Stakeholder Survey 2020

Online Survey A third-party provider supplied access to the online survey instrument - SurveyMonkey The survey period: From August 3, 2020 to September 7, 2020
Stakeholder	Sample Requirements	Email Sent	Valid Email Amount	Click-through Rate
Domain Name Registered Registrant	Registrants who registered the .tw/.台灣 domain name in the past year, excluding those who registered Chinese domain names.	59,244	1,534	2.6%
Chinese domain name registrant	Registrants who registered the .tw/.台灣 domain name in the past year, i.e., registrants who were affected by the new policy.	1,534	91	5.9%
IP Members	-	316	57	18.0%
TWCERT/CC Newsletter Subscribers	Newsletter subscribers	4,312	566	13.1%
Stakeholder	Sample Requirements	Valid Email Amount
Domain Name Registered Registrant	Registrants who registered the .tw/.台灣 domain name in the past year, excluding those who registered Chinese domain names.	1,534
Chinese domain name registrant	Registrants who registered the .tw/.台灣 domain name in the past year, i.e., registrants who were affected by the new policy.	91
IP Members	-	57
TWCERT/CC Newsletter Subscribers	Newsletter subscribers	566

In-depth Interviews The interview period: From August 28, 2020 to September 24, 2020
Stakeholder	Sample Requirements	Number of Interviewees
Domain Name Registrar	-	5
Taiwan CERT/CSIRT Alliance	-	4
Relevant Government Agencies	Points of contact with frequent operational engagement	3
ICANN and APNIC	International organizations responsible for administering internet resources	2

Current Organization Status and Partnership

Stakeholders from the international organizations first praised TWNIC’s cooperation overview; they think that TWNIC is a highly cooperative and service-oriented organization. Interactions between the two parties were great and they continuously provided help and contributions to the various events held by the stakeholders of international organizations and they expressed their thanks to the organizing team.

TWNIC culture is a very collaborative open minded sort of service and cooperative oriented organization….it's a really good indication that gives a sense of TWNIC, I'd call it sort of serious intent and commitment to what's important to us, which is collaborative community oriented service oriented pace.

In terms of actively wanting to contribute to work, we are really grateful to thank for Kenny and his team that vision for wanting to contribute and give back to the community.

In addition, due to the mutual influence background of the various network information security issues, they agreed when it was mentioned that TWNIC and TWCERT/CC were combined into international and national assistance roles under the same organization; they thought this was a very practical cooperation and will be able to effectively help with the healthy development of the network ecology.

But not only for the sake of the Pacific, or also for the sake of the internet much more broadly because lack of security in one place can and can immediately create security problems elsewhere. So I think TWNIC can with TWCERT as well for precisely that reason, can really argue for a national and international role in assisting internet development.

Recommendation on Key Development Fields

For the expectations that the stakeholders from the international organization have on the cooperation progress, they continued on last year’s suggestion and continued to mention technical field resources and educational training to support the two fields. This year, they were more specific and described opportunities for extensions of hot topics online, including the influence of 5G application and the popularizing of IoT. TWNIC plays the key role for the stakeholder’s research on innovative technology, including opportunities for linking IP or domain names to develop innovative applications.

And we can only do that when we have partners like TWNIC, because it gives you a very clear sense as to how it gives people something to see and to touch and to feel to know that this is actually an organization that works on this. So again, it's like, you know, if there's some events or conferences related to topics like that, …we can work together to just to make sure that we explain it to the wider stakeholder community.

They also mentioned the lack of educational training resources at this stage, including cross-language to improve the difficulty of teaching and the lack of technical resources. This also had an impact and caused reduced possibilities to communicate with the community. Therefore, they hope that TWNIC can help host educational training events and develop teaching materials to develop more interactions between international communities and cover wider language ranges.

We're always looking for people to help us scale up. Literally training activities, actual training delivery, but also training materials development training content development, educational materials more generally, the translation and interpretation of the, of the material as well.

Future Positioning and Expectations of the Organization

For the organization positioning and future expectations of TWNIC, stakeholders encouraged Taiwan to continue to develop international relationships and they think that the pandemic is a thrust just like TWNIC’s experience in helping international organizations organize various forum events in the past; there will be more opportunities in the future to continue organizing and hosting these events through online methods.

And I think Taiwan's foreign relationships have been important. I'm sure TWNIC is kind of is interested in. In, some international affairs part. And I'd encourage that...This opportunity for TWNIC for all of us to show the good work that we've done and, and to be involved, and to be activated in more of what's coming in future. In terms of the post COVID kind of world.

They also encouraged TWNIC that they should play two roles of active supervision and consultant in government relations. In the experience sharing of stakeholders from international organizations, taking positive attitudes towards government units can ensure that they move towards a healthy network society in network governance. As for the consultancy role, they can draw on the experience of international organizations to ensure that TWNIC can provide more international recommendations in the formulation of government policies and have more opportunities to speak out.

Yeah, so there's a little bit of both. So the first is that we try to make sure we at least have an active relationship with the governments that deal with the internet ….Then the second area is some monitoring…So in this case this is where we a partnership works because TWNIC sees legislation. They can flag it to us and then we can provide some advice, which advice, mainly consists of education.

Clear Organizational Positioning, Looking into Future Planning

The stakeholder first approved that the positioning of TWNIC is becoming clearer and the role and tasks of TWCERT/CC are also going in the correct directions. Compared to the survey last year, stakeholders from government units have higher expectations for the positioning of the organization and task inventory. The visions this year lean more towards raising awareness and the planning of follow-up development directions.

After TWCERT/CC moved to TWNIC, its positioning has become clearer; at least it’s been a lot clearer in the past year, but they’re still a bit slow on pushing it. Judging from a few indices, how many people know about the core services of TWCERT/CC and how they provide help? There is still a lot of room for improvement for these.

When looking at the next move, stakeholders from government units hope that TWNIC or TWCERT/CC can think over about the positioning of future developments. Whether or not it is operating by following the current plan and framework, or developing new business models and acting independently, the most important thing is to set strategic goals for the future and proposing business plans, continuing providing services for private enterprises and improving the service quality.

Assume that TWNIC treats TWCERT/CC as a plan, then they should run it the way they are running now; but it is another problem if it is treated as a business or division because from the government’s point of view, it is impossible for them to keep giving money.

Continue to Increase Popularity at Home and Abroad

Stakeholders think that the raising of awareness includes multi-party integration domestically and internationally. Domestically, they should focus on raising enterprises and the public’s awareness by performing promotional education. Internationally, they should become the bridge for Taiwan to connect to the rest of the world. The stakeholders mentioned that Taiwan has great technological capabilities and can use its technical strength to respond to international needs to achieve the goals of security or economic prosperity. Concrete practices include providing English information and update contents continuously, using the sharing of information to contact target countries for security cooperation and display Taiwan’s valuable strategies and also establish smooth communication channels. Whether or not it is information on information security provided to us by international organizations or the other way around, we can grasp the progresses of the processing and development processes well.

First is concerning SMEs, they should let more SMEs know that they can ask the Center for help when events occur. We are also coordinating the cooperation of commercial departments on this area. The second part is they need to let the public know about them. Most of these require education and promotion.

I suggest that when TWCERT/CC is exchanging and processing international information, they can negotiate with international organizations that receive information about the report information that we should provide and establish feasible report principles and process report channels for international organizations so that we can make sure whether or not the information was processed properly and whether other countermeasures should be taken.

Increase Corporate Visibility with Practical Needs

Since TWCERT/CC has the feature of bridging public and private fields, stakeholders continued to wish that more diversified promotional strategies can be developed between domestic enterprises to highlight its role as the notification center. They also pointed out that the Center can cooperate with the locals directly, and use practical development and the connection of enterprises to actively keep up with corporate trends or network issues to increase visibility. Take the digital transformation issue that enterprises pay much attention to recently for example, TWCERT/CC can have cross-industry cooperation and digital transformation research teams hold seminars, and use issues that appeal to enterprises to introduce the needs for information security, and further establish information security literacy for enterprises and achieve notification awareness. Or, use potential information security issues derived from the increased usage of video conferencing software brought by 5G applications, cloud printers or network printers which operate via wireless transmission and the impact of the epidemic, and propose corresponding solutions based on the usage requirements of enterprises.

TWCERT/CC should first have the ideas and tools, then people will go to them when there are contingency demand notifications afterwards. For example, they can have digital transformation research teams go share some information and everybody’s awareness will be raised.

Due to the impact of the epidemic, many physical events have been switched to online or video events; this also drove the significant adoption of video conferencing software in different industries. I suggest that TWCERT/CC should continue to visit SMEs that they already provide information security services for and keep statistics on whether or not they have used video conferencing software with information security concerns and coach them actively; also strengthen the collection of related vulnerability information and share repair information with the SMEs.

Develop Strategic Partners, Including Personal Promotion

Stakeholders also indicated possible methods to increase notification; besides continually thinking about incentives for how to attract active notifications, they can also specifically cooperate with related units and promote the prevention of information security events though local criminal police departments.

Another function of CERT is to connect with enterprises; since it is difficult for one unit to penetrate deep into every enterprise, they can cooperate with the criminal police departments and companies that provide government information services and individual protection cases up to certain extents. For example, what they should be careful of when shopping online and what they need to beware of when working remotely.

In addition to increasing enterprise promotions and cultivating information security literacy to bring about notification opportunities, things that can actually be done for the individual aspect can begin with the concept of protecting personal information. This will help raise the awareness of the notification service.

Information security is actually a concept for the promotion of information security and it includes the awareness to protect personal information. Currently, I haven’t thought about how we should go about pushing it, but the protection of personal information should also be promoted in Taiwan. It would be great if CERT can also include the protection of personal information.