N AT I O N A L C Y B E R S E C U R I T Y ST R AT E GY I V II.6 RISK ASSESSMENT AND MANAGEMENT made available to the sectors for inclusion in their risk analyses. • Since the first national cybersecurity strategy, the government has actively promoted a risk management culture based on risk analysis and the application of security measures adapted to the level of risk involved. The scope of this approach will be extended to all sectors and the risk analysis tools made available will be adapted to the specific needs of the sectors. • The identification and exchange of relevant risk scenarios and metrics is a collective activity that will be coordinated at State level and documented in the Risk Scenario Sharing Platform (MOSP). This will be accessible as a public service, which in the medium term will substantially contribute to increasing the quality of governance (informed governance) and resilience, and thus the attractiveness of Luxembourg. • Aggregating risk assessments at the sector and national level will help to identify systemic risks within sectors and at national level and to define scenarios for assessing such systemic risks. These scenarios will be II.7 CRITICAL INFRASTRUCTURE PROTECTION • The National Filtering Centre for Distributed Denial of Service Attacks (DDOS) will be responsible for systematically monitoring national and global DDOS developments and trends and developing recommendations and best practices for critical infrastructure in the prevention, detection and response to DDOS attacks. systematic dissemination of information on exploitable threats, attacks and intrusion attempts, and of building up shared situational awareness using metrics — it is envisaged to deploy a national network of probes installed at voluntary critical infrastructures in partnership with private sector actors. • A security operations centre for critical infrastructure will be set up. • GOVCERT will continue to strengthen its capacities, skills and pen testing team. The service currently offered to State administrations and services will be extended to critical infrastructures. • For the purpose of protecting against known and emerging threats — of the 13