National strategic framework for cyberspace security communication appliances, or also how it can be difficult to find the right balance between the right to privacy and the fight against criminal activities such as child pornography, drugs smuggling, hate incitement or terrorism planning crimes that not only hurt individual and social liberties, but also undermine the very existence of an open, democratic and free Internet. exercised in and throughout cyberspace, or against cyberspace and its fundamental elements. The threat is carried out by means of cyber attacks, by which we mean more or less automated actions of individuals and organizations, both governmental and non-governmental, aiming at disrupting, damaging or impeding the regular functioning of computer systems, ICT networks or supervisory control and data acquisition systems and data processing, or at compromising the authenticity, the integrity, the availability or the confidentiality of data residing in those systems or transiting through the networks. The most sophisticated cyber attacks can be carried out through so called cyberweapons, that is a malicious software (i.e. malware) designed to damage or alter an IT system with the aim of causing its malfunction, or even physical damage. Objectives The present National Cybersecurity Strategic Framework and the related National Plan, both foreseen by the Prime Minister’s “Decree Containing Strategic Guidelines for the National Cyber Protection and ICT Security” of the 24th January 2013, aim at enhancing the national preparedness to respond to present and future challenges affecting cyberspace, and are devoted to directing all national efforts toward common and agreed solutions, knowing that cybersecurity is a process rather than an end to itself, that technical innovations will always introduce new vulnerabilities in the strategic and operational horizon, and that the intrinsic nature of the cyber threats makes our defence, at least for the time being, mostly – although not exclusively–reactive. An insidious threat A fundamental characteristic of the cyber threat is its asymmetric nature. The attacker: • May strike from anywhere in the world, as long as he is connected to the Internet; • Exploits one single vulnerability to hack into very sophisticated and otherwise well protected computer systems; • Attacks instantaneously, allowing no time to mount an appropriate reaction; • Can hardly be traced or even detected, making it extremely complex for the defender to put in place a response. The cyber threat and its actors Definition We define the cyber threat as the complex of malicious conducts that can be 12