third Cyber Security Assessment Netherlands - NCSC

Table 3 provides a summary of the different main types of threat
together with the most important actors and their objectives. The
paragraphs below detail the main types of threat, indicate which
manifestations are apparent and show the level of the threat. All
of this is finally summarised in the conclusion.
6.1 Attack targeted at information
We are constantly producing, collating, sharing and processing
increasing volumes of information with one another. No one wants
their financial details or personal or business information to fall
into the wrong hands or be manipulated. However cyber attacks
pose a threat that can harm the confidentiality and/or integrity of
this information. This paragraph differentiates between two types
of threat targeted at information: a) theft of information with
possible publication or sale of information and b) manipulation
of information.
6.1.1 Theft of information
Theft information (possibly for publication and sale) concerns
stealing confidential or valuable information. Actors may keep
information for themselves and take personal advantage of it,
but they may also publish or sell it. Information cannot be stolen
in a legal sense – the terms is lifting of the exclusivity since the
information is not removed.
Information regarding financial transactions and identity are
the most common targets of theft
Research carried out by Verizon [106] reveals that it is predominantly
information regarding financial transactions and
identities that is stolen. Verizon states that criminals prefer
information regarding financial transactions and personal
information that can easily be converted into cash. Corporate
espionage focuses on trade secrets, an organisation’s internal
information and system information. Hacktivists target
personal information and organisations’ internal information.
Finally, identities are desirable information to all of these actors.
Digital espionage
The most apparent form of information theft is digital espionage
(primarily) by states. For states, the motivation behind the theft
of information is political, military or economic gain through
digital espionage. [107] The extent to which and the structural way
in which digital espionage is used poses a major threat to national
security and the economy. Throughout this reporting period,
various public and private organisations in the Netherlands have
been a victim of this. This threat is therefore classified as ‘high’.
106 Verizon Data Breach Investigations Report 2013.
107 See cyber espionage section.
108 http://intelreport.mandiant.com/Mandiant_APT1_Report.pdf
109 See for example http://hackmageddon.com en http://csis.org/publication/cyber-events-2006
for additional overviews of cyber espionage.
Digital espionage aimed at citizens targets specific individuals
(often dissidents) who are being tracked by states.
Although the origin of digital espionage can rarely be established
conclusively, there are various indications of state involvement. The
General Intelligence and Security Service (AIVD) has detected
espionage activities originating from China, Russia, Iran and Syria.
See the detailed sections on Cyber Espionage for more information.
There was an increase in the number of cases of digital espionage
discovered last year. The actors behind these attacks dedicate
substantial amounts of money and time to these attacks.
The target is selected deliberately and the attack is targeted until
the aim is achieved. This type of attack is also known as an APT.
Advanced Persistent Threat (APT)
An Advanced Persistent Threat is the threat ensuing from a
targeted ‘long-term’ cyber attack, primarily on knowledgeable
countries and organisations by states and criminal organisations.
The General Intelligence and Security Service (AIVD) is
investigating APTs. In these cases, the attacker persistently tries
to penetrate a company and to secretly be present in the IT
infrastructure. During the APT attack, the attacker will primarily
collate ‘confidential’ information and/or prepare for disrupting
the functioning of vital components. The majority of these
attacks are simple in nature and succeed primarily because
of the lack of adequate detection and security measures in
organisations.
In particular, the Mandiant report on what became known
as their ‘APT1’ espionage attack received much publicity. [108]
See the factsheet ‘Persistence pays off (APT)’ from the NCSC
and the General Intelligence and Security Service (AIVD) for
[35: NCSC 2013-2]
more information.
The summary on page 45 gives an indication of the scope and
diversity of digital (espionage) attacks. [109] The information comes
from open sources and is expressly not an exhaustive summary.
Given certain similar features, some campaigns may describe the
same attack. The data stated refers to the first publication in open
sources and therefore not the ‘start date’ of the attack. In some
cases, this is months or even years earlier.
Theft of information for financial gain
Criminals steal information to cause harm to others or to put others
under pressure (blackmail). The information acquired (for example
user names and passwords) can also serve as a tool for manipulation
or information.
Theft of information often originates from malware-infected
computers that may possibly form part of a botnet. The computers
in a botnet send the captured information to a central computer.
In December 2012, the NCSC received information from the investiga-
44