross-border cooperation, Steven Tan suggested that working groups such as those created by IS3C provide a good starting point. These should involve government policymakers, industry leaders, standards-setting bodies and consumer groups, with the aim of collaborating on global frameworks for the Internet and applications security, ensuring that solutions would work across borders in support of a common global Internet and avoiding the risks of fragmentation and balkanisation.

Steven added that a further step would be to establish workshops in regional fora where experts can discuss security challenges in order to mitigate the incidence of cross-border cybercrime. Capacity building initiatives would also be key in sharing best practice and supporting technology transfers, with the aim of ensuring that no region or country is left behind in achieving a safer and more secure Internet.

Kristina added that it is very important first of all to clarify and define the problem to be addressed through such cooperation because the Internet has so many different layers, and in every layer there are some different problems, and then identify the experts and key actors to involve in the work, to undertake the necessary lobbying for adoption of solutions, and which tools to use in the process (such as internet.nl for testing security resilience etc).

iv. IS3C project on social impacts of IoT security by design and post quantum cryptography (PGC).

Wout de Natris announced that IS3C will start a new project in early 2025 that will be led jointly by the chairs of Working Group 1 on IoT security by design and Working Group 9 on emerging technologies, which will examine the societal impacts of IoT security and post quantum cryptography. This IS3C project is supported by the French Internet registry Afnic.

Nicolas Fiumarelli, chair of working group 1, summarised the work undertaken in 2022-23 to compile a comprehensive analysis of national IoT policies and regulatory documents from 22 countries in all regions (see: https://is3coalition.org/docs/saving-the-world-froman-insecure-internet…). Analysis of these documents identified over 400 different best practices relating to security. 

A major conclusion drawn from this analysis was that nations particularly in the Global South lack enforceable IoT security policies because many are voluntary or fragmentary ones. Global adoption of the security by design principles is therefore hindered by this inconsistent regime of policy standards. 

On the positive side, IS3C’s research identified examples of promising solutions such as the cybersecurity labelling schemes introduced in Singapore and Finland which empower consumers by providing clear information about products’ security features. This in turn drives manufacturers to prioritise security in their product design and development.

Nicolas said that these systems require robust independent testing mechanisms to ensure their effectiveness. Consumer empowerment such as that provided by labelling schemes, must be complemented therefore by strong regulatory frameworks. IS3C Working Group 1 will continue in 2025 to update and add to its repository of data on IoT security polices worldwide with the aim of promoting greater regional adoption of best practices for ensuring greater safety and security of IoT devices and related network applications. 

With specific regard to Working Group 1’s contribution to the joint project with Working Group 9, João Moreno explained that he will lead in analysing the societal implications and consequences of the current levels of IoT security, the impacts of threats such as hacking. The aim will be to identify what needs to change in order to strengthen the levels of security so that society is safer in the era of ubiquitous connected objects.

Dr Elif Kiesow Cortez described the involvement of IS3C Working Group 9 on emerging technologies (information to WG9 https://is3coalition.org/working-groups/) in this joint IS3C project. The working group will commence its next phase of work in early 2025 on post quantum cryptography (PQC). The Afnic-funded project research will therefore have two intersecting areas of focus: one dedicated to the societal impacts of IoT security and the second of the impacts of post quantum cryptography. Following a combined analysis of these domains, the project will proceed to undertake a multidimensional analysis of societal, legal, economic and environmental impacts.

Elif emphasised that it will be important for the project to facilitate stakeholder engagement and dialogue about the societal implications and issues, such as digital transformation, economic competitiveness, future proofing against emerging threats and defining the optimum way forward for the secure global deployment and roll out of these technologies through effective international cooperation. IS3C intends therefore to submit a workshop proposal for this purpose at the next IGF in Norway in June 2025.

The project’s principal outputs will be a report setting out policy recommendations, both at the state level and at the organisational level.

Conclusions – the way forward for IS3C

In his closing remarks, Wout de Natris reviewed the significant progress that IGF’s Internet Standards and Safety dynamic coalition had made since its launch at the virtual IGF in 2020 with the mission to make the Internet safer and more secure. The coalition’s initial focus had been on three specific policy areas: security by design for the Internet of Things; gaps in education and skills relating to cybersecurity; and procurement practice as an under-used driver of deployment of security standards.  

In 2021, IS3C presented its plans on how to address those three challenges. After relying wholly on voluntary contributions by experts, the first sources of funding for the coalition’s work came through in 2022 which provided support for the research activities and the publication in 2023 of IS3C’s first three reports with recommendations and guidelines in 2023. The scope of the coalition’s work has expanded since then with additional areas of cybersecurity policy focus, including the deployment of specific standards (RPKI and DNSSEC) and emerging technologies (AI and quantum). 

The ongoing challenge to secure funding for IS3C’s research projects, and to ensure that IS3C’s outputs of policy recommendations, best practice guidance and toolkits are disseminated as recognised IGF outputs, has led to internal discussions about how organising the coalition in a different way might help to overcome these operational challenges. IS3C leadership team comprising the Coordinator, the Working Group chairs and the Senior Policy Adviser Mark Carvell, is now reviewing two options for the way forward for sustaining the future conduct of IS3C’s work. 

Firstly, the leadership team has decided to apply for IS3C to become an Internet Society special interest group. This will enable IS3C to spreads its wings beyond the IGF community and attract funding for projects and develop the outputs as capacity building programmes (which is not an IGF function) while still retaining its status as an IGF dynamic coalition.

The second option currently under consideration by IS3C’s leadership team is to incorporate the coalition formally as a not-for-profit foundation with an oversight board that would consider strategic issues including funding structure. This could possibly be supported by a membership fee and donations which the coalition is not able to accept under its current financial arrangements.

Wout thanked all presenters, co-moderators, technical IGF team and the scribes before he closed the meeting.