policies designed for CIIP. This may result in inadequate security of these assets and services. Likewise, non-critical Internet infrastructure classified as “critical” is impacted by policies created for CIIP, potentially harming its efficiency. African governments and other stakeholders should take a service-based approach to identifying critical Internet infrastructure. That means that services, such as those vital “for public safety, economic stability, national security, international stability, and for the sustainability and restoration of cyberspace”13 should be studied to discern the Internet infrastructure essential for the provision of these vital services. This infrastructure is then classified as “critical Internet infrastructure”. Alongside services, the identified critical Internet infrastructure should also be examined for dependencies. Integral stakeholders related to critical Internet infrastructure should also be identified. Prioritizing their importance, conducting risk assessments, and building appropriate security defences around them should be undertaken, while maintaining functionality. Risk assessments are especially important in this context to evaluate what security solutions make sense relative to the specific assets. Given limited resources, it is essential that the steps taken are appropriate to the risk, and neither too little or too much. Alongside risk assessments and a services-based approach, threat modelling can be a useful method for identifying and protecting critical Internet infrastructure. Threat modelling is a method in which potential threats are identified and prioritized by assuming the attacker’s point of view. This method allows defenders to determine the threat vectors likely to be used by attackers and their probable targets. 3.2.2 Facilitate Information Exchange through a National Multistakeholder Structure Promoting information sharing at the national level is important for developing a healthy Internet infrastructure security ecosystem. National multistakeholder structures should be established to provide an advisory role to the national government on cyber security strategy and policy, and facilitate information sharing among stakeholders. These structures should be multistakeholder in nature and include stakeholders such as the national CSIRTs, the national government, civil society, academia, the technical community, and private sector. Drawing on the expertise of its stakeholder groups, the network would identify areas where action should be taken on a national level. Examples of advised national actions could be new training programs to alleviate a capacity gap in a specific security area, or adopting a new security practice within government agencies. 3.2.3 Establish and Strengthen National Level Computer Security Incident Response Teams (CSIRTs) CSIRTs are vital in addressing Internet infrastructure security issues. They perform an important function in identifying security incidents, helping organizations protect themselves against cyberattacks, and in recovery. The frequency and gravity of cyber threats necessitates effective watching, warning and incident response capabilities. Even a well-defended organization will likely experience a cyber incident at some point. All stakeholders, including the AU, national governments, and the technical community, should work to establish CSIRTs where none exist, and support CSIRTs that promote the principles of awareness, responsibility, cooperation and fundamental rights and Internet properties, along with a free and open Internet. 3.2.4 Promote Internet Infrastructure Resilience through Internet Exchange Points (IXPs) Governments should promote the use of IXPs and increased cooperation and connectivity between different African networks. IXPs can limit the scope of cyberattacks. Lower traffic loads on international connections make DDoS attacks harder to carry out on those 13 See the African Union Convention on Cyber Security and Personal Data Protection at https://www.au.int/web/en/treaties/african-union-convention-cyber-security-and-personal-data-protection internetsociety.org Internet Infrastructure Security Guidelines for Africa 17