N AT I O N A L CY B E R S ECU R I T Y ST R AT EGY 7 Targets and Objectives of the Strategy, evaluation criteria and their Values Cyber Security and Cyber Defence Capabilities of the State 5. The first target of the Strategy is to strengthen cyber security in the country and to develop cyber defence capabilities. 6. Like other countries of the world that have well-developed broadband infrastructures and in which ICT potential is being actively explored, Lithuania has become attractive not only to individuals, groups of individuals or organised groups but also to the countries specified in the reports of national security threats and issued annually by the State Security Department of the Republic of Lithuania and the Second Investigation Department under the Ministry of National Defence of the Republic of Lithuania (hereinafter referred to as the “SSD” and “SID”, accordingly). Those countries threaten Lithuania’s national security and conduct hostile activities in global and Lithuanian cyberspace. Data collected by the National Cyber Security Centre under the Ministry of National Defence (NCSC), SSD and SID reveal that Lithuania continuously encounters various types of cyber incidents that are intended to encroach on the information resources and critical information infrastructures. According to forecasts, the number and extent of cyber incidents are expected to increase.1 7. According to data in the National Cyber Security Status Report 2017, the National Electronic Communication Networks and Information Security Incidents Investigation Unit (also referred to as the “Computer Emergency Response Team in Lithuania” or “CERT-LT”) processed 54,414 cyber incidents in 2017. Also in 2017, the number of recorded cyber incidents was 10% higher than in 2016. While cyberespionage attacks primarily target Lithuanian state information resources, private critical information infrastructures and other entities of strategic or significant importance to the national security are also at risk. While applying technical cyber security measures, the NCSC has identified that the highest number of malware was detected in the sectors of energy (27%), public security and legal order (22%) and foreign affairs and security policy (21%). Compared to 2016, malware has mostly spread in the fields of public security and legal order, foreign affairs and security policy and energy. The condition of public sector websites, which according to the National Cyber Security Status Report 2017 has deteriorated, also influence the state of cyber security. 8. The explosion of cyber incidents that is indicated in the annual reports of the NCSC, SSD and SID is proof that every cyber security entity must determine the amount of time, money and other resources to allot to the protection of their communication and information systems and provided services. Cyber security entities perform security risk assessments, but they are often of formal nature only and are conducted so as to comply with legal requirements or internationally recognised standards. The Risk Analysis Manual published by the Ministry of the Interior of the Republic of Lithuania 12 years ago reflects the progress in risk assessment in the light of current conditions of research and innovation, but the security risk assessment methodology has changed over time and the understanding of risk assessment performance has transformed from the assurance of control environment to the holistic approach of risk assessment of organisations’ activities. 9. Individual security risk assessment processes have already reached maturity level in Lithuania, however, on the national level, the security risk The State Security Department of the Republic of Lithuania and the Second Investigation Department under the Ministry of National Defence (2018). National Security Threat Assessment; National Cyber Security Centre under the Ministry of National Defence (2018). National Cyber Security Status Report 2017. 1