Letter - EIA to Assistant Minister for EDTSC re Cyber Defence - 10 February 2023

States Greffe

Deputy Alex Curtis

Assistant Minister for Economic Development, Tourism, Sport and Culture

BY EMAIL

10th February 2023

Dear Assistant Minister, Briefing on Cyber Defence

The Panel received a briefing from officers within Economic Development, Tourism, Sport and Culture on 31st January 2023 relating to the ongoing work being undertaken on cyber defence by the Cyber Emergency Response Team (CERT.je).

Following the briefing, it was agreed that the Panel would write with any further questions. We would be grateful if you could provide responses to the following:

• Can you confirm the various platforms used in which CERT.je receives data?

• How secure are these platforms and what assurance do you have that they are reliable?

• What engagement, if any, has been undertaken with other sectors (finance, retail, tourism etc)?

• Is CERT.je limited to Emergency Response? On its website, CERT.je is advertised as "The Cyber Security Centre for Jersey" but their title suggests they are an Computer Emergency Response Team'. Can you confirm which is correct?

• What is CERT.je doing with the information it seeks to collect?

• What is CERT.je's interaction with JT and other broadband providers?

• Can you provide the Panel with a concise, Kings English Problem Statement of less than 200 words of the problem CERT is intended to solve?

• If such a problem statement exists, has this been reviewed by others who know this subject and how can you be certain that the problem statement makes the most sense in the circumstance?

• Can you give an overview of what exactly CERT.je is protecting and the size of the problem?

• What is CERT.je's Definition of Winning" and how is success of CERT.je measured?

• What  has  CERT.je  done  since  June  2021  and  how  have  they  measured  it  (including emergencies resolved and help with special email systems and improvements for Jersey Businesses)?

• Can you provide examples of proactive action that has been taken by CERT.je to prevent a serious breach or attack in Jersey? Could private sector services have been used instead?

• To what extent might CERT.je be regarded as competing with local business providers or overlapping  with  States  of  Jersey  police  activities  in  educating  local  organisations  on cybersecurity?

• Does CERT.je have SMART objectives? If so, can you list them?

• Has CERT.je ensured that all customer data on databases of all Jersey businesses are strongly encrypted?

• What action is CERT.je taking to drive and measure change including promotion of the "Zero

Trust" concept?

• What "email specific security" measures are provided by CERT.je?

• What training plans have CERT.je put in place to ensure that security systems are operated by fully trained staff in organisations?

• How many people have CERT.je trained to be secure?

• Could you please provide us with any training materials used by CERT?

• Can you confirm if use of all USB data drives are disabled in Jersey companies and if and how CERT.je are ensuring all Jersey organisations adopt this basic security measure is adopted including users of government systems?

• Can you describe CERT.je's zero-day prevention techniques?

• How much does CERT.je cost to run?

• How much value does it generate and/or has contributed to the Island? To what extent might it charge users for its services in the future?

• How is return on taxpayer investment and performance measured by the Department?

• Please provide a copy of any Memorandum of Understanding between the Department and CERT.je.

• What risk/cost analysis has been done for the implementation of CERT.je?

• What is the current capability of the sector CERT.je is protecting and are mature defences in

place?

• In the event of a cyber event, what can CERT.je do to add to the solution/mitigation and how much will CERT.je be able to reduce impact?

• Recent questions around Jersey's resilience and crisis management have suggested that the Island has the capability to withstand crisis events. Can you confirm where CERT.je fits into this resistance?

• Can you confirm how many attacks against Jersey are experienced in any given period (say one week) and how CERT.je assists in reducing these?

• Can you confirm if it is possible for the larger number of incidents to be taken out by the filtering of web addresses and if so, how does that affect the answers above?

• What industry consultation is being undertaken regarding the proposed law relating to CERT.je, what are anticipated to be its statutory powers, what industry consultation is being undertaken regarding the content of the law and will responses to the public consultation be

made public prior to the law being finalised?

We would be grateful if you could respond to this no later than midday on Friday 24th February 2023.

If you have any questions regarding this or our work in general, please do not hesitate to contact me.

Yours sincerely,

Deputy Moz Scott

Chair

Economic and International Affairs Scrutiny Panel