Ireland (IE)

This is the first NCSS for Ireland. An external assessment was published in May 2016, which is incorporated in this analysis.

A related document is the National Risk Assessment for Ireland (2015) published by the Department of An Taoiseach (department of the office of the Prime Minister), which notes that cyber-attacks could potentially threaten Ireland’s key national infrastructure (such as energy, transport and telecoms systems). It also identifies the specific risk for the public service in respect of theft or compromising of data collected by the public service.

It remains to be seen what steps will be taken for the new national cybersecurity strategy.

The Department of Communications, Energy and Natural Resources is responsible for implementation, including the establishment of the National Cyber Security Centre. The Minister for Communications is expected to bring a memorandum to Government in early September proposing the formal establishment a National Cyber Security Centre.

Implementation is dependent on effective interDepartmental co-operation. The strategy places an emphasis on task-sharing and building trust relationships between the State, public and private partners, academia and civil society. However, at the current time there is no evidence that protocols to facilitate the flow of information have been implemented.

A key element of the 2015-2017 NCSS is the establishment of the National Cyber Security Centre (NCSC), whose primary focus is on the protection of government networks, personal and business systems, protection of critical national infrastructure but not yet established.

The objective for 2015-2017, the skillset and constituency base of the NCSC will be developed to:

• Seek formal accreditation for the Government CSIRT (g/CSIRT), critical for peer recognition.
• Seek accreditation for a formal national CSIRT (n/CSIRT) while also developing a limited capacity in the area of Industrial Control and SCADA systems, which are used to run utility sector control systems, such as apply to electricity and water networks.

The NCSC's mandate includes:

• Activities to reduce the vulnerability of critical systems and networks within the State to incidents and cyber-attacks.
• Effective response when such attacks occur.
• Responsibility for the protection of critical information infrastructure (CIIP).
• Establishing and maintaining cooperative relationships with national and international partners.

The NCSC will expand its information sharing arrangements with national and international stakeholders with timely public notification.

Legal foundations will aim to fully implement the EU NIS Directive by means of primary legislation. This legislation will give effect to national cyber security arrangements and transpose the NIS Directive. The process will involve regulatory impact analysis and legislative scrutiny by parliament (Oireachtas). The strategy does not make explicit references to specific legal foundations and therefore requires future investigations.

To date, the Criminal Justice (Offences relating to Information Systems) Bill has been introduced. The Bill will enable ratification of the Council of Europe Convention on Cybercrime and the transposition of the EU Directive 2013/40 on attacks against Information Systems.

Cork is Ireland's most prominent Cybersecurity Hub with a mix of indigenous start-ups and multi-nationals, which have chosen Ireland as their EU HQ or set up a centre there. A critical factor underpinning this growth is Cork’s strong ecosystem, which can deliver the technical talent required to support the cybersecurity sector.

Cork’s higher education institutions are also playing a key role in the development of the cybersecurity cluster, such as the Cork Institute of Technology (CIT) and the University of Cork. Security for embedded systems and the Internet of Things is a rapidly growing area of focus for us currently through CIT's NIMBUS Research Centre. Deep engagement with industry partners and advanced programmes are part of the capacity-building measures being taken. Programmes cover security management and law, digital forensics, malware analysis, applied cryptography, offensive security, and network security and forensics.

Cork’s local authorities and Ireland’s national development agencies are strategically committed to providing the supports that advanced IT organisations require to compete globally. Access to decision makers, a favourable tax environment and a willingness to engage strategically while adopting a joined-up-thinking approach all combine to make the Cork cybersecurity value proposition exceptionally strong.

Ireland has become a significant base of international technology and security companies stemming from a growing, well educated and flexible workforce with a rapidly increasing graduate output.

The NCSS is a mix of compliance with international and EU developments, alongside national initiatives with a strong focus on legislative and policy aspects. In 2017 the NCSS has embarked on a major recruitment campaign for experts who will help protect critical national infrastructure such as electricity, water, ports, airports and hospitals from potentially crippling cyber attacks.

Irish Reporting and Information Security Service IRISS-CERT, Ireland's first CERT (Computer Emergency Response Team) to provide services to all users within Ireland. It provides clients with incident reporting, alerts and warnings, sanitised attack notifications, guidelines and advice, surveys and research into information security matters in Ireland. Accredited by Trusted Introducer.

• Team Email: info@iriss.ie