3. Recommendations Cyber security is the responsibility of all stakeholders, including governments, the private sector, civil society, academia, and the technical community. Since the Internet is a global network of interconnected networks, no one stakeholder can act alone to successfully ensure the security of the Internet. Not even governments or powerful network operators can secure the Internet, as clearly shown in various major incidents just within the last year.11 The Internet spans all nations and is made up of thousands of individual networks, each made up of even more users and devices. A trusted Internet infrastructure ecosystem can only be achieved through cooperative efforts among all stakeholders. Every stakeholder must apply the essential principles of awareness, responsibility, cooperation, and uphold fundamental rights and Internet properties when taking specific actions to protect their systems and the wider Internet ecosystem. Otherwise, the measures that are intended to protect the Internet might end up harming it. Based on panel discussions, interviews with experts, existing literature, and, in line with the essential principles, this section presents specific recommendations. Although many cyber security solutions created elsewhere may work for Africa, there are some characteristics that make Africa different. Most African countries differ from the rest of the world (with the exception of some developing countries in other continents) in the following ways: • • • • Shortages of skilled human resources in the area of cyber security Limited resources (including financial resources) available to be allocated by governments, organizations and other stakeholders for cyber security Limited levels of awareness of cyber security issues among key stakeholders, such as ICT regulators, law enforcement agencies, the judiciary, information technology professionals, and users Lack of awareness of the risks involved in the use of ICTs These differences are taken into account in these recommendations. The Guidelines outline the following five dimensions for cyber security solutions: • • • • • Legal and regulatory measures, including legislation and enforcement Capacity building, revolving around strategies for enhancing knowledge, expertise and skills to boost cyber security Technical and procedural solutions as a way to address vulnerabilities in software and hardware Institutional and organizational structures, which aim to create a collaborative environment that is conducive to helping prevent, detect and respond to attacks against critical Internet infrastructure Effective global cooperation, focusing on strategies for continued and inclusive collaboration, coordination and information sharing among all stakeholders to reinforce trust in the Internet However, there are other solutions, such as economic incentives, that could also be used to improve security. 11 14 For example the Dyn DDoS attack, the US Democratic National Committee hack, and the US Department of Justice attack. Internet Infrastructure Security Guidelines for Africa internetsociety.org