The recommendations in this section address all five dimensions.12 It has to be noted that some of these recommendations could already be implemented in some countries, while not in others. Although the emphasis is on Internet infrastructure security, it is sometimes difficult to separate it from the general objective of information and network security. Therefore, some recommendations may lie closer to the sphere of general information security. 3.1 Regional (AU Level) As the Internet is designed as a collection of networks, responsibility for security is shared. Every participant should be conscious that their own security also depends on the security of neighbouring networks and that their security decisions impact others. There is a collective responsibility to implement best practices for Internet security. We recommend establishing a coordination structure at the continental level and engaging in new capacity building initiatives. It should be noted that we have surveyed the existing Africa-wide institutions that are engaged in Internet-related activities to avoid any major duplication of efforts. 3.1.1 Form an Africa-Wide Cyber Security Collaboration and Coordination Committee (ACS3C) An Africa-Wide Cyber Security Collaboration and Cooperation Committee (ACS3C) would help facilitate coordination and information sharing among stakeholders, help identify cyber security areas where resources are needed, and advise African Union policymakers on regional strategies and capacity building. The Committee would be an evolving, compact, and trusted network of experts formed by the AUC in collaboration with the African Internet community. The Committee’s leadership should be multistakeholder. It should include experts from relevant Africa-wide and national level organizations, and institutions such as AfricaCERT, representatives from academia, the technical community, civil society, regional law enforcement agencies, and some national cyber security multistakeholder structures. Through its multistakeholder network structure, the Committee could more flexibly adapt to the new and emerging security challenges facing Africa. The Committee could be tasked to advise and support the AUC in its cybersecurity activities by: • • • • • • • • • Advising the AUC on cyber security issues and policies, such as capacity building initiatives Proposing solutions to facilitate the implementation of the Convention Sharing best practice recommendations for Internet infrastructure security Identifying areas of research needed for the formulation of policies, guidelines, etc., which can be general or sector-specific, for instance, cyber security for smart grid technologies in the electric power industry, for financial systems, and for equipment monitoring tools Identifying ways to support Computer Security Incident Response Teams (CSIRTs), including AfricaCERT, in the area of capacity building and information sharing at the regional and African Union level Encouraging close collaboration among stakeholders, including in responsible and coordinated disclosure Proposing ways to increase the skills of security professionals in Africa (e.g. by fostering trusted certification programs) Supporting the AUC in formulating strategies for cyber security and capacity building Supporting the AUC and Member States in international cooperation regarding cyber security The Committee should work in close collaboration with the Communication and Information Communications Technology (ICT) Specialized Technical Committee of the AU. 12 For expanded recommendations on legal measures see, for example, UNECA���s “Tackling the challenges of cyber security in Africa”, Issue Number NTIS/002/2014. internetsociety.org Internet Infrastructure Security Guidelines for Africa 15