The initiative is provided for in the Three-Year Plan for IT in the Public Administration 2020-2022 and aims to raise awareness of cyber risks in the public sector. The digital services delivered by the Public Administration are crucial to the functioning of the country as a whole.
Public Administration cybersecurity in the PNRR: what will happen?
The cyber threat is constantly growing in both quantity and quality, and it is also driven by the evolution of social engineering techniques aimed at deceiving the end users of public digital services.
In order to plan and calibrate the appropriate actions to support and sustain preventive security, a baseline is needed to measure the average level of knowledge and awareness of the subject.
At the same time, again as established by the Plan, Agid, in collaboration with the Department for Digital Transformation, has released recommendations on security protocols and, in particular, on the Transport Layer Security (TLS) protocol and Cipher Suites.
Transport Layer Security (TLS) and its predecessor Secure Sockets Layer (SSL) are cryptographic presentation protocols used in telecommunications and computing that enable secure communication from the source to the recipient (end-to-end) over TCP/IP networks (such as the Internet), providing authentication, data integrity and confidentiality by operating above the transport layer.
Several versions of the protocol are widely used in applications such as browsers, e-mail, instant messaging and voice over IP. One example of an SSL/TLS application is the HTTPS protocol.
A Cipher Suite, on the other hand, is a set of algorithms used to secure network connections based on Transport Layer Security (TLS) or its predecessor Secure Socket Layer (SSL).
The set of algorithms that makes up a suite typically includes: an algorithm for exchanging cryptographic keys, an encryption algorithm and a message authentication code (MAC) algorithm.
What happened in 2021?
The PNRR, the National Recovery and Resilience Plan, has been approved. According to Draghi, Next Generation EU will mean an economic recovery for Italy, which has been stuck on this front for decades.
Let’s look at what is planned in the cyber field.
The Dpcm implementing the national cyber security perimeter, relating to Article 1, paragraph 3, “measures aimed at ensuring high levels of security of networks, information systems and IT services”.
It contains the instructions for promptly notifying incidents to the CSIRT of the Presidency of the Council of Ministers.
Promptness is measured in hours, which will make its application by public and private operators interesting, as they will necessarily have to identify swift procedures for assessing the possible impacts of an incident, even in the absence of specific assessments of the nature and possible developments of the incident itself.
Identifying intervention priorities
To fully apply the contextualisation methodology of the National Framework, the companies that must apply the minimum measures will also need to identify their intervention priorities.
In any case, a contextualisation of the Framework has been carried out for the entities within the Perimeter, the same for all of them.
A mapping is also provided between the security areas set out in the Perimeter (organisational structure, security policies and risk management, physical and logical data protection, and so on) and the subcategories of the Framework.
What is the National Recovery and Resilience Plan
The “National Recovery and Resilience Plan” (PNRR) sets out the programme of investments and measures with which Italy intends to respond to the economic and social crisis caused by the Covid-19 pandemic.
The document identifies three strategic pillars: digitalisation and innovation, ecological transition and social inclusion.
The PNRR cites the DESI, according to which Italy ranks 17th among EU countries in terms of connectivity. The coverage rate of Italian households with ultra-fast networks is 24%, compared with an average of 60% across the 28 European countries.
The PNRR sets out the allocation of investments with an approach that should be strategic and operational, against which the tactical details of possible implementation will then need to be examined.
The strategic vision, however, still seems to be built bottom-up, on the basis of individual specific requests rather than on a global, innovative and informed view.
The PNRR attempts to seize the opportunity offered by the European Commission to turn the costs of the relaunch into investments for the future.
The primary objective to pursue in the recovery phase is to strengthen the economic and social infrastructure and to invest in a profound digital, social and sustainable transformation of the country.
With the increase in digitalisation, in both the private and public spheres, it is in fact necessary to significantly strengthen the capacity for prevention, monitoring and defence of citizens, private companies and the Public Administration against cyber attacks and incidents.
This pandemic period has generated a social and cultural regression and, on the other hand, has driven digitalisation by promoting online activities and smart working.
The PNRR seems to gloss over the aspects of this “new digitalisation”, which instead constitutes a best practice of resilience that allows companies to keep working, at least in intangible services, and which is based, in the new discipline of managing prolonged crises that emerged after the pandemic, on the immediacy of the switch to “full digital” (including from home and from private and residential connections) and on the continuity of use of private and residential connections.
This is true for both public and private companies. Yet the cyber security section contains no in-depth analysis of these issues.
The PNRR should instead be a tool for pushing forward, including in the organisational forms that support security, and for helping the country grow in secure technology and in security technology.
It could be the ideal place, for example, to allocate funds for training, for information and for launching small and medium-sized enterprises that develop secure technologies.
It could be the ideal place to fund standardisation projects that keep our country among the leading players in global security.
It could be the place to relaunch an Italy where “business is secure”, so as to attract investment and innovation from abroad as well.
How will Italy seize the opportunity?
Italy will be the first in Europe to benefit from the two instruments of Next Generation EU: the Recovery and Resilience Facility, RRF, which will guarantee resources of 191.5 billion euros for the five-year period 2021-2026, 68.9 billion of which as non-repayable grants, and the Recovery Assistance for Cohesion and the Territories of Europe package, REACT-EU.
As Draghi himself stated, Italy will draw on this funding through RRF loans, estimated at 122.6 billion.
What does the PNRR provide for in terms of cybersecurity?
The PNRR just approved therefore provides first and foremost for a digitalisation programme for the Public Administration based on effectiveness, speed and security for citizens and businesses in the use of services such as infrastructure, interoperability, platforms and services, and cybersecurity.
In addition, it will include “preparatory measures for the full implementation of the key reforms of the Central Administrations, such as the development and acquisition of (new) skills for Public Administration staff (also by improving upskilling and skills updating processes) and a significant simplification/reduction of red tape in key procedures, including a dedicated effort by the Ministry of Justice to clear the backlog of cases”.
You might also be interested in this article:⬇️
