PROTOCOL OF GENERAL ACTIONS OF CYBER SECURITY SUBJECTS DURING RESPONSE TO CYBER INCIDENTS, AS WELL AS IN THE ELIMINATION OF THEIR CONSEQUENCES

Abstract

Cyberspace, along with other physical spaces, is recognized as one of the theaters of war. The tendency to create cyber troops is gaining momentum (Roadmap for the creation of Cyber Troops of the Armed Forces of Ukraine - Order of the General Staff of the Armed Forces of Ukraine, dated April 22, 2022 No. 48), whose tasks include not only ensuring the protection of the state’s critical information infrastructure from cyber attacks, but also conducting preventive offensive (carrying out cyber operations) in cyberspace, including the disabling of critical infrastructure facilities of the enemy by destro ying the information systems that manage such facilities. An increase in the intensity of interstate confrontation and reconnaissance and subversive activities in cyberspace is predicted. The circle of states that are trying to form their own cyber inte lligence, to master modern technologies of reconnaissance and explosive activities in cyberspace is expanding, and they are strengthening state control over national segments of the Internet. Taking into account the experience of conducting hostilities during the introduction of the legal regime of martial law and given the uncertainty of subjects and objects, their functions and tasks for actions in certain areas, including in the field of cybersecurity, in peacetime led to adversity and inconsiste ncy of these actions by the subjects of support state cybersecurity. And given that with the introduction of the legal regime of martial law, certain entities change their location, move information assets and equipment to new locations using cloud services, which greatly complicates the process of harmonization and coordination of actions to respond to cyber incidents, as well as elimination of consequences. This leads to a forced redistribution of tasks and functions for the implementation of cyber defense measures at various facilities. Under these conditions, new subjects of cyber defense are created on a permanent or temporary basis, which requires time for them to acquire the abilities to perform their intended tasks. In such a situation, Ukraine should be able to ensure its socio-economic development in the digital world, which requires the acquisition of the ability to effectively deter destructive actions in cyberspace, a sustainable response to threats in cyberspace, the achievement of cyber resilience at all levels, and the interaction of the components of the security and defense sectors to ensure cybersecurity within the cyber defense of the state. So, based on the need for a scientific justification of the institutional framework, it is necessary to clearly define: “a list of subjects for ensuring cybersecurity for the implementation of the actions established by this Protocol”, both in peacetime and under the legal regime of martial law; the above subjects, their role and place, the list and procedure for responding to cyber incidents and eliminating their consequences, both in peacetime and under the legal regime of martial law. At the same time, the scientific novelty of the expected results lies in the theoretical substantiation and provision of practical recommendations for improving the mechanisms for managing and interacting with the components of the security and defense sector when planning the state’s preparation for cyber defense, taking measures to neutralize and actively counter cyber threats in the national segment of the state’s cyberspace.