third Cyber Security Assessment Netherlands - NCSC

Core assessment » 1 Interests
»
»»»»»
1 Interests
The National Cyber Security Strategy 2011 defines cyber
security as follows:
Cyber security means being free of the danger of harm caused
by the disruption, failure or inappropriate use of IT. The
danger of harm caused by misuse, disruption, or failure can
mean a restriction on the availability and reliability of IT,
infringement of the confidentiality of the information stored
in IT or harm to the integrity of this information.
Thus cyber security is about protecting information and
the functioning of IT. When IT does not work properly
or confidentiality and integrity of information are at
risk, the interests of our society may be damaged.
This chapter examines the relation between IT security
and interests.
1.1 Importance of IT security to society
The increasing digitalisation of our society is apparent to
practically everyone. It means that harm to IT security can have
an ever-greater impact on our interests. In the context of cyber
security we differentiate between four types of interests that
need to be protected:
Individual interests
»»
Privacy
»»
Freedom of speech
»»
Access to services
»»
Physical safety
Chain interests
»»
Responsibility for information
from citizens or customers
»»
Management of general
provisions and systems such
as GBA, iDeal and DigiD
»»
Dependency between
organisations
Organisational interests
»»
Products and services
»»
Production resources (incl.
money and patents)
»»
Reputation
»»
Trust
Social interests
»»
Availability of vital services
»»
Upholding of (democratic)
rule of law and national
security
»»
Infrastructure of the internet
»»
Free flow of services
»»
Digital security
Cyber security needs to consider all of these interests. These interests
will have a different weighting for everybody and may be contradictory.
Individual interests
These are interests that individuals deem important and seek
to protect. Examples include basic rights such as privacy or the
importance of freedom of speech as well as the security of
someone’s digital identity and the importance of access to online
services. From a European perspective, relatively large numbers
of Dutch people use the internet for shopping (76 per cent) and
banking (82 to 84 per cent). [3: CBS 2012] Compared with other
EU Member States, Dutch people state notably often (28 per cent
compared with an average of 13 per cent) that they have been
[12: : EC 2013-1][3]
unable to use online services because of cyber attacks.
Privacy concerns are the main reason why 35 per cent of Dutch
[49: TNO 2012]
people choose not to use an internet service.
Organisational interests
These are interests that an organisation depends on to achieve its
objectives and/or its continued viability. A successful hacker can
cost an organisation a considerable amount in recovering from or
combating an attack, and hacking can also result in loss of reputation.
It is not just attacks; compromising the integrity (accuracy,
topicality, and/or completeness) of data can have very negative
effects. For a webshop, availability and the website functionality
are crucially important and failure can result in a sharp decline in
turnover. If a chemical factory’s process control system fails or
control is seized, safety could be seriously compromised.
Chain interests
These are interests that transcend businesses. Examples include
responsibility for information from citizens or customers and
suppliers or the availability of digital services, but they also include
the importance of basic provisions such as those for online
payments. The chain’s interest is compromised when cyber attacks
affect third parties. For example if personal information is leaked or
where online services that other organisations depend on are no
longer available. The partial failure of iDeal following cyber attacks
in April 2013 is one example. [4]
Social interests
These are interests that transcend the interests of the organisation
and are important to Dutch society as a whole. Examples include the
availability of essential services such as electricity. Cyber attacks
against a company or sector may ultimately affect society as a
whole. For example the long-term failure of payment transactions
or the electricity supply as the result of a cyber attack could affect
the economic interests of the Netherlands and lead to social unrest.
3 The period of measurement was March 2012, well before the cyber attacks in April/May 2013.
4 http://tweakers.net/nieuws/88305/storingen-ideal-en-ing-kwamen-door-ddos-aanval.html
17