Cybersecurity: Managing risks for greater opportunities

The ongoing challenge for governments is to ensure that cybersecurity policies support prosperity and development rather than undermine it. To this end, the OECD promotes a risk-based approach whereby a certain level of risk is accepted in order to preserve the economic and social benefits made possible by an open Internet.

Security should thus aim to reduce risk to an acceptable level through appropriate and balanced measures rather than to simply control threats by reducing openness and interconnectivity. The flexibility, scalability and management aspects of this approach reduce the cost of security, without restricting choice, stifling innovation or limiting the adoption of new technologies. An OECD consultation of non-governmental perspectives found that multi-stakeholder collaboration is the best means to develop effective cybersecurity policies that respect the fundamentally global, open and interoperable nature of the Internet. NGOs however express concerns regarding the blurring of boundaries between the economic and social dimensions of cybersecurity and the emergence of sovereignty considerations. The OECD has now launched a broad consultation of all stakeholders from member and non-member countries to review its Security Guidelines. The review will take into account newly emerging risks, technologies and policy trends around such areas as cloud computing, digital mobility, the Internet of things, social networking, etc. It will also build on successful policies in national cybersecurity strategies and consider ways to foster greater international co-operation among governments, consistent with the 2011 OECD Recommendation on Principles for Internet Policy making.