Cyber ​​Security in Saudi Arabia: review of the main government companies

In the globally widespread scenario of cyber Crime characterized by criminal activities that exploit components of information technology both hardware and software, economic interests and geopolitical conflicts make the Middle East a magnet for cyber attacks. The region, which is home to nearly half of global oil reserves and much of the world's natural gas, is a constant target of such attacks.

In this context, a review of government companies operating in the sector is particularly interesting Cybersecurity present in Saudi Arabia, with the aim of focusing i products, the services and activity of Research & Development (R&D), in which these government companies operate.

La Cyber ​​Security, translated as cyber security, in Italy it is defined by Prime Ministerial Decree of 17 February 2017 "Directive containing national cyber protection and cyber security guidelines" such as the "condition for which the cybernetic space is protected thanks to the adoption of suitable physical, logical and procedural security measures with respect to events, of a voluntary or accidental nature, consisting in the undue acquisition and transfer of data, in their modification or illegitimate destruction , or in the undue control, damage, destruction or blockage of the regular functioning of networks and information systems or their constituent elements".

The National Cybersecurity Authority of Saudi Arabia has defined cybersecurity as "the protection of IT systems and networks, systems and components of operating technologies, including hardware and software components, together with the services provided and the data included therein, against illegal methods of hacking, obstruction, modification, access, use or exploitation ". 

Cyber ​​Security materializes, as indicated in the multi-year planning document for Defense for the three-year period 2019-2021 (Doc. CCCXXXIV, n. 2), through the protection of workstations, mobile devices and the data contained therein according to criteria of confidentiality, availability and integrity (End Point Protection); Perimeter Protection, i.e. activities aimed at protecting networks and in particular at reducing the attack perimeter; Application Security or the implementation of security best practices during the software life cycle that allows the creation of a suitable level of security for all the components that provide services and finally with the Security Governance which concerns the set of activities and operations that make it possible to better set up the information security management process in order to increase the effectiveness and efficiency of operational activities related to cyber protection.

The Saudi government published the National Information Security Strategy (NISS). The need to draw up a national strategy in this area emerged from the awareness that the Kingdom was facing greater and more complex threats to national security and economic well-being. National and international interconnection has created new types of threats to the Kingdom's economic infrastructure. NISS focuses on a few key points, including a strong investment in research and development in the IT sector. In addition, the National Cybersecurity Authority (NCA), a central cyber incident management body responsible for risk prevention.

In particular, it has the following functions:

What led the country to the adoption of the NISS and the establishment of the NCA is attributable to the main cyber attacks suffered by the country. A tested online of 2018 specializing in defense and aerospace, indicates that the first major attack suffered by Saudi Arabia dates back to 2012, when the Shamoon malware, attributed to Iran, targets the oil company Aramco. In 2017 the same malware made some computers of the Ministry of Labor totally unusable and attacked a chemical company. In 2018, the website of the General Entertainment Authority (Gea) was hit by a cyber attack. The country estimates a loss of up to 0,5% of its Gross Domestic Product (GDP) due to weak cybersecurity. The Project was already announced in 2016 SaudiVision 2030 whose main goal is to reduce Saudi Arabia's dependence on oil and diversify its economy by 2030.

At the same time in 2018 the Saudi Cyber ​​Security and Programming Federation (SFCSP) signs 3 Memorandum of Understanding with the United States and in particular one with the American defense giant Lockheed Martin, a company engaged, among other things, in the development of the program for the production of the fifth generation multirole fighter F-35 Lightning II, a second with the Raytheon Company, an important US defense company, and finally the third with Northrop Grumman, a star and stripe company operating in the security, defense and aerospace sectors.

La Saudi Telecom Company (STC) is a telecommunications company based in Saudi Arabia that offers landline, mobile, internet and computer network services. STC, like other Saudi companies, offers services e products which fall within the four elements that characterize Cyber ​​Security, namely End-Point Protection, Perimeter Protection, Application Security and Safety Governance services.

IT Security Training & Solutions -I (TS) ^ 2 is a company founded in 2003 in Riyadh, recognized as the main Middle Eastern provider of integrated IT security solutions, services

Cyber ​​Security Consulting and Training Courses.

To solve the ever growing IT security problems, I (TS) ^ 2 offers various solutions concerning both the protection of End-Points and the implementation of Security Governance which include systems such as Security Information Event Management (SIEM). , new generation firewall, data loss prevention (DLP) systems, End-Point detection and response, firewall for web applications, advanced antimalware protection, web e-mail security, risk assessment and penetration test, social security networks, threat intelligence platforms, defense of social engineering and vulnerability management.

Finally, the company is also very active in providing training and promoting Cyber ​​Awareness campaigns.

La Saudi Arabian Military Industries (SAMI) is a national holding company 100% owned by a public investment fund owned by Saudi Arabia. SAMI develops and supports the military industries in Saudi Arabia and plays an important role in the localization of the military industries of an area which, remember, is classified among the top five countries in terms of military expenditure worldwide.

The SAMI Company invests in the latest technologies and the best national talent to develop products e services innovative military with international standards through four commercial divisions: aeronautics, land systems, weapons and missiles and defense electronics.

It is precisely the electronic defense division that works at research and development all aspects of modern technologies, including: radar and microwave, electro-optics, communication systems, electronic warfare, command, control, communications, computers and intelligence, cyber warfare, naval combat systems.

La Saudi Paramount Computer Systems (SPCS) started its activity in 2001, specializing in cyber security and providing a range of cyber security products and services for large enterprises and the government of Saudi Arabia.

As a company specializing in IT security and network protection solutions, it helps customers to design their security environment by providing specific products and services based on the needs of the requesting parties. Among the latter, government bodies certainly stand out, including the Ministry of Defense and the Ministry of Communications and Information Technology.

Within the services provided by the company, the following should be noted:

Al-Arabiya Systems Engineering (ASE) was founded as a Saudi company specializing in computer science. Its business consists of providing specialized technical consultancy, strategic consultancy, IT security, infrastructure and IT solutions, contact center solutions and other organizational issues.

Within the services Cyber ​​that the company provides, there are solutions that range from consultancy to training to Cyber ​​infrastructures; Applications Security in infrastructures include Data Security, Big Data management, Cloud Security, Identity Assurance, Cyber ​​Security and Government, Risk and Compliance.

Of particular note are the partners to which ASE refers: Cisco, Dell, Samsung, Oracle, Sharp and Panasonic are to be mentioned. Among the customers to whom its services are provided, there is the Ministry of Economy and Finance.

MBUZZ is one of the main ICT companies, whose foundation dates back to 2007. The head office is located in Riyadh, Saudi Arabia and has a strong geographical presence in the Middle East, Africa, Asia and Europe. MBUZZ offers solutions in the Data Center, Telecom, SDN and NFV, Cyber ​​Security, Artificial Intelligence and Internet of Things sectors. It uses its exclusive business engineering skills to develop new business models aimed at solving challenges, generating new opportunities and improving existing business processes and portfolios to meet market trends. It provides, at Cyber ​​level, services Cyber ​​Defense, Strategy and Risk, Digital Identity, Application Security and Infrastructure Security that allow MBUZZ to have an integrated approach to corporate security aimed at allowing the customer to focus on the needs of his company rather than on the risks related to IT security. As for the other companies analyzed, MBUZZ also boasts collaborations with Saudi government bodies and, specifically, among the number of its customers (among which important telecommunications companies such as Nokia, Huawei and Ericsson stand out) there is the Ministry of Health.

What emerges from the analysis conducted regarding the products, services and R&D activities for each government company analyzed is that Saudi Arabia is purely oriented in the Cyber ​​market to offer services that map all the characteristic elements of Cyber ​​Security relating to End Point Protection, Perimeter Protection, Application Security and Security Governance. With regard to products the Cyber ​​market is purely oriented to the Perimeter Protection area. While for the R&D activities, SAMI is certainly the government military company that operates in those projects that map all four elements of Cyber ​​Security.

Saudi Arabia has the largest ICT market in the Middle East both in terms of volume of capital and expenditure which is rapidly becoming one of the most sought after by local and international companies. In fact, while the Saudi IT industry currently contributes only a modest 0,4% of the country's gross domestic product (GDP) and the Kingdom's ICT market continues to be driven by imports - with more than 80% of the ICT expenditure of foreign companies - the IT sector is considered one of the industrial sectors with the fastest growth and enormous development opportunities. In the IT sector, a growth rate of the Saudi Arabia Cyber ​​Security market of 16,59% between 2018 and 2023.

After the attack in 2012, Saudi Arabia began to invest huge resources to develop cyber capabilities in a defensive key, according to what was highlighted by a 2017 report created by the Potomac Institute for Policy Studies and has increasingly relied on US companies to increase cybersecurity nationwide. The agreements of 2017 with Raytheon and 2018 with Booz Allen Hamilton, for the provision of cyber services, are emblematic of this partnership with the United States. Companies that actively collaborate with Saudi Arabia include: IronNet Cybersecurity, Raytheon, Booz Allen Hamilton, Northrop Grumman and Lockheed Martin.