[Cyber Control Tower] ② How do the US, UK, and Japan respond to hacking?

As discussions on reforming the government-wide cyber response system have begun in earnest following a series of large-scale hacking incidents, the cybersecurity command and coordination methods of major countries such as the United States, the United Kingdom, and Japan are attracting attention.

While the United States and the United Kingdom are strengthening cyber threat information sharing and joint response, each agency is responsible for damage recovery, investigation, technical support, and regulation and supervision. Japan is promoting measures to prevent the spread of damage early by strengthening the policy coordination system centered on the Prime Minister and sharing undisclosed vulnerability information obtained by private companies with the government.

Domestic experts emphasize that rather than creating a new organization, it is important to connect the expertise of existing agencies such as the National Intelligence Service, the Ministry of Science and ICT, and the Personal Information Protection Commission and secure a practical coordination function that will lead to rapid information sharing and joint response.

A plan was also proposed in which the National Intelligence Service would take the lead in consultation and coordination between related agencies on the premise of political neutrality. However, it is pointed out that it is necessary to avoid 'rooftops' where authority overlaps with existing organizations and establish a response system that includes institutionalization of vulnerability information sharing, public-private cooperation, and international cooperation.

◇ The United States divides recovery and investigation duties, and the UK divides technical support and regulations… Joint response by institution

In the United States, the Cybersecurity and Infrastructure Security Agency (CISA) under the Department of Homeland Security is responsible for protecting damaged systems, supporting recovery, analyzing risks of major infrastructure, and sharing threat information.

The Federal Bureau of Investigation (FBI) is in charge of responding to threats, including criminal investigation, evidence collection, and identification of attackers.

It is a structure that divides the work of normalizing the damaged system and the work of tracking the attacker, while sharing the information obtained during the response process.

The United States operates the Joint Cyber ​​Defense Council (JCDC), centered around CISA, and is promoting cyber threat information sharing and joint response among government agencies, private companies, and friendly country partners.

In the UK, the National Cyber ​​Security Center (NCSC) under the GCHQ provides threat analysis and technical support.

NCSC helps affected companies consult with relevant government agencies and connects them with specialized organizations necessary to respond to incidents. However, it is not a regulatory body, and supervision of personal information infringements is handled by the Information Commissioner's Office (ICO).

The reporting process also distinguishes between technical support and regulatory functions.

NCSC operates a reporting window where you can request technical support or provide threat information, but informs you that reporting here does not fulfill reporting obligations under other laws or regulations.

In principle, personal information infringements subject to statutory reporting must be reported separately to the ICO within 72 hours of recognition.

◇ Japan strengthens cyber response centered on the Prime Minister... Promoting preemptive defense by sharing undisclosed vulnerabilities

Japan is strengthening the cybersecurity policy coordination function centered on the prime minister.

A representative example is the reorganization of the existing National Cyber ​​Security Center (NISC) in July last year and the launch of the National Cyber ​​Command Office (NCO).

The head of the Cyber ​​Security Strategy Headquarters was also promoted from Chief Cabinet Secretary to Prime Minister, and the scope of participation was expanded to include all cabinet members.

The NCO is responsible for comprehensive coordination of cyber policies and monitoring and analysis of fraudulent activities in government information systems.

Recently, plans are being made to connect information collection to joint public-private response.

According to Japanese media reports, the cybersecurity emergency plan being prepared by the Japanese government includes establishing a system to secure undisclosed vulnerability information from U.S. Big Tech and others at an early stage.

The plan is to secure response time by identifying the impact on government agencies and major infrastructure such as power and communications before vulnerabilities are disclosed.

The NCO is responsible for gathering information.

The goal is to analyze not only the damage to a specific company but also the possibility of it spreading to other companies and respond through public-private cooperation.

Measures to have security companies and cloud companies participate in public-private councils related to active cyber defense were also included in the plan.

The goal is to prevent the spread of damage by connecting a security company with information on the attack site and a cloud company that operates several customer systems to the response system.

◇ “Review of consultation and coordination centered on the National Intelligence Service… Political neutrality and prevention of rooftops are premised”

In Korea, it is suggested that a government-wide coordination system is needed to connect the functions of relevant agencies when a large-scale cyber incident occurs.

This means that related organizations such as the National Intelligence Service, the Ministry of Science and ICT, the Personal Information Protection Commission, the Korea Internet & Security Agency (KISA), and the police must be able to share the information they have obtained and quickly coordinate the direction of response.

Wi Jeong-hyeon, dean of the College of Virtual Convergence at Chung-Ang University, suggested, "There is a need to consider establishing an organization where the National Intelligence Service, which has the ability to collect and investigate foreign information on the premise of political neutrality, will take the lead in consultation and coordination between related agencies."

The purpose is to link public and private responses while utilizing the National Intelligence Service's ability to identify cyber threats originating from foreign countries.

However, Dean Wee pointed out that the new organization should not become a 'rooftop' that overlaps work with existing organizations or complicates the command system.

The suggestion is that rather than just adding more organizations, the design should be designed so that practical consultation and coordination can take place while utilizing the role of existing organizations.

There are also opinions calling for institutionalizing the sharing of vulnerability information and preventive measures.

Choi Kyeong-jin, president of the Korea Information Law Society (Professor of Law at Gachon University), suggested that it is urgent to establish a national-level defense system such as AI Cyber ​​Shield Dome in the public sector, and to institutionalize rapid vulnerability sharing and response while providing incentives for vulnerability discovery in the private sector.

In addition to cooperation between governments and companies, sharing threat information across borders is also considered a major task.

Stanford University professor Anne Neuberger, who served as deputy national security adviser for cyber and new technologies at the White House National Security Council (NSC), emphasized at a domestic seminar in May last year that strengthening defense capabilities and international cooperation through public-private cooperation is necessary to respond to attacks that cause widespread information leaks and social chaos.

The spread of attacks using AI is increasing the need for such joint response.

In its annual report released this month, the UK's NCSC warned that the risk of cyber attacks targeting key infrastructure such as energy, transportation, defense, health, and finance is increasing due to AI developments.