View the NESA Center January–February 2024 Update focused on regional cyber trends. The update also highlights January through February NESA Center programs and events, faculty and staff engagements, alumni contributions, and a calendar with upcoming events.
Regional Trends – Cyber
-
U.S. Strategy in the Middle East: Cyber as a Non-traditional Threat:
-
The cybersecurity landscape in the Middle East, Levant, and Central Asian States is marked by complexity and geopolitical tensions, where both state and non-state actors leverage cyberspace to pursue political, economic, and military objectives. As governments grapple with the dual role of being both victims and aggressors in cyber warfare, there is an increasing recognition of the need to fortify national defenses against cyber threats. Despite being ranked as a third-tier cyber power, Iran stands out as a significant regional disrupter, posing threats to the networks and data of U.S. allies and partner nations. In response, major powers like the U.S., Israel, and Saudi Arabia are intensifying efforts to safeguard critical sectors through substantial investments and advancements in cybersecurity infrastructure.
-
The significance of cybersecurity cannot be overstated, particularly in the face of state-sponsored threats that challenge national sovereignty and security. Military preparedness in the digital age requires sustained capabilities and sophisticated technologies to counter internal and external adversaries effectively. Artificial Intelligence emerges as a crucial tool in bolstering cybersecurity, enabling advanced threat detection, prevention, and response through machine learning algorithms. Automation further enhances operational efficiency by streamlining security workflows and enabling split-second decision-making for integrated measures.
-
Addressing cybersecurity challenges demands collaborative efforts across multiple domains and borders, including government, industry, and civil society. It is critical to tailor initiatives aimed at promoting awareness, capacity building, and resiliency to specific regional needs and priorities. Establishing norms and regulations governing cyber warfare, enhancing cybersecurity capabilities, promoting digital literacy, and diversifying economies away from oil dependence are key areas of focus.
-
To effectively mitigate evolving cyber threats, three recommendations are institutional capacity building, education, and engagement to build a like-minded integrated force to protect global stability. First, investing in AI-driven cyber defense systems is a strategic imperative to ensure advanced capability for threat detection, decision-making, incident response, and resiliency against future cyberattacks. Secondly, education and training programs are essential to equip military and civilian personnel with the necessary skills to understand, develop, and defend against cyber threats. Lastly, strengthening international partnerships for cybersecurity cooperation is paramount, given the transnational nature of cyber threats.
-
These proactive measures represent just the beginning of efforts to safeguard against cyber threats. Failure to act promptly could empower radicalized individuals with the means to perpetrate cyber violence, underscoring the urgency of collective action to protect the cybersecurity landscape in the Middle East, Levant, and Central Asia.
-
-
Cyber Threats:
-
Countries in the region are very aware of cyber threats but generally lack the ability to detect or counter cyber threats on their own. For the most part, cyber efforts are focused on identification and the imposition of cyber hygiene as a preventative measure.
-
Countries in the region are dependent upon commercial vendors for most of their cyber products. They generally have a diverse range of cyber products from different vendors in different countries. This means that they have a variety of vulnerabilities and, in general, do not have the indigenous capability to respond to cyber threats across multiple platforms.
-
The cyber defense effort in the region tends to focus on “retail level” software, such as communications and financial transaction systems. There is less capacity in control and remote sensing software, again because of the reliance on multiple offshore vendors rather than home-grown software developers.
-
NESA Center program participants have expressed the view that other countries, most notably the U.S., would police the cyber realm as it generally does in the maritime realm. Participants seemed unconcerned about the possibility of Huawei hardware having back doors that would introduce a cyber threat. They seem to think that their generally non-confrontational relations with China provide insurance against any possible Chinese cyber disruption, although they seemed less confident about possible information exfiltration.
-
-
North Africa & the Sahel:
-
North African and Sahelian officials often simply tie cybersecurity to their experiences with terrorist use of the Internet and the web for recruiting and communication, as well as leverage new technology to that end. They understand all too well that as governments and private providers (Facebook, X, etc.) crackdown on extremists on these social media platforms — terrorists, radicals, and criminals are increasingly turning to more secure platforms, such as the “dark web.” Governments are most challenged on the “dark web” which ensures anonymity and avoids government monitoring. Their goal/ask/answer as far as cybersecurity is concerned is often simply “how do we completely shut down the internet.”
-
The expanding use of cyber also challenges their more traditional security approaches in that it can change rapidly and outpace governments’ ability to stay abreast of cyber-use implications. It should be of no surprise that AI will almost certainly end up being adopted into terrorists’ and criminals’ new strategy as another effective tool. It was acknowledged by security experts in the region that their governments lack the ability to counter terrorists’ and criminals’ use of this new technology nor effectively add it to their own toolbox. While it was accepted that technology would play an enormous role in future conflicts and while it was not necessarily being embraced by governments, most did see this as an opportunity to establish closer partnerships between public and private, as well as with skilled youth.
-
Cybersecurity discussions often tied to concepts of future conflicts. Even as far back as 2019, some predicted that there would be an increasing prevalence of proxy wars; cyber-attacks; coercion; weaponization of food and water and violence against women; economic pressures/sanctions; coordinated international criminal attacks; and a wider range and forms of terrorism. How well countries are prepared to deal with these new trends in state warfare is questionable as governments, even today, struggle to meet even the basic services and personal security for their people. On the other hand, there was no doubt that non-state actors not only will set these new standards but stand ready to fill the governance voids and, in the very eyes of its citizens, put in question the very legitimacy of the state.
-
There is a need and a strong argument for allies to better tailor security assistance programs to prepare partners for realities and challenges that lay ahead – cybersecurity being only one of those key areas.
-
-
Regional Economy & Market:
-
Globally, 40% of jobs are exposed to cybersecurity and artificial intelligence. Countries that lack the infrastructure and a skilled workforce to invest could fall behind. Regional economies such as the UAE and Saudi Arabia have significantly increased investment in cyber and AI as part of strategies to diversify their economies.
-
According to a new analysis by MarketsandMarkets™, the size of the Middle East cybersecurity market is expected to increase from USD 14.8 billion in 2023 to USD 23.4 billion by 2028 at a Compound Annual Growth Rate (CAGR) of 9.6%. The rise in digital transformation projects is fueling the Middle East Cybersecurity Market development and pushing cloud technology adoption. This rise is further supported by regulatory initiatives aimed at countering the dynamic threat landscape, which highlights the crucial role of cybersecurity. In particular, Saudi Arabia’s Vision 2030 influences cybersecurity market growth, and increasing cyber threats against Israel has accelerated the country’s demand.
-
The Kingdom of Saudia Arabia has established a National Cyber Security Authority (many other states have similar structures) with a mission to “Enhance cybersecurity in the Kingdom” to reduce risks, boost confidence, and enable growth. They are looking for global and local investors and promoting research and development, entrepreneurship and startups, local content, and leadership of national companies.
-
Read the full NESA Update report [PDF]
Read other NESA Center reports here.