third Cyber Security Assessment Netherlands - NCSC

Furthermore, business information can be placed online in unknown
environments (cloud) whose security is unknown and is possibly
insufficient. This results in the risk of data leaking. Consumerisation
thus yields vulnerabilities but it still cannot be said that the number
of incidents attributable directly to consumerisation is increasing
sharply or is large.
4.1.3 Insufficient insight into threats and incidents
Cyber security demands an up-to-date and broad view of new
developments, vulnerabilities, methods of attack and defence
mechanisms. For organisations, this demands insight into the
in-house IT environment such that attacks on or penetrations into
this environment are detected quickly. In addition to insight and
detection, cyber security also requires the capacity to respond
rapidly and appropriately to threats and incidents: effective cyber
security also requires an ability to act. After all, real life shows that
incidents can never be fully avoided and it is therefore important
to be well prepared.
Currently, many organisations still lack the right knowledge,
detection methods and the capacity to deal with incidents.
Incidents such as the Pobelka botnet demonstrate that the network
has been penetrated in many organisations and computers have
been infected, but that this often goes unnoticed for many months.
In many cases, organisations focus their information security on
standards such as ISO2700x, but this results in information security
being set up in a relatively static way. The modern threats requires
them to get up to speed with their insight and ability to act. [58]
4.1.4 Efficiency and customer satisfaction putting privacy under pressure
In its review of 2012, the Dutch Data Protection Authority (CBP)
noted that the government is increasingly collecting and linking
personal details. [2: CBP 2013] Given that in many cases citizens are
obliged to hand over personal details, it is essential that citizens can
be confident that these details are handled carefully, in accordance
with the law. However according to the CBP, the government –
spurred on by technological developments and the desire to be
efficient and achieve customer satisfaction – is increasingly linking
personal data to then use this data for completely different
purposes than those for which it was originally intended. Indeed
the same can be said of companies that acquire and store customer
data on a large scale.
4.1.5 Vulnerability when using cloud services
Cloud computing has advantages but it also entails risks, in part
because access is not always effectively secured and cloud providers
assume rights for use of the data under constantly changing terms
and conditions. American and European privacy laws are not
aligned with each other, but the EU considers American cloud
service providers to be sufficiently secure provided they are deemed
to be a ‘safe harbour’ and have certification.
Customers could nevertheless become involved with foreign
regulations that may be in conflict with the interests that are
to be protected (and possibly local regulations), such as the privacy
of customers/patients/citizens, intellectual property and continuity
of business operations. With the Patriot Act as a symbol, the issue
is increasingly attracting the attention of politics and science and of
organisations considering acquiring an (American) cloud service.
Many countries have legislation that is comparable to the Patriot
Act and the powers arising from it may not be superseded by
contractual guarantees or Dutch legislation. According to research
carried out by the University of Amsterdam, the transition to cloud
services will lead to a reduction in the autonomy of organisations
[53: UvA 2012]
when dealing with enquiries from foreign governments.
It is known that cloud services are used to store and exchange
illegal material and to carry out botnet attacks. [59]
Cloud computing also presents challenges for the detection and
[57: WODC 2012]
prosecution of crime.
4.1.6 Social media remain an unintentional source of information
Social media are of great interest to individuals with malicious
intent because of the personal information available there, the
mutual trust between the participants of a social network and the
Protection of medical data
In 2012, research commissioned by the CBP revealed that a large
number of the hospitals had not implemented sufficient safety
measures to eliminate vulnerabilities with respect to the
confidentiality, integrity and availability of patient and medical
data. In September 2012, for example, it reprimanded a
hospital [58] and tasked it with making improvements after audits
revealed that identification, authentication and authorisation
were insufficiently managed for systems with digitalised patient
files. This gave employees greater access to the data than their
role should have warranted.
According to the Special Interest Group Information Security in
University Hospitals, a number of patient-side developments
support the flexibility and efficiency of personal care provision,
but on the other hand there are again risks of undesirable and
unintentional access to medical data. Apps are available where
patients can enter their personal and medical data and share
these with a care provider. However these apps are provided by
third parties and it remains unclear where the data is stored and
what security system is applied to these data.
58 www.cbpweb.nl/pages/med_20120920-beveiliging-medische-gegevens-rpz-ziekenhuis.aspx
59 http://news.cnet.com/8301-1009_3-10413951-83.html
32