third Cyber Security Assessment Netherlands - NCSC

Appendix » 2 Incidents
Incidents registered with the NCSC
The NCSC supports governments and organisations in vital sectors
in dealing with reported incidents in the area of IT security. The NCSC
also identifies incidents and vulnerabilities itself, on the basis of
detection, for example.
Furthermore, the NCSC acts at the request of international parties,
particularly ISPs, to provide support in combating cyber incidents
abroad that have originated in the Netherlands (for example from a
web server or from infected PCs in the Netherlands). The NCSC does
this under the title ‘international requests for assistance’.
Number of incidents dealt with per target group
The number of incidents dealt with by NCSC showed no significant
increase or decrease in the previous quarter. Following a sharp
increase in the second quarter of 2012 ( 27 incidents compared
with the first quarter) the number of incidents increased in the
remaining quarters of 2012 to then fall again in the first quarter
of 2013 (Figure 14).
NCSC defines a reported incident as ‘an IT-related security
event discovered to pose an immediate threat or cause
damage to IT systems or electronic information, related to
one or more specific organisations, to which NCSC responds
with action on their behalf.
This definition shows that an incident does not always result
in harm, but may still be a risk. More specifically, incidents
fall into three types:
» Attack: a malicious attack has taken place in an attempt
to breach security as a result. Examples include hacks,
malware infections and DDoS attacks.
» Threat: an actor has the malicious intention to carry out
an attack but has not done so yet.
» Vulnerability: an IT environment is vulnerable, for example
because of an error in the software, hardware or system
configuration. A vulnerability means that a threat or attack
has not (yet) taken place but there is opportunity for abuse.
The number of incidents reported by or in relation to the government
during the reporting period of this CSAN remained relatively
stable: between 42 and 48 incidents per quarter. The fluctuation in
incidents is thus primarily caused by incidents relating to the private
sector (28 to 42 per quarter) and the number of international
requests for assistance (3 to 14 per quarter).
Incidents
Incidents dealt with by NCSC (10Q4-13Q1)
>
120
100
80
60
40
20
0
Quarter > 10Q4 11Q1 11Q2 11Q3 11Q4 12Q1 12Q2 12Q3 12Q4 13Q1
g Incidents at governments g Incidents at private organisations g International requests for assistance
Figure 14. Incidents dealt with by NCSC (total)
103