third Cyber Security Assessment Netherlands - NCSC

By 2017 companies and citizens will be able to handle affairs with
the government – such as applying for a permit – digitally.
[45: Central government 2012]
What is important here is that citizens and
companies need to provide their details only once. [162]
6.3 The risk of far-reaching digitalisation
It is expected that in the future, there will be greater investment in
gaining insight into the available large volumes of data than in
obtaining this data. [16: IDC 2013] The most important developments and
associated risks are summarised below.
Internet of Things
Devices are increasingly connected to the internet and communicate
with one another to make the user’s life easier. Within one year,
billions of devices will exchange enormous volumes of information.
[6: Cisco 2011]
The Internet of Things has legal consequences. For
example, how will users’ privacy be handled? Who actually owns
all this information and who is liable if things go wrong? Important
questions arising from this are: Is it still possible to trace precisely
which device is generating what information? In addition, which
other device is using this information? Who is responsible for and
who manages this information?
Mobile devices
Smartphones or tablets often hold many users’ personal details,
such as e-mail, contacts, diaries, location details, credit card details,
photos, videos and log-in details. There are risks associated with
processing this data which threaten companies and users’ personal
privacy if the privacy legislation is not complied with. [163]
Privacy risks include an app, without the user knowing or having
consented, gaining access to personal details, saving information
on smartphones or tablets, sharing information regarding use with
third parties or sending unencrypted information over the internet.
There is also the risk that apps use a lot more data than they need to
operate to operate the app.
Users and the responsible people in organisations often have
virtually no idea of the risks. A game that in the background uploads
the contacts database? Follow the competitor’s sales staff thanks to
a free parking app? It is all possible. Shockingly easily, even. [164]
Big
The consumer-driven use of IT (consumerisation) also entails security
[30: NCSC 2012-1]
risks to which many organisations still have no answer.
162 http://ibestuur.nl/magazine/stef-blok-rijksoverheid-in-2017-volledig-digitaal
163 http://www.cbpweb.nl/Pages/pb_20130314-wp29-opinie-mobiele-apps.aspx
164 http://www.automatiseringgids.nl/achtergrond/2012/20/
apps-maken-bedrijfsspionage-gevaarlijk-simpel
165 http://venturebeat.com/2012/06/11/autonomy-big-data-infographic/
166 IBM: Understandig Big Data, http://www-01.ibm.com/software/data/bigdata/
167 http://www.emc.com/about/news/press/2013/20130226-02.htm
168 http://www.automatiseringgids.nl/nieuws/2013/08/big-data-helpt-criminaliteit-opsporen
data
Companies and governments are recording and collating increasing
volumes of data in systems for logging, data mining, marketing and
other purposes. This data is highly diverse and is both structured
and unstructured (for example e-mails, tweets and Facebook posts)
and there is often a huge volume of smaller datasets.
»»
To form a picture of our ‘compulsive hoarding’ below are some
[17: IDC 2012][165][166]
relevant figures with respect to big data.
»»
Between 2005 and 2020, the digital universe will grow by a factor
of 300, from 130 exabytes (1 exabyte = 1018 bytes) to 40,000
exabytes, equating to more than 5,200 gigabytes for every man,
woman and child in 2020.
»»
90 per cent of the data worldwide was produced in the past two
years and every day 2.2 million terabytes (1 terabyte = 1012 bytes)
of data are created.
»»
Between 10 and 20 per cent of the data worldwide is structured
data and between 80 and 90 per cent is unstructured data
(for example e-mails, tweets, Facebook posts, music and mobile
telephone conversations).
»»
The volume of unstructured data is growing at 15 times the rate
of structured data.
This unrestrained collation, storage and processing of data also
brings technical and social security challenges with it, while often
no effective security measures are integrated.
Big data is more than a question of storing a lot of data. It is a chance
to gain insight into this data, so that companies and governments
can respond more flexibly to new and relevant developments, and it
provides the opportunity to answer questions that previously could
not be answered. Using big data, criminal networks can be charted,
the reaction of these networks to various intervention strategies
can be recorded and potential cyber attacks can be predicted and
prevented. [167] In fact this is true not just of cyber crime but of
‘regular’ crime too. [168] However malicious attackers are also collating
more data to better get to know their (potential) victims and make
their attacks more effective.
Cloud
Cloud computing is a development that connects IT services through
the public internet and increasingly stores data and (possibly) is
used to process data in locations away from the organisation and the
owners’ influence.
Many organisations are investigating the opportunities to accommodate
their IT in the cloud, or are already doing it. Cloud is also
simple for individual employees to use. For example at work, data
can be put in the cloud and shared with colleagues or easily
accessed at home.
Cloud computing entails risks, including that access often has
restricted security and cloud providers retain all sorts of rights with
respect to use of the data [31: NCSC 2011] and cover this (semi) legally in
agreements. Housing information with a cloud provider also means
that public authorities and security services are able to call up this
76