third Cyber Security Assessment Netherlands - NCSC

Core assessment » 2 Threats: actors and their intentions
»
»»»»»
2 Threats: actors and their intentions
This chapter examines the first aspect of threats, i.e.
the actors, their intentions, and developments in
this area. An ‘actor’ is the party playing a role in the
area of cyber security. Parties can take on several roles
and thus mani fest themselves as various actors.
Actors may also intentionally or unintentionally use
one another’s capacity.
Following the description of the actors there is a summary of these
actors, their intentions, skills, and primary targets.
It is not always possible to determine with certainty what type of
actor is behind a specific cyber attack - this is the issue of attribution.
Examples of this include the DDoS attacks on various Dutch banks,
KLM and DigiD where we cannot (yet) say with certainty which
actor was responsible. Even where an actor claims responsibility
for an attack, there is still the issue as to whether the claim is true.
2.1 States
‘State actors’ are defined as actors who form part of a country’s
government. The threat from states is their intention to improve
their geopolitical position (for example diplomatic, military, or
economic) or, for example, to influence dissidents or opposition
groups who are resisting the current regime. Governments globally
are aware of the strategic significance of the cyber domain.
This is why various states are building on their digital skills and
developing or investing in digital tools (cyber capacity).
States or state-related actors may disrupt IT services by deploying
offensive cyber capacity (in varying degrees). Other actors may also
be used, perhaps to avoid attribution to a state.
Digital espionage by states, supported by states, permitted by states
or with the state as the ultimate beneficiary, forms a major threat
to the Dutch economy and to national security. Research carried out
by the Dutch intelligence services indicates that in the Netherlands,
these espionage activities are directed primarily at public authorities,
non-governmental organisations, the business community,
academia, dissidents, and opposition groups. Activities of this
type are known as an Advanced Persistent Threat (APT). The biggest
cyber espionage threat against Dutch interests at the moment is
from actors that are related to China, Russia, and Iran and to a lesser
degree Syria. [14]
For example there are indications that in China, there are various
actors such as intelligence services, the army, hacker groups, and
universities that have links to digital intelligence activities. Global
large-scale attacks originating from Chinese actors have been
detected directed for example at the petrochemical, automotive,
pharmaceutical, defence, maritime and aerospace industries.
The aim of these attacks is to obtain relevant military and economic
information.
The digital intelligence activities on the part of actors linked to
Russia/Russian digital intelligence activities are directed at public
authorities (in particular the ministries of Defence and Foreign
Affairs), international organisations (in particular NATO), the
defence industry, banking, the energy sector and Russian dissidents.
Digital intelligence activities from Syria are directed primarily at
intimidating Syrian dissidents and disrupting their communication.
State actors who invest in offensive cyber capacity can deploy this
capacity during conflicts with other states or opposition groups.
A conflict of this nature in the cyber domain would generally
involve the same elements as in the physical world, i.e. propaganda,
espionage, observation, manipulation, sabotage or (temporary)
disruption, reconnaissance, intimidation by opposition parties and
targeted attacks. This is allegedly how the Shamoon malware (see
section 2.10 ) was spread by a state actor in retaliation for Stuxnet.
The most extreme use of offensive cyber capacity is when it is used
in warfare. Digital warfare is defined as “using digital means to carry
out military operations designed to disrupt, mislead, change or destroy an
opponent’s computer systems or networks”. [15] To be classified as warfare,
the terms of warfare must be met: an act of violence that is
instrumental to a political aim (of a state), i.e. to impose its will
on an opponent. [44: Rid 2012] Conflicts that are (in part) fought out
in the digital domain can harm parties not directly involved in the
conflict. For example, state actors may exploit vulnerabilities in
private and business computers.
2.2 Terrorists
‘Terrorists’ act from ideological motives. Their aim is to bring about
social change, to incite serious fear among the population or
to influence political decision-making. In doing what they do, they
have no qualms about using whatever means they deem fit and they
use targeted violence against people or cause disruption to harm
companies. [16] Terrorists may launch cyber attacks against the
infrastructure of the internet (internet as a target), physical targets
14 AIVD annual report 2012.
15 Advisory Council on International issues (Adviesraad Internationale Vraagstukken), Advisory
Committee on International Law Issues (Commissie van Advies Inzake Volkenrechtelijke
Vraagstukken), Digital Warfare, No 77, AIV/No 22, CAVV December 2011.
16 The official definition of terrorism is from ideological motives threatening, preparing, or
carrying out serious violence against people of acts directed at causing material damage to
society with the aim of bringing about social change, inciting serious fear among the
population, or influencing political decision-making.
21