4 ‫والغ اٌزهذَذاد اٌّزٕبُِخ‬ The Evolving Threat Landscape The environment that Jordan operates in subjects it, in common with other global and regional governments, to threats that are constantly evolving. Recent attacks on other global governments and organisation‟s infrastructure and personnel have highlighted the need for an integrated, coordinated, and consistent approach for managing national information security threats. Events that have also highlighted the diverse range of threats that governments face include but are not limited to:  The Snowden leaks have shown the ease with which vast amounts of classified data can be removed from a “highly secure‟ network by an insider and released to the media, the public and used by foreign intelligence services and other organisations;  Threats to sensitive and often classified intellectual property have been highlighted by the WikiLeaks disclosures exposing, amongst others, National Security Agency (NSA) and Central Intelligence Agency (CIA) activities and tools;  The recent 'WannaCry' ransomware attack that seriously affected the UK‟s National Health Service (NHS) displayed the ease with which cyber-attacks can cripple essential services; ٠ِ‫ ػ‬ٟ‫ٓخص حألخش‬ٌٞ‫ حألسدٕ – ًلخٍ حُل‬ٚ‫حؿ‬ٞ٣ ‫ض‬ّٜ‫هذ ٗز‬ٝ ،‫ش‬٤ٓ‫ذحص ٓظ٘خ‬٣‫ذ‬ٜ‫ ط‬-ُْ‫حُؼخ‬ٝ ‫ حُٔ٘طوش‬ٟٞ‫ٓغظ‬ ‫ش‬٤‫ طل‬٠٘‫ر‬ٝ ‫ٓخص‬ٌٞ‫ذكض ٓئخشح ك‬ٜ‫ حعظ‬٢‫ـٔخص حُظ‬ُٜ‫ح‬ ‫ حػظٔخد‬٠ُ‫ حُلخؿش ا‬٠ُ‫ ٓ٘ظٔخص ػذس ا‬٢‫ٖ ك‬٤‫ظل‬ٞٓٝ ‫خص‬٣‫خص ادحسس طلذ‬٣‫ٓظ٘خعن ُـخ‬ٝ ‫ٓ٘غن‬ٝ َٓ‫ ٓظٌخ‬ٚ‫ؿ‬ٞ‫ط‬ .٢٘‫ؽ‬ُٞ‫ٓخص ح‬ِٞ‫أٖٓ حُٔؼ‬ ٢‫٘ش حُظ‬٣‫ذحص حُٔظزخ‬٣‫ذ‬ٜ‫ أرشصص حُظ‬٢‫طشَٔ حألكذحع حُظ‬ ‫َ حُٔؼخٍ ال‬٤‫ عز‬٠ِ‫ ػ‬٢ِ٣ ‫ٓخص ٓخ‬ٌٞ‫خ حُل‬ٜٜ‫حؿ‬ٞ‫ط‬ :‫حُلظش‬  Cyberattacks in the Middle East have typically been carried out by hackers targeting the oil and gas sectors, defence and security and other critical industries. ‫شص‬ٜ‫ أظ‬٢‫( حُظ‬Snowden) ٕ‫د‬ٞ٘‫زخص ع‬٣‫طغش‬ ‫خٗخص‬٤‫خثِش ٖٓ حُز‬ٛ ‫خص‬٤ًٔ ‫ُش كزف‬ٜٞ‫ ع‬ٟ‫ٓذ‬ ‫حُٔظ٘لش ٖٓ "شزٌش آٓ٘ش ؿذح" ٖٓ هزَ شخض‬ ‫ش‬٤‫غ‬٤‫ط‬ٝ ّٞٔ‫ُِؼ‬ٝ ّ‫خ ُإلػال‬ٜ‫ز‬٣‫طغش‬ٝ ،‫خ‬ٜ٤ِ‫ٓطِغ ػ‬ ‫ش‬٤‫ًخالص حالعظخزخسحص حألؿ٘ز‬ٝ َ‫خ ٖٓ هز‬ٜٓ‫حعظخذح‬ .‫خ ٖٓ حُٔ٘ظٔخص‬ٛ‫ش‬٤‫ؿ‬ٝ  ‫ هذ‬٢‫حُظ‬ٝ ،‫ش حُلشؿش‬٣‫ش حُلٌش‬٤ٌُِٔ‫م ح‬ٞ‫ذ كو‬٣‫ذ‬ٜ‫ط‬ ‫هذ أدص‬ٝ ،‫ش ٓظ٘لش‬٣‫ٓخص عش‬ِٞ‫طشٌَ ًزُي ٓؼ‬ ٖ‫ حٌُشق ػ‬٠ُ‫خ ا‬ٛ‫ش‬٤‫ؿ‬ٝ ‫ٌظ‬٤ِ٤ٌ٣ٝ ‫زخص‬٣‫طغش‬ ‫ش‬٣‫ًخُش حالعظخزخسحص حُٔشًض‬ٝ ‫حص‬ٝ‫أد‬ٝ ٍ‫أػٔخ‬ .٢ٌ٣‫ حألٓش‬٢ٓٞ‫ًخُش حألٖٓ حُو‬ٝٝ ‫ش‬٤ٌ٣‫حألٓش‬  ‫خ‬ٜ٘ٓ ،‫شس‬٤‫ أُلوض أػشحسح ًز‬٢‫ش حُظ‬٣‫خص حُلذ‬٤‫رشٓـ‬ ‫ش‬٤‫جش حُخذٓخص حُظل‬٤ٜ‫َ حُٔؼخٍ ٓخ ُلن( ر‬٤‫ عز‬٠ِ‫ػ‬ ‫ ٓخ ًشق ػٖ هذسس‬ٞٛٝ ،‫ش‬٤ٗ‫طخ‬٣‫ش حُزش‬٤٘‫ؽ‬ُٞ‫ح‬ ‫ْ حُخذٓخص‬٣‫ اػخهش طوذ‬٠ِ‫ش ػ‬٤ٗ‫زشح‬٤‫ـٔخص حُغ‬ُٜ‫ح‬ .‫ُش‬ٜٞ‫ٖ رغ‬٤٘‫حؽ‬ُِٞٔ ‫ش‬٤‫حألعخع‬  ٕ‫ ًخ‬٢‫عؾ حُظ‬ٝ‫ حُششم حأل‬٢‫ش ك‬��ٗ‫زشح‬٤‫ـٔخص حُغ‬ُٜ‫ح‬ ‫ٕ هطخػخص حُ٘لؾ‬ٞ‫ذك‬ٜ‫غظ‬٣ٝ ‫خ حُوشحط٘ش‬ٜ‫ّ ر‬ٞ‫و‬٣ ‫ش رُي ٖٓ حُوطخػخص‬٤‫ؿ‬ٝ ٖٓ‫حأل‬ٝ ‫حُذكخع‬ٝ ‫حُـخص‬ٝ .‫حُلغخعش‬  Governments, regulators, and societies are increasingly holding public and private organisations to account for practices across the globe. The previous approach of governments and organisations has been to adopt a defensive and reactive stance, hoping that the provision of standards combined with market pressures will improve the security of products and systems. However, experience has shown that this has not provided sufficient cyber protection and has led to economic loss, reputational damage and increasing legal challenges. ‫حُٔـظٔؼخص‬ٝ ‫ش‬٤ٔ٤‫خص حُظ٘ظ‬ٜ‫حُـ‬ٝ ‫ٓخص‬ٌٞ‫ حُل‬ٚ‫ؿ‬ٞ‫ضدحد ط‬٣ ّ‫ ٓغخءُش ٓئعغخص حُوطخع حُؼخ‬ٞ‫ٍ حُؼخُْ ٗل‬ٞ‫ك‬ ‫ٓخص‬ٌٞ‫ حُغخرن ًخٗض حُل‬٢‫ كل‬،‫خ‬ُٜ‫حُخخص ػٖ أكؼخ‬ٝ ‫ حالعظـخرش‬٠ِ‫ؼظٔذ ػ‬٣ ‫خ‬٤‫هلخ دكخػ‬ٞٓ ‫حُٔئعغخص طظخز‬ٝ ٖٓ‫ٖ أ‬٤‫ طلغ‬٠ُ‫طَ ا‬ٞ‫رُي أٓال رخُظ‬ٝ ،‫ع حُلذع‬ٞ‫ه‬ٝ ‫رؼذ‬ ‫حطلخص‬ُٞٔ‫حألٗظٔش ٖٓ خالٍ حػظٔخد ح‬ٝ ‫حُٔ٘ظـخص‬ ‫٘ض اخلخم‬ٛ‫ اال إٔ حُظـشرش هذ رش‬،‫م‬ٞ‫خص حُغ‬٤ُ‫ػـؾ آ‬ٝ ٢ٗ‫زشح‬٤‫ش ُِلؼخء حُغ‬٤‫ش ًخك‬٣‫ٖ كٔخ‬٤ٓ‫ طؤ‬٢‫ ك‬ٚ‫ؿ‬ٞ‫زح حُظ‬ٛ ‫ عٔؼش‬٢‫اػشحس ك‬ٝ ‫ش‬٣‫ خغخثش حهظظخد‬٠ُ‫ ا‬ٟ‫ ٓخ أد‬ٞٛٝ ‫ش‬٤ٗٞٗ‫خص حُوخ‬٣‫ كؼال ػٖ حُظلذ‬،‫ حُٔئعغخص‬ٙ‫ز‬ٛ .‫ذس‬٣‫حُٔظضح‬ The threat context discussed in this strategy seeks to highlight the sources of threat and levels of persistence to relevant information assets and people. ‫ش‬٤‫ـ‬٤‫ حالعظشحط‬ٙ‫ز‬ٛ ُٚٝ‫ طظ٘خ‬١‫ذحص حُز‬٣‫ذ‬ٜ‫ذف ٗطخم حُظ‬ٜ٣ ٟ‫ٓذ‬ٝ ‫ذحص‬٣‫ذ‬ٜ‫ حُظ‬ٙ‫ز‬ٛ ‫ ٓظخدس‬٠ِ‫ء ػ‬ٞ‫ؾ حُؼ‬٤ِ‫ طغ‬٠ُ‫ا‬ .‫ حُ٘خط‬٠ِ‫ػ‬ٝ ‫ٓخص‬ِٞ‫ٍ حُٔؼ‬ٞ‫ أط‬٠ِ‫خ ػ‬ٛ‫ؿغخٓش آػخس‬ National Cyber Security Strategy 2018-2023 Page 7 of 29 4 2023 – 2018 ٢ٗ‫زشح‬٤‫ش ُألٖٓ حُغ‬٤٘‫ؽ‬ُٞ‫ش ح‬٤‫ـ‬٤‫حالعظشحط‬