N AT I O N A L C Y B E R S E C U R I T Y ST R AT E GY I V II.3 ENSURING DIGITAL SOVEREIGNTY conducted among all public sector stakeholders, involving, according to their needs and mandates, stakeholders from industry, research, or civil society. • In cooperation with its partners in the European Union, the Luxembourg government will continue its efforts to ensure digital sovereignty at national and European level. Reflections on this subject will be II.4 CONTINUOUS IMPROVEMENT OF INCIDENT DETECTION AND MANAGEMENT • The capacity to prevent and detect intrusions into State networks and information systems will be improved and gradually extended to all critical systems and networks. architecture and capabilities of the logging system and GOVCERT’s management processes will be continuously adapted to the development of the State’s information systems. • The capacity to process and analyse security logs will be strengthened. The collection, analysis and correlation of security events are essential for the early detection of attacks, for rapid responses in the event of a compromise, and for subsequent investigation in the event of an incident. The • Systematic recourse to teleworking significantly increases the area of exposure to attacks. In the event of a security incident and in order to minimise the risks of malicious propagation and data leakage, the use of remote analysis and diagnostic tools will be promoted. II.5 CYBER SITUATIONAL ANALYSIS (CYBER WEATHER) AND CYBER INTELLIGENCE • The systematic analysis of the information gathered, combined with the analysis of the modus operandi of the attacks, will enable a better understanding of the state of the threat (cyber intelligence) and the identification of concrete and actionable recommendations for prevention and preparedness. • Better shared situational awareness will enable all stakeholders to act in an informed and concerted manner to ensure a level of security appropriate to the current state of threat. • Within the framework of the Cyber Weather initiative launched by GOVCERT, the Luxembourg CERTs, based upon a dynamic analysis of notified incidents, regularly constitute an inventory at the national level. In close collaboration with all the players involved, the inventory will be gradually expanded by incorporating information from other available sources (sectoral ISACs, SOCs, intrusion detection probes, risk analyses, etc.). • The State entities concerned will ensure coherent and exploitable dissemination of current threats to public and private operators and professionals in the ICT sector on the one hand, and, on the other hand, will ensure the dissemination of security warnings with mitigation recommendations to the general public. 12