third Cyber Security Assessment Netherlands - NCSC

ACM seeks active collaboration with (inter)national public and
private parties. Legal judgments from spam investigations in 2012
[38: OPTA 2013]
can be found in the ACM annual report 2012.
Responsible disclosure introduced
Responsible disclosure in the IT world means responsibly, and jointly
between the reporter and the organisation, making IT vulnerabilities
public on the basis of relevant policy put together by organisations.
[32: NCSC 2013-1] Applying responsible disclosure can very much help
to increase the security of information systems and (software)
products. In 2013, the guideline for arriving at a practice for
[32: NCSC 2013-1]
responsible disclosure in the Netherlands was published.
This is a handout for organisations and reporters as to how
vulnerabilities in information systems and (software) products can
be reported and dealt with in a responsible manner. It is now down
to organisations to implement and publish their own responsible
disclosure policy. The NCSC received the first reports at the
beginning of 2013 but it is still too early to draw any conclusions.
5.8 Cyber operations in the Defence sector
In June 2012, the Minister of Defence issued the Defence Cyber
Strategy containing six focal points. The focal points for Defence
are a comprehensive approach, strengthening of digital resilience
(‘defensive’), the military capacity to carry out cyber operations
(‘offensive’), increased cyber intelligence capacity, adaptive and
innovative capability and collaboration. [93] The Ministry of Defence
(MoD) is expanding its cyber capacities to safeguard deployment
of the Dutch armed forces and increase the efficiency of this
deployment. The priority is to increase the MoD’s own resilience
and strengthen the intelligence position.
In 2012, a Cyber Task Force was formed to facilitate this intensification.
A start was also made in expanding the capacity of the Defence
Computer Emergency Response Team (DefCERT) and the Defence
Intelligence and Security Service (MIVD). At the same time, there is
closer collaboration with the NCSC and other partners. To increase
internal awareness, various learning environments have been
introduced and there has been participation in various cyber drills.
Furthermore, the taskforce will establish the capability to apply
cyber in military operation (including offensive capacity). To achieve
this, the Defence Cyber Command and the Defence Cyber Expertise
Centre (DCEC) are being set up.
DefCERT supervises protection of the defence networks. DefCERT’s
current capacity is being expanded with specialists in ICS and
Process Control or SCADA systems. This marks an important step
in increasing the protection of arms and sensor systems.
93 Defence Cyber Strategy, June 2012.
94 Washington, Beijing in Cyber-war Standoff, Newsline ABC, 12 February 2013.
95 The other four domains are: air, sea, land and space.
96 Cyber Crime and Cyber War Predictions, Cyber Defense Magazine, 25 March 2013.
The MIVD investigates all actors who pose a cyber threat to the Dutch
armed forces and the defence industry. The MIVD is reinforcing its
information position in the cyber domain with the aim of detecting
and combating digital attacks from (potential) opponents. In doing
this, the MIVD is helping to combat cyber threats with the aim of
guaranteeing the Dutch armed force’ readiness for deployment and
action. Given its expertise and special legal competences, the MIVD,
working with the Defence Cyber Command, plays a crucial role
in developing the defence sector’s offensive cyber capacities.
In addition, project Symbolon is to be rolled out together with
the General Intelligence and Security Service (AIVD), as part of
which both intelligence services will bundle their cyber and SIGINT
capability into one joint unit.
Within the given mandate, offensive cyber capabilities will be used
by the Defence Cyber Command under the responsibility of the Chief
of Defence (CDS). By 2015, the armed forces must be in a position
to deploy offensive cyber capabilities in military operations.
Defence is furthermore involved in the National Cyber Security
Research Agenda, various NATO and EU programmes and
the Cooperative Cyber Defence Centre of Excellence (CCDCoE)
in Tallinn. In preparation for the establishment of a professorship
in 2014, an Associate Professor of Cyber Operations was appointed
to the MoD’s Dutch Defence Academy in 2012.
Digital warfare and cyber conflicts
States are not only active in cyberspace to defend themselves,
they are increasingly developing intelligence and offensive
cyber capabilities. Every day, states carry out digital surveillance
on computer networks for reconnaissance and/or
offensive purposes.
The media are firmly instilling fear of a cold war in the digital
domain [94] In reality, digital resources are another weapon
in the arsenal that a state already has at its disposal. The
deployment of digital resources is relatively easy given the
degree of anonymity and because developing and deploying
digital resources is simpler and cheaper than conventional
weapons. Political and military conflicts already take place
partially in cyberspace and comprise the same elements as in
the physical world, including propaganda, espionage, surveillance
and targeted attacks. The Dutch armed forces therefore
consider cyberspace to be the fifth domain. [95]
Conflicts (partially) fought out in the digital domain may
present an additional threat if there is a large-scale spill-over
to civil society. After all, offensive cyber capabilities may
be deployed through vulnerabilities on private and business
computers, and on mobile devices. [96] Furthermore, with
a targeted cyber attack it is in theory possible to bring about
harm to a country remotely, for example by infecting the
SCADA systems.
40