Linking Cybersecurity Policy and Performance: Microsoft Releases Special Edition Security Intelligence Report

Have you ever wondered what factors contribute to how well a country or region is addressing cybersecurity issues?  Today, I have the pleasure of presenting alongside my colleague, Kevin Sullivan at George Washington University’s Homeland Security Policy Institute in Washington DC on exactly that topic. During the lecture we will discuss key findings from a new special edition of our Microsoft Security Intelligence Report that focuses on “Measuring the Impact of Policy on Global Cybersecurity”.

This new report takes a look at cybersecurity in a world where the demographic of the internet is rapidly changing. Current projections indicate that internet users will double by 2020 to four billion worldwide, with large populations of users located in China, India and Africa. This change, coupled with a consistently evolving cybersecurity threat landscape will require governments around the world to look more broadly than ever before to understand the impact of the decisions that are being made today.

Figure 1 – Projected Distribution of Global Internet Users in 2020

While Microsoft has long reported on the technical measures of cybersecurity through the Microsoft Security Intelligence Report (SIR) and other sources of information, we have been looking to better understand what other factors can impact a given cybersecurity outcome.  In the report, we introduce a new methodology for examining how socio-economic factors in a country or region impact cybersecurity performance.  We examine measures such as: use of modern technology, mature processes, user education, law enforcement and public policies related to cyberspace. With this methodology we can build a model that will help predict the expected cybersecurity performance of a given country or region. From that prediction, we can attempt to better understand the public policies that distinguish the performance of different countries and regions.

When we looked at the data, we found that countries with the lowest malware infection rates (based on data from the Microsoft Security Intelligence Report) were significantly more likely to have signed international treaties such as the Council of Europe Cybercrime (CoE) or Voluntary Codes of Conduct such as the London Action Plan (LAP). While membership in CoE or LAP alone will not reduce cyber risk, there are steps countries often take to prepare for membership that significantly help to reduce risk. These steps include having a common policy environment for cybercrime and establishing methods of international cooperation that can evolve with the changing threat landscape. In addition to such policies, countries with the lowest cyber risks had on average more personal computers in use per capita, higher health expenditure per capita, regime stability, and greater broadband penetration. Out of all the highest performing countries, 43 percent were located in Western Europe.

The data also revealed that countries or regions with the highest levels of cyber risks also had high rates of piracy.  These countries or regions typically had low literacy rates, low broadband speed and penetration, and high crime per capita. On average, these countries or regions had three times more malware than the highest performing countries, an average piracy rate of 68 percent and fewer than 10 percent of these countries had signed international treaties or codes of conduct on cybercrime.  Out of all the lowest performing countries, 52 percent were located in The Middle East and Africa.

Of course, these are just some of the highlights.  I encourage you to download the report today to learn more about what socio-economic factors correlate to cybersecurity performance.

It is our hope that this work will catalyze additional research on factors that impact cybersecurity around the world, as well as provide more data to help guide cybersecurity policy decisions.


About the Author
Paul Nicholas

Senior Director, Trustworthy Computing

Paul Nicholas leads Microsoft’s Global Security Strategy and Diplomacy Team, which focuses on driving strategic change, both within Microsoft and externally, to advance infrastructure security and resiliency. His team addresses global challenges related to risk management, incident response, emergency communications, Read more »