third Cyber Security Assessment Netherlands - NCSC

Core assessment » 5 Resilience: measures
»
»»»»»
Digital resources may also be deployed in combination with
sophisticated technical attacks on military installations. For
example at the end of 2011, the American Air Force’s drone
programme became infected by a virus. Although the virus did
not endanger the operational element of the mission, it did
cause some nuisance. [97][98] A further example is the hacking
of American drones by insurgents in Iraq, who intercepted live
video images so that they could evade and monitor American
military operations. [99] Furthermore, an American general has
admitted that the American army has used cyber capabilities
in Afghanistan. Carrying out these cyber operations allowed
the United States to infect opponents’ command & control. [100]
In practice, digital resources are being deployed more frequently
(and certainly more visibly) on the ‘soft’ side of
psychological warfare, such as Twitter and other social media.
This was for example evident throughout the Israeli operations
against the Gaza Strip [101] and ISAF operations in Afghanistan,
where the Taliban and ISAF tried to get the better of each other
on Twitter. [102] Other good examples include the multiple
break-ins in August 2012 to the Reuters press agency’s Twitter
account and Wordpress blog environment. 22 false tweets
appeared on these media along with several blog posts,
supposedly from Reuters journalists about developments in
the conflict in Syria after unknown individuals has hacked the
account and the blog environment. [103]
pay more attention than previously to measures and this is also
happening more often in collaboration.
Noticeable examples of this are the campaigns for raising awareness,
such as ‘Alert Online’, ‘Banking details and log-in codes.
Keep them secret’ and ‘Protect your company’. In addition to this,
closer collaboration in the area of exchange of information and the
agreements reached between banks and the government in
connection with the DDoS attacks are good examples. In the area of
research and innovation there have been various research programmes
set up for the purpose of tackling the issues in connection
with cyber security in collaboration between the government, the
business community and the academic community. A guideline has
also been published for setting up a policy of responsible disclosure,
which involves pointing out IT vulnerabilities in a responsible
manner. This is a handout for organisations and reporters as to how
vulnerabilities in information systems and (software) products can
be reported and dealt with in a responsible manner.
The increased awareness has also recently led to new initiatives and
supplementary measures at a national level and in certain organisations.
They thus anticipate on the ever-increasing dependence on IT
and changing threats. The effectiveness of this can only be measured
in the long term. «
5.9 Education and investigation
Good education and investigation are important in terms of
sustained resilience. In recent years, education has seen several
secondary schools, universities and companies set up or
strengthen cyber security training courses. The question arises as
to whether these (semi) public and private initiatives supplement
each other sufficiently.
As part of the National Cyber Security Research Agenda (NCSRA)
there have been two calls for research proposals, for which
€6.3 million is available. With the help of the SBIR regulation [104]
initially short-term development projects were put out to tender,
resulting in 17 feasibility studies being carried out. These will be
reviewed by mid-2013 to see which projects tenderers can successfully
develop further. Secondly, the Dutch Organisation for
Scientific Research (NWO) has been allocated a sum of 3.2 million
for nine joint long-term research projects. [105]
5.10 Conclusion
Many initiatives involving resilience that were cited in the previous
edition of the CSAN either have been started or are now in full
swing. During the past year - partly because of major incidents - the
public and political attention towards cyber security has noticeably
increased. The need has also reached the boardroom, meaning that
the subject of cyber security or information security is often given
great importance. The government and the business community
97 Computer Virus Hits U.S. Drone Fleet, www.wired.com, 7 October 2011.
98 Air Force says drone computer virus poses ‘no threat’, Los Angeles Times, 13 October 2011.
99 Insurgents Hack U.S. Drones, The Wall Street Journal, 17 December 2009.
100 Afghanistan Cyber Attack: Lt. Gen. Richard P. Mills claims to have hacked the enemy,
Huffington Post, 24 August 2012.
101 Editorial: Cyber and military capacity, Militaire Spectator 12-2012.
102 Jan van der Meulen and René Moelker, Digital duels in the global public sphere, in: P.
Ducheine, F. Osinga, J. Soeters (ed), Cyber Warfare – Critical Perspectives, 2012.
103 http://www.reuters.com/article/2012/08/03/net-us-reuters-syria-hackingidUSBRE8721B420120803,
http://www.reuters.com/article/2012/08/06/net-us-reuters-syria-hackingidUSBRE8721B420120806,
http://www.theregister.co.uk/2012/08/17/reuters_blogs_hacked_again/, http://blogs.wsj.com/
cio/2012/08/05/hacked-reuters-wordpress-platform-had-known-security-issue/
104 Small Business Innovation Research programme, http://www.agentschapnl.nl/nl/node/460958
105 http://www.nwo.nl/actueel/nieuws/2013/ew/negen-projecten-in-cyber-security-onderzoekvan-start.html
41