In a recent
report Malta submitted to
ENISA on Network and Information Security (NIS) related matters, the government presented its NIS strategy and governance models in terms of preparedness.
Although Malta has an agency responsible for the implementation of the National Strategy for Information Technology known as the Malta Information Technology Agency (MITA), in 2010, this agency had some of its roles transferred to two new agencies:
- INFOSEC, which is responsible for information security for the government, and has the task of defining the national direction for security;
- The Critical Information Infrastructure Protection (CIIP) Unit, which will be responsible for critical infrastructure protection as well as coordinate all the stakeholders involved in critical information infrastructure issues. The aim of the CIIP Unit is to create a protection plan on a national level. It also has the task of encouraging actors from the private sector (ISPs, banks, etc.) to form their own CERT teams. From that point on, the CIIP Unit will start a forum involving those private sector CERT teams.
In addition the above, two new agencies were created:
- The National Security Agency (NSA) now responsible for security in general, physical security issues and EU information matters.
- The National Security Accreditation Authority (NSAA). This entity is now the overall security authority, under supervision of the prime minister‘s cabinet. This agency supervises the NSA and the CIIP Unit.
The report mentions yet another agency - the INFOSEC Council, created to bring all the government entities together for discussing INFOSEC and CIIP issues.
If it sounds confusing, here's a pictorial representation of these entities taken from the said report.
The report goes on to mention the various legal regulatory frameworks relevant to data protection, privacy, cybercrime and the domestic criminal code concerning eIdentity and eCommunications (p8-10). Finally, the report provides some national statistics outlining how Malta fairs in information technology matters when compared to the rest of Europe.
Interestingly, back in 2004 another
report by the Central Information Management Unit (CIMU) also defined the Cabinet Secretariat as the designated Security Accreditation Authority (SAA) that certified individuals who are security cleared by the National Security Authority. At that time MITA (formerly MITTS) was CIMU's agent for operation matters, whilst CIMU acted as the INFOSEC Authority for Malta. Amongst other things, it was responsible, for the accreditation of IT systems and networks working jointly with the National Security Authority to provide information and advice on technical threats to security and the means for protecting them.
At that time, the National Security Authority (then NSA) was the Malta Security Service. It was responsible in terms of the law for the security vetting of personnel who may have access to or handle classified information or who are involved in the technical operation maintenance of communication and information systems containing classified information. It was also charged with the setting of standards of security in the Central Registry and sub-Registries.
There are currently no websites for the NSAA, NSA, CIIP and INFOSEC so there is very little information on the mandate or structure of these entities. Nevertheless, I anticipate a lot more visibility as the regulatory role of the government with regards to information security slowly becomes more prominent.
Posted by Donald Tabone
Twitter
