PROTECTION OF GOVERNMENT NETWORKS THREAT TYPES ADVANCED PERSISTANT THREAT The government in its national security policy?> has recognized CONVENTIONAL THREAT dependence industries, and economy transportation, on all components The growing dependence increases the level of exposure >» ® B REACTIVE & MANUAL c TOOLS-BASED cyberattacks that could lead to the paralysis of communication INTEGRATEDPICTURE DYNAMICDEFENSE RESILIENT ENTERPRISE government command country Manual maturity level of the state. The goal of NCSP the state of developed and is to reach resiliency and the government agencies are collected can be used for research and formulation, threat analysis, analysis of cyber-attacks. The emerging NCSP is the roadmap that trends and patterns, etc. Reporting** of security breaches and Establish National Database for Monitoring and Reporting government Currently, the country offices that have centralized collection and that manages a national database incidences or events shall be mandatory monitors threat reports, including intrusion information that have been collected shall become The data and information different agencies. remain in silo with To effectively identify and to all a valuable component developing and measures Data 20 (c )(4) and down to the local shall and formulation of Emergency Strategic Plan. This shall form part of the National Drill Exercise which shall be done on a preparing innovative i. Integrating information security measurement into the process for planning, implementing, documenting evaluating, and remedial actions to address any deficiencies in the information security policies, procedures, and practices of the agency; ii. Obtaining the adequate human financial and resources to support information iii. Leading program and implementation the development of any internal guidelines or policy related to information security measures; in periodic interval. report to the agency head on the effectiveness of the agency’s information security proggram, including progress of remedial actions; v. Conducting measures information security development and implementation; vi. Ensuring that a standard process is used throughout the agency for information security measures development, creation, analysis, and reporting; and vii. Using information security measures our Establishment of CISO Programs in Government Agencies information source and Privacy Act of 2012. R.A No. 10173 Section agency include the development policy, resource allocation, and for budget decisions. To implement the strategy efficiently, it is availability of data must be accessible at all 24 protocol should unit. The program Communications of a CISO includes but not limited to: support of the agency’s CIO’s annual part of the operational environment the Computer for in protecting and defending to aid cyberattacks. A well-prepared response The general responsibilities® iv. Using information security measures agencies in the event of a government cyberspace. protect our Cll against potential threat attacks, complete become agencies including agencies and attempts and other computer incidences. shall be established and of any government repository of information. The data and and for the national computer prolonged intrusion attempts including other computer has no single authority Response emergency emergency Units. CISOs have an role to play in security governance. development A program government important security measurement cyberattack or cyber incidents, including to reach the Resilient Enterprise state. Emergency guidelines shall be formulated policy updates and ability to sustain Operations during and after will enable the government and control systems. Computer Program personnel. The data and information that development, services and defense/military Establishment of a National times to authorized is still mostly at a Reactive and infrastructure, international financial systems, critical Figure 3: Cybersecurity Maturity Model The cybersecurity and vulnerability to cyberattacks. These are AGILITY / SPEED OF ACTION into Government Agencies and the Local Government the growing of government, of cyberspace. established recommended that CISO Programs are 25 National Security Council.(2011).National Security Policy 2011-2016: Securing the Gains of Democracy, pp.20. http://www.gov.ph/downloads/2011/08aug/NATIONALSECURITY-POLICY-2011-2016.pdf (f).(2012) 34 26 National Institute of Standards and Technology. (2008). Information Security: Performance Measurement Guide for Information Security (NIST-SP 800-55 Revision 1). U.S. Department of Commerce. Chew, E., Swanson, M., Stine, K., Bartol, N., Brown, A. & Robinson, W. 35