Romania adopted its national cyber security strategy in 2013, setting out the objectives and principles for understanding, preventing and counteracting cybersecurity threats, vulnerabilities and risks.
Obj. 1 - Adapt the regulatory and institutional framework to the threat dynamics of cyberspace.
Obj. 2 - Esablish and implement security profiles and minimum requirements for national cyber infrastructures, including the proper functioning of critical infrastructures. The strategy highlights banking, transport, energy and national defence, but also increased risks to citizens, businesses and the government, as cyber infrastructures face technical threats/failures, human threats and natural threats.
Obj. 3 - Ensure the resilience of cyber infrastructure.
Obj. 4 - Ensure security through understanding, prevention and combatting vulnerabilities, risks and risks to cyber security in Romania.
Obj. 5 - Promote national interests, values and objectives in cyberspace.
Obj. 6 - Promote and develop co-operation between the public and private sectors at national and international level in the field of cyber security.
Obj. 7 - Develop a security culture by raising awareness about vulnerabilities, risks and threats in cyberspace and the need to protect information systems.
Obj. 8 - Play an active participation in initiatives by international organisations to which Romania belongs, defining and establishing international confidence-building measures concerning activities in cyberspace.
NATIONAL CYBER SECURITY STRATEGY - NIS Capacities
|Year of adoption||2013|
|Updates and revisions||
Specific legislation and regulation related to cybersecurity has been enacted through the following instruments:
The strategy includes a programme to build capacities in different areas, such public-private co-operation on cyber security, including efficient early warning, alert and response mechanisms for cyber incidents, as well as encouraging research, development and innovation capabilities, increasing the resilience of cyber infrastructures and developing CERT-type entities in both the public and private sector.
CERT-RO (Romanian) is the Romanian Computer Emergency Response Team (CERT) established as a government institution. Its focus is on research, development and experise in cyber security. Its constituents are users, systems and networks from Romanian cyberspace.
Its main tasks include preventing, analysing, identifying and responding to cyber incidents. It is also responsible for elaborating and distributing public politics for prevention and counteracting incidents occurring within national cyber infrastructures.
In November 2016, CERT-RO was ranked 2nd in the European Cyber Security Challenge. The team was selected in May 2016 by CERT-RO in partnership with the Romanian Intelligence Service (SRI) and National Agency for Computer System Security (ANSSI), alongside the main sponsors (Bitdefender, Orange Romania and Q-East Software). Exercises in June focused on web application security, cyber attack and defence, cryptography, analysis of network traffic, and reverse engineering. Additional training sessions were provided by sponsors.
CERT-MIL (English) is the Romanian entity of the Ministry of Defence charged with providing cyber defence for its members. It focuses on cyber risks, specialised assistance, forensics, and the management of cyber incidents.
National Cyberint Center (English) is the cyber intelligence centre of the Romanian Intelligence Service (SRI). Its main focus is on counter-espionage, ecnomic security, transnational threats and the protection of classified information.
CORIS-STS (English) is the Romanian CERT designed to prevent and respond to incidents of security and communications systems of the Special Telecommunications Service and of its beneficiaries.
Romania's new cyber security law has generated controversies and deemed unconstitutional by some. The proposed law goes well beyond the European Directive on network and information security (NIS Directive). The bill would apply to all legal persons that handle personal data using IT systems, which includes newspapers, NGOs, SMEs and doctors, among others while hosting providers would have a special regime, tasked with helping "competent authorities" and logging activities of their IT systems.
Ten different public institutions would have various responsibilities in terms of ensuring cybersecurity. Romanian intelligence organisation would be given the lead role on cyber security infrastructures of national importance, but which are vaguely defined as a class of service providers to be established.
Public Private partnerships
In addition to sponsors Bitdefender and Orange Romania, CERT-RO has signed a Memorandum of Understanding with ENEL on security co-operation networks and information systems, working with the ENEL Energy Cyber Emergency Readiness Team (CERT).
CERT-RO signed a Memorandum of Understanding (MoU) and Protocols with more than 20 public institutions in the cyber security field. Also, National System for Countering Cybercrime, could be considered the framework for sharing cyber security assets within the public sector.
The 2013 strategy provides for the development of national risk management and reaction capabilities for cybersecurity based on a national programme, such as consolidating the potential of understanding, preventing and countering threats at the level of competent authorities and minimising risks in cyberspace.
|Other capacity-building measures: research and education||
Romania established a Cyber Security Research Centre (CSSIR; English) in 2013 to promote, support, implement and coordinate security research in IT security in Romania, and also conduct international actions through short-, mid- and long-term partnerships on cyber security.
In May 2017, the Romanian Intelligence Service (SRI) organised its first national cyber security exercise called CyDEx17. The exercise was aimed at testing and assessing the way of managing the cyber incidents, the institutions’ response at operational level, tactically and strategically, while seeking to provide appropriate security levels across the cyber infrastructures and to optimise co-operation across institutions by identifying and limiting the impact of such incidents.
|Implementation and Monitoring||The National Action Plan on implementation of the Romania's Cybersecurity Strategy provides a national governance roadmap for cybersecurity in Romania.|
|Last WISER update||July 2017|
Compliance with the GDPR and NIS Directive: Report a cyber incident
Report a cyber incident
to national CERT/CSIRT
CERT-MIL (MoD): Specialised cyber-defence assistance to subscribed members
The ranking of Romania in the 2016 European Cyber Security Challenge demonstrates its level of preparedness in terms of it ability to respond to and resolve threats in cyberspace. However, its approach to a legal framework requires better alignment with EU guidelines and best practices, as well as better definition of IT and critical infrastructures, better clarifying the roles of providers and users of IT systems.
|Guidance and Updates||
Information on internet safety can be found in the website of the Romanian National Computer Security Incident Response Team (CERT-RO).CERT-RO provides alerts and also updates on the threat landscape, e.g.
|Languages||Romanian and English. CERT-RO website is only in Romanian.|
|Date inserted||July 2017|