Portugal at Forefront of Global Cyber Initiatives

Cyberspace is often described as the fifth domain of military operations, as equally critical to national and international defense as the domains of land, sea, air and space. The success of military missions increasingly depends on the availability of cyberspace and freedom of action in it. Robust and resilient cyber defense capabilities are now required to support military structures, missions and operations. Although many nations have recently made great progress in developing their cyber defense capabilities, a consensus is growing that there is much room for improvement.

Because of severe budget constraints and scarce resources, leaders see NATO’s Smart Defence and the European Union’s (EU’s) Pooling and Sharing efforts as pragmatic and coherent ways to generate the cyber defense capabilities NATO member nations and EU member states need to face future challenges. The joint NATO-EU declaration signed July 8 last year in Warsaw, Poland, gave a new impetus and substance to NATO-EU cooperation, highlighting the need to adopt a multidimensional framework and a synergetic approach to reinforce the complementary nature of NATO-EU cyber defense and security efforts. Additionally, the declaration strengthened NATO-EU political will to enhance further cooperation on cyber defense. Regular staff-level consultations and NATO-EU collaboration are considered vitally important to avoid unnecessary duplication and to ensure cogent and complementary efforts.

In cyber defense, three Smart Defence projects are in development: the Dutch-led Multinational Cyber Defence Capability Development (MNCD2) project; the Belgian-led Malware Information Sharing Platform (MISP) project; and the Portuguese-led Multinational Cyber Defence Education and Training (MNCDE&T) project.

As this work moves forward, cyber remains a dual-use sector that offers many opportunities to develop synergies covering several aspects of cyber defense and security, from competence profiles to research and development. Over the past few decades, a large volume of information and communications technology (ICT) products and services originating from the civilian market were incorporated into the defense sector following a commercial off-the-shelf approach that substantially reduced acquisition costs.

Today, Portugal is at the forefront of the cybersecurity cooperation framework, leading different initiatives alongside NATO and the EU, namely to improve cyber defense education, training and exercises. Several current and future national challenges should be looked at within the scope of a broader international cooperative framework. For example, in cyber defense education, training and exercises, Portugal will soon host the NATO Communications and Information (NCI) Academy and a NATO cyber training center that will provide certified courses to NATO, allies and partner nations.

By leading a multinational project such as MNCDE&T, which is developing a structured analytical process to define cyber defense training needs and a cyber curriculum, Portugal acts as an enabler of the future NCI Academy. Initial operational capability is expected in 2018-19.

Portugal and France, as lead member states of the EU Military Training Group Cyber Defence Discipline, are conducting a parallel project to the MNCDE&T project, following a similar program of work and vision for cyber defense education, training and exercises. Strengthening cooperation between the MNCDE&T Smart Defence project and the EU Military Training Group Cyber Defence Discipline will contribute to exploring synergies and enhancing coordination of cyber education and training.

Portugal also will assume responsibility for managing the future EU centralized Cyber Defence Training and Exercises Platform (CDTEXP). This platform is expected to be able to support three different domains—EU, national and multinational—and will take a central role in developing future cyber education and training initiatives.

Based on the development of an international cyber defense and cybersecurity master’s program, the MNCDE&T project has created a Multinational Cyber Academy Group. To better support the launch of the international pilot courses and to enhance cooperation between the main national stakeholders, academia and industry, Portugal has established a cyber hub for academia and innovation.

Developing synergies and adopting an international cooperative approach at all levels of cyber education, training and exercises are key to advancing such a knowledge-intensive capability. As a result, Portugal is implementing its strategic approach and performing a central role as a “web of knowledge.” It will act as a coordination point for future cyber defense education and training initiatives at NATO, EU and national levels.

Together with its partners and allies, and as a node in a broad network of centers of excellence, Portugal stands ready to contribute and support ongoing cooperative NATO-EU efforts to bring security and resilience to the digital community.

At last July’s NATO summit in Warsaw, allies formally committed to strengthening their own cyber defenses and recognized cyberspace as a new operational domain. In the Cyber Defence Pledge, also signed in Warsaw, allied heads of state and government pledged to ensure that the alliance keeps pace with the fast-evolving cyberthreat landscape and that its nations will be capable of defending themselves in cyberspace in line with the other domains. The pledge included a specific reference to the central role of education, training and exercises.

At the same time, interest was growing in rationalizing NATO’s cyber defense education, training and exercises. In this context, detailed training requirements analyses, conducted by specialized groups, could expose potential areas for cooperative cyber defense education and training initiatives and synergies with civilian cybersecurity training.

On the other hand, the EU might implement the EU Cyber Defence Education, Training and Exercises Centre/Platform to improve EU and NATO member states’ cyber defense capabilities to successfully carry out the Common Security and Defence Policy (CSDP) and, in particular, launch EU-led operations and missions.

Supported by the EU Military Staff and building on a European Defense Agency (EDA) training needs analysis, the cyber defense discipline aims to identify the military training requirements for the CSDP.

Although developing a common cyber defense curriculum for the CSDP remains a major EU objective, at this stage the EU’s diplomatic service lacks the resources to do so. This highlights the need to better streamline cyber defense education, training and exercises organized by member states.

Streamlining is also part of the reason for building the NCI Academy in Portugal. Following NATO’s reform program adopted at the 2010 Lisbon summit, a decision was made to relocate the NATO Communications and Information Systems School (NCISS) from Latina, Italy, to Oeiras, near Lisbon. NCISS will give birth to the NCI Academy, which will perform a crucial and central role to NATO’s cyber defense capability development process, namely by providing NATO structures and allied nations’ communications and information systems and cyber defense education and training. By assuming host nation responsibilities for this NATO school, Portugal is deeply engaged in supporting ongoing cyber defense efforts.

As a clear sign of national commitment, Portugal assumed a leading role in two Smart Defence projects: the CIS E-Learning Training Centres Network in 2011, which has been completed, and the MNCDE&T in 2014. More recently, in April 2015, Portugal embraced the co-lead role with France of the EU Cyber Defence Discipline group.

Taking into account NATO and national capability targets, the main objective of MNCDE&T is to help participating nations identify education and training needs and fill gaps created by their cyber defense capability development processes. Project goals are to create a web-based cyber defense education and training coordination platform as well as new initiatives to fill NATO and national shortfalls in this area. The MNCDE&T project also intends to develop a cyber defense curriculum that will be a valuable supporting tool for the future NCI Academy.

The project is now being implemented by 21 participating nations, including four partner nations. Project leaders also have been working with other relevant stakeholders, such as NATO’s Allied Command Transformation (ACT), the NCI Agency, the NCISS in Italy, the C3 Staff and the Cooperative Cyber Defence Centre of Excellence in Estonia as well as some other nations that may join in the near future. Additionally, the MNCDE&T project is engaging with the EU at the staff level, chiefly with the EU Military Training Group Cyber Defence Discipline, the European Security and Defence College, the EDA, the European Union Military Staff and with industry and academia through the NATO Industrial Advisory Group (NIAG) and the NATO Industry Cyber Partnership (NICP).

Fostering multinational cooperation and enhancing the necessary integration of national efforts, the MNCDE&T project adopted a strategic vision. Its pragmatic approach allowed the establishment of several coordination points between four parallel and synergetic axes—NATO, national, EU and EDA. It helped streamline present and future efforts toward three important milestones: adoption of a similar program of work in April 2015; acceptance of a common vision for cyber defense education and training in December of that year; and a proposal of a first draft of a common NATO, EU and national cyber curriculum last year.

This cyber curriculum will help streamline cyber defense education and training initiatives in a modular and flexible way. It incorporates an inherently coherent and integrated perspective not only for future cyber defense education and training initiatives but also for delivery to different target audiences. Within the cyber curriculum framework and to fill gaps identified by the ACT’s cyber defense training requirements analysis and the EDA’s training needs analysis, the MNCDE&T project proposes six new cyber defense education and training initiatives that target academia, industry and other Smart Defence project participants. Proposed initiatives include the Cyber Defence Awareness Course (Cyber User); Cyber Defence Staff Officers’ Course (Cyber Staff); Cyber Intelligence Course–Intel Analysts (Cyber Intel); Cyber Defence Capability Development Course (Cyber Capability Planners); Cyber Security and Cyber Defence International Master (Cyber Warrior); and Cyber Security and Cyber Defence Law Master (Cyber Lawyer).

Several representatives from academia and industry participated in developing the cyber curriculum and demonstrated their interest in actively engaging in the two master’s programs. The first international pilot programs are expected to begin this year or next.

The development of a course certification process and the definition of a cyber defense career path to build a skillful cyber force also are being considered as future options.

Gen. Artur Pina Monteiro, POA, is Portugal’s chief of defense.