![](https://csdnimg.cn/release/download_crawler_static/10329168/bg13.jpg)
By working in existing military, civilian, police, central, regional, local and other kinds
of structures, an ever-looming "brick wall" of entanglement, obstinacy, and
ineffectuality can be avoided. This is achieved, partially, by clarifying the impact of
cyber security and ensuring clarity among the active parties on framework questions –
authority, cooperation, information sharing, timeframes and resources. The urgency of
crisis management processes makes answering these issues all the more important.
Different models can be detected at the level of the countries within the Alliance.
In the Netherlands, there is a Dutch Association of Consumers and Regulators which
brings together private companies, universities, regulators and other entities, with cyber
security as one of their purposes. In quite a number of countries (Spain, Italy, Romania),
there are civil society associations of critical infrastructure experts as well as
companies which can become models or actual partners in a deepening cyber security
partnership between competent stakeholders.
The role of the intelligence community is also an important factor for national
cyber security governance. There are several models and applications. For instance,
when embedding Computer Emergency Response Teams (CERT) or CSIRT (as part of
a cyber-security center), there is a binary choice: inside the intelligence community or
outside. This institutional arrangement subsequently determines to a large extent the
information sharing relations that the center can build and maintain. If part of the
intelligence community, the CERT – i.e. in Denmark's case – can share and receive
malware signatures and threat indicators from international partners that are either
intelligence services or linked to them. Much cybersecurity information in the
government sector is (unfortunately) over-classified, and these reports can only be
shared easily with partner intelligence services. If the CERT is outside, such as the
Dutch DefCERT and National Cyber Security Centrum (NCSC), then cooperation will
be easiest with other centers that are equally situated outside the intelligence
community. In general, for both sharing communities, the larger the group, the less
information that is shared.
Another important point is the concerns on the choice between clustering cyber
capacity, or differentiating by the mission. In the Netherlands, offense, defense and
intelligence are all separate, and each has its own legal regime. In Denmark, they are all
clustered into one unit, and the legal mandate depends on the activities executed. From
a legal, accountability and ethical perspective, differentiating by mission is the
principled choice and prevents boundaries between sectors and legal regimes blurring.
However, from a practical perspective, combining cyber offense and cyber defense is a
force multiplier, as the two approaches use similar techniques and software, operating
most effectively when in close contact with each other. In the US, but also in the UK,
information assurance and offensive cyber-operations are housed under the same roof
for these reasons.
Considering the availability of cyber knowledge and capacity within Ministries of
Defense, there is continued debate on their eventual role as a last resort in cyber crises.
Even if no military role is foreseen in protecting civilian critical infrastructure, Defense
could still be perceived as – and therefore in the time of crisis designated as – the last
resort security provider. NATO and the US Cyber Command, for instance, have
developed the concept of (rapid reaction) cyber teams that can be deployed to assist
(civilian) organizations that have suffered a cyber-attack. Considering that there are
many versions of SCADA-software, and that they can be extremely complex, each
specific to a sector or industry, it is not an efficient use of resources to recreate this
expertise in Defense cyber teams. It would be more effective to organize an inventory
U. Tatar et al. / Strategic Approach to a Fierce Domain8