Cyber

The Government Plan for Cyber and Digital Crisis Management establishes the overarching framework for the Luxembourg State's preparedness, coordination and response to cyber or digital events that could harm the vital interests or essential needs of all or part of the country or its population. This includes situations such as major technical failure or large-scale attacks against public and/or private sector information and communication technology systems.

The Government Plan for Cyber and Digital Crisis Management aims to:

• to strengthen preparedness, prevention and protection against cyber and digital risks;
• to define the governance principles and crisis management bodies necessary for effective national coordination;
• ٓto establish general procedures for responding to and managing crisis situations, as well as the respective roles of the actors involved;
• to establish the framework for disseminating alerts from the authorities and information to the public.

A cyber or digital emergency refers to an event, resulting from an incident or a cyber threat, which is likely to cause a major malfunction or the unavailability of communication and information processing systems, and which undermines or is likely to undermine the vital interests or essential needs of all or part of the country or the population of the Grand Duchy of Luxembourg.

Cybersecurity refers to the measures required to protect networks and information systems, the users of these systems and other individuals exposed to cyber threats.

The overall objectives in the field of cybersecurity are as follows:

• availability;
• integrity, which can include authenticity and non-repudiation ;
• confidentiality.

The execution of the plan developed under the leadership of the High Commission for National Protection (Haut-commissariat à la protection nationale, HCPN) falls under the remit of the Prime Minister,.

All the ministries, agencies and departments of the State are required to cooperate with the implementation of the Government Plan for Cyber and Digital Crisis Management using all the means available to them.

The Cyber plan sets the following management bodies in a cyber emergency:

• the Crisis Cell (Cellule de crise, CC) ;
• the Operational CYBER Cell (Cellule opérationnelle Cyber, PCO-C);
• the Cyber Risk Evaluation Cell (Cellule d’évaluation du risque cyber, CERC);
• the Communicationand Information Cell (Cellule communication et information, CCI).

The Crisis Cell (Cellule de crise, CC) is activated by the Prime Minister in the event that a crisis is imminent or has occurred. It initiates, coordinates and monitors the execution of all the measures intended to deal with the crisis and its effects in order to return the situation to normal. It prepares the necessary strategic decisions and submits them to the government for approval. In the event that operational intervention is required on the ground, the CC's mission extends to coordinating and monitoring its execution.

The Operational Cyber Cell acts as the Cyber Risk Assessment Cell (CERC) for the duration of the crisis, whilst ensuring the coordination and operational implementation of the measures adopted and acting as the link between the strategic and technical levels.

The Crisis Cell (CC) may delegate to an operational cell, in particular, the execution, implementation and monitoring of the measures and activities ordered

The Cyber Risk Evaluation Cell (Cellule d’Évaluation du Risque Cyber, CERC) is responsible for analysing, assessing and monitoring cybersecurity incidents and cyber threats. It provides enhanced monitoring, assesses the severity and potential impact of events and, if required, formulates recommendations and defines next steps, such as escalating to "Crisis" mode.

The Communication and Information Cell (Cellule communication/information, CCI) is in charge of communication and providing information for the media and citizens. The horizontal coordination of organising external communication falls to the Office for crisis communication (Service de la communication de crise).

Providing information to the public is a core component of crisis management. The Government provides regular, coordinated updates regarding the evolution of the situation, its potential impacts and actions to be taken by citizens.

Official information is distributed via the Government’s institutional channels, including the www.infocrise.lu portal. Depending on the nature, severity and urgency of the situation, the Government may use the national warning and information system LU-Alert, to ensure the rapid and targeted dissemination of critical information to the public. 

In addition, any other communication channel deemed appropriate may be used to ensure that messages are distributed widely, quickly and reaching the broadest possible range of stakeholders.

The plan provides those charged with its execution with the tools they need to react in an appropriate and flexible manner to the events that occur and to provide the best possible protection for the citizens or sectors affected, their vital interests and the nation's economic interests.

The Cyber plan sets out seven measures:

• Assessment;
• Enhanced monitoring;
• System upgrade and protection;
• Service restoration.

Assessment is the first step in the crisis management cycle. It aims to assess the urgency of the event, its scale and its actual or potential impact on the vital interests or essential needs of all or part of the country or its population.

Enhanced monitoring encompasses the actions taken when a situation presents an increased risk. These actions include analyzing available information and continuously assessing situational developments.

This measure aims to limit the risk of technical vulnerabilities being exploited and may result to the implementation of appropriate protection or mitigation measures, following the recommendation of the PCO-C and decision of the CC.

Service restoration allows for the gradual resumption of affected activities, in line with defined priorities, until a normal and stable situation is restored.

The High Commission for National Protection, in its role as ANSSI, contributes to the State's information security policy, assists administrations in its implementation and issues recommendations related to information security. It defines a risk management approach together with the administrations, advises on information security training programs, promotes information security through awareness-raising measures, advises public institutions and critical infrastructures, and ensures the compliance of classified networks and information systems as a TEMPEST authority.

GOVCERT.LU is the central contact point for all types of IT incidents that could compromise the information systems of the government and other public or private infrastructure operators that are considered critical.

Launched on 8 June 2015, the national platform for the promotion of cybersecurity SECURITYMADEIN.LU is an initiative from the economic interest group 'Security made in Lëtzebuerg' (SMILE) which was mandated in 2010 by the Ministry of the Economy to promote and strengthen information security in Luxembourg.

The four objectives of SECURITYMADEIN.lu are:

• to coordinate government initiatives like BEE SECURE (awareness raising for the general public) and CIRCL (post-incident coordination and action services);
• to back and make more visible the awareness raising and support actions of these different initiatives among their target audience;
• to promote the whole information security community;
• to develop a cybersecurity ecosystem which will make the stakeholders and services related to information security in Luxembourg more visible.

Launched on 8 November 2010, BEE SECURE is a common initiative from the Ministry of the Economy, the Ministry of Family Affairs, Integration and the Greater Region and the Ministry of Eduction, Children and Youth. It includes all the necessary actions for raising awareness of how to use new information communication technologies more securely.

The objective of the Safer Internet Plus programme from the European Commission is to encourage European citizens to use new information technologies securely and confidently.

In line with this policy, the main strategic priorities of the Safer Internet Plus programme, as well as those of the BEE SECURE project as part of this programme, are:

• to promote a safer use of the internet and current communication technology, in particular among young users,
• to educate users in this area, particularly children, teenagers, parents, teachers and educators,
• to combat illegal content and dangerous online behaviour.

The Computer Incident Response Center Luxembourg (CIRCL) is an government initiative for the private sector, municipalities and non-government entities which aims to provide a systematic response centre for threats and incidents that affect computer security.

The objective of CIRCL is to provide optimal protection for information and communication systems, guaranteeing an alert and warning system for users in Luxembourg.

International cooperation is guaranteed and international assistance is possible for any cyber crisis that could become international in dimension, both from CERTs and international organisations of which the Grand Duchy of Luxembourg is part (European Union, Benelux, NATO, UN, OSCE).Toute crise cyber étant susceptible d’avoir une dimension internationale, une collaboration internationale est garantie et une assistance internationale est possible tant au niveau des CERTs que dans le cadre des organisations internationales dont le Grand-Duché de Luxembourg fait partie (Union européenne, Benelux, OTAN, ONU, OSCE).