third Cyber Security Assessment Netherlands - NCSC

Core assessment » 6 Manifestations
»
»»»»»
6 Manifestations
This chapter brings together the interests, threats
and resilience as manifestations, as shown in the figure
below. It describes the events or activities by which
actors (may) harm interests, and examples of
this throughout the reporting period of this CSAN.
Interests
The starting point for a manifestation is the ‘threat’ that results in
a negative effect on the availability, confidentiality and/or integrity
of information or information systems. A threat can become real
through a combination of the target’s vulnerability (the interest
to be protected), the resources available and an actor with the
intention and capability to carry out a specific attack. A threat may
arise from a conscious human action on the part of actor, natural
or technical events and through human error.
Threats
Actors
Tools
Manifestation
Resilience
Vulnerabilities
Measures
This chapter applies an allocation based on the target of the threat:
information or IT. A distinction is made between the following
main types of threat that cause a manifestation:
1. Attack targeted at information
a) Theft of information, possibly for publication or sale
(for example digital espionage and identity theft)
b) Manipulation of information (for example fraud involving
financial or other online transactions)
2. Attack targeted at IT
a) Digital defacement
b) Disruption of IT (for example DDoS attack)
c) IT takeover (for example the withdrawal of resources)
3. Failure of IT (because of natural or technical events or because
of human error)
Type of threat
1a) Theft of information, possibly
for publication or sale
Main actor(s) and intended aims
» States: digital espionage by other states and private organisations
» Professional criminals: financial gain
» Hacktivists, cyber vandals, internal actors: highlight vulnerabilities, expand own image or cause
harm to others
1b) Manipulation of information » Professional criminals: financial gain
2a) Defacement
2b) Disruption of IT
2c) Takeover of IT
3) IT failure due to natural
or technical events
» Hacktivists: to make a public statement, to spread propaganda
» Script kiddies, cyber vandals: show that it’s possible or for fun
» States: deployment of offensive cyber capabilities in state conflict
» Terrorists: as a weapon against physical targets or to support their terrorist activities, for example
to spread propaganda (using the internet as a tool)
» Professional criminals: as the basis of or as a diversion from attacks from which they have financial gain
» Hacktivists, script kiddies and cyber vandals: the disruption is an aim in itself to show it can be done
or for fun
» Internal actors: the disruption is an aim in itself
» Criminals: financial gain, sending of spam and phishing e-mails
» Hactivists: hosting of data in order to spread propaganda
» Script kiddies and cyber vandals: highlight vulnerabilities because it’s possible or for fun
Not applicable
Table 3. Summary of threats
43