The measures for culture and education in the national strategy are:

• Fostering awareness to encourage a responsible cyber culture throughout society. 
• Building cyber skills into the workforce and leadership through effective education. 

These are part of the Maltese Cybersecurity Strategy Model along with policy, legislation and risk management. Specifically, they link to the following targets: 

1. Secure Cyberspace:

• Establishing regulation and voluntary self-commitment for guaranteeing cybersecurity.
• Fostering the use of interoperable and secure standards on the basis on good practices.

2. Cyber Awareness and Education: 

• Encouraging cybersecurity education and training. 
• Exploring the possibility of establishing a Cyber Centre of Excellence. 
• Ensuring relevant education and training to public sector staff and other stakeholders.
• Fostering a strategic, target-oriented national awareness and advice campaign. 

The strategy also includes capacity building as part of the cybersecurity awareness and education measures by identifying and developing skills and an educational framework, as well as the analysis of other EU and global strategies, EU legal directions, the actions defined in Digital Malta and the goals of e-Commerce Malta, where cybersecurity is seen as key enabler for the innovation of SMEs and other businesses.  ​

In January 2017, the Minister for Competitiveness and Digital, Maritime and Services Economy launched Malta’s first National Cyber Security Strategy with MITA launched a two year National Cyber Awareness Campaign as one of the Strategy’s initial priority areas. The campaign targets society, businesses and the public sector. 

The Campaign aims to cover the online security interests of the public sector, the citizen, as well as the private sector, giving also particular attention to the SMEs which, as within the EU, constitute the majority of the Maltese economy.

• AUM American University of Malta – M.Sc in Cybersecurity. European Credit Transfer System (ECTS): 96. Focus: System security, network security, component security, SW security. 

The strategy defines measures for the education and training for the public sector staff and stakeholders as a key priority given the sector's extensive use of IT and sensitive data. The target is to combine technology controls with human resources, awareness and employee guidance programmes. It also includes having a comprehensive list of people sector professionals certified under internationally recognised certification programmes. Training outcomes  including being able to recognise cyber incidents, detecting anomalies in IT systems, responding to threats and reporting them to competent authorities.

• Foster the application of research and development on cybersecurity.

The aim of this measure is to ensure that cybersecurity becomes a research priority by encouraging and supporting research in national and European projects and initiatives with the participation of government, the private sector and academia. 

The CYBERWISER.eu CyPR is all about boosting opportunities in the cybersecurity marketplace. 

This European Cybersecurity Professional Register is the place where professionals, juniors or seniors, age can promote their specific skill sets and experiences in cybersecurity, courses taken and qualifications.

Organisations of any size or sector from SMEs to large companies and public institutions can find and contact the right skills and experiences they need to improve their IT security posture.

The information contained here is based on desk research carried out by CYBERWISER.eu, including the ENISA interactive maps on national strategies and educational courses. 

Computer Security Incident Response Teams  (CSIRTs) tend to be of technical and operational nature. Thus it is important to ensure consolidation of a top level National CSIRT. Close communication and coordination of the CSIRT is also required on:

• Real-time information sharing and response to calls.
• Longer term planning.
• Communication and coordination with other CSIRTs in Malta as required.
• Possible further alignment with EU legal requirements and consolidation.

Steps taken at the business and societal levels: Malta has established:

e-Commerce Malta highlights 3 pillars: 1) generating trust in e-commerce; 2) transforming micro-businesses; 3) taking SMEs and industry to new levels of cyber security, such as through the audit-kit and a Specialist advisory service (Measure 2) and the European Trust Mark (Measure 9).

Digital Malta: is the Forum for transforming industries through ICT that aims to raise awareness about the benefits of adopting technology and enabling self-regulation.

CSIRTMalta

• Team Email: csirtmalta@gov.mt
• Telephone: +356 2122 1334 +356 2704 1506
• Public PGP Key

The Strategy highlights the importance of cyber risk management under measure iv - ensure the conduct of a national cyber risk assessment exercise. The purpose is to identify major national cyber threats and risks, assess respective impacts and suggest risk mitigation and management strategies accordingly. This exercise should be undertaken on a regular basis as the threat landscape evolves and new technologies become available. Such an exercise should include regular testing and validation exercises.

Measure v stresses the importance of cyber risk assessments also on an individual basis "Ensure necessary measures in line with individual cyber risk assessments by key public and private sector organisations falling within the scope of related EU legal requirements" (i.e. processing of personal data in relation to products and services dealing with EU citizens or in relation to the Directive on Network and Information Security. The strategy explictly encourages cyber risk assessments as relevant within the public and private sector in that the legislation demands a risk-based approach to the development of appropriate controls. 

Moreover, the Strategy underscores the importance of cyber risk assessment in general to all organisations operating in cyberspace. It includes references on the need to assess financial risks with regard to cyber-related incidents and the potential need for cyber insurance. However, it points out that cyber insurance coverage must not replace risk management and the use of necessary security controls.

Evaluations and periodical reviews are an integrated part of the National Cyber Security Strategy. Cyber risk management practices also include monitoring and evaluations.

English

The information contained here is the result of desk research carried out by CYBERWISER.eu.