As part of implementing the national strategy on computer security and computer systems auditing, major steps were taken over the period, including:
- Launching, in 1999, a Unit for Objectives-based Management to Develop Computer Security.
- Creating, in 2004, a national computer security agency (ANSI) by Law no. 2004-5 of 3 February 2004 on computer security, which laid down general rules for protecting computer systems and networks.
- Requiring regular auditing of computer security for systems and networks coming under the public bodies and establishments.
ANSI is responsible for generally supervising the security of computer systems and networks coming under the various public and private bodies and ensuring technology watch in the field of computer security.
2008 saw the launch for the first time ever of the certification of private enterprises in the field of computer systems auditing, in order to help the various sectors whose activities are based on computer networks and applications. This is a promising field with a sustained pace of investment and enterprise creation.
In the field of computer systems security and auditing, there are now (april 2010) 221 computer auditors as against 160 in the same period in 2008.
Internationally, ANSI, with its CERT (Computer Emergency Response Team) centre, is a leader in Africa, since it represents the first African CERT to be recognised since 2007 by the FIRST world network (Forum of Incident Response and Security Teams), which boasts almost 200 CERT centres in 45 different countries.
In this regard, ANSI was requested by South Africa to help it set up a national CERT as part of the preparations for the World 2010 football event. An agreement was signed to this effect and assistance actions by skilled ANSI workers were immediately started up in December 2008. Visits were made to South Africa, a Tunisian technical platform was installed and is today operational in South Africa, and operations were carried out to embed South African teams within ANSI. Similarly, cooperation was established with other countries to help them in the process of setting up a CERT.
Furthermore, since 2008 the agency has also been a member of the UNCTAD network of centres of excellence (United Nations Conference on Trade and Development). Choosing ANSI as a centre of excellence in the field of ICT by UNCTAD aimed at encouraging emerging countries to follow the Centre’s model in the context of south-south cooperation. Top-level training actions took place in Tunis in 2008 and 2009, with the participation of about fifteen African countries, helping people in charge of computer security. The aim was to set up professional ties that would enable Tunisia’s experience to be reproduced in their respective countries.
As far as data security is concerned, to guarantee the continuity of critical applications, the following steps were taken:
- Premises for the National Backup Centre are being built, and are expected to be completed in late May 2010. It should be noted that the choice of where the Centre should be built was decided taking into consideration the results of seismic and rainfall studies.
- Allocation of contracts to the various providers concerning the acquisition of computer, networks, electric and software and physical security equipment.
Future prospects
- Increasing the number of awareness actions and developing specialist academic training in the field of computer security,
- Continuing to promote the image of Tunisia as an outstanding technological centre and supporting coordination with many African institutions that specialise in the field of computer security, in order to promote bilateral cooperation in the field and continue to provide assistance to African countries to set up computer emergency response centres.
