third Cyber Security Assessment Netherlands - NCSC

Summary
The National Cyber Security Centre (NCSC) publishes
an annual Cyber Security Assessment Netherlands (CSAN)
in close collaboration with public and private parties.
The CSAN is published for policy-makers in government
and vital sectors, who use it for the insights it offers into
developments, for assessing possible measures for
increasing the digital resilience of the Netherlands,
and for improving current cyber security programmes.
CSAN-3 covers the period April 2012 to March 2013 but
also includes important developments up to the start
of May 2013.
Information Technology (IT) today is woven closely into society
and thus forms an important part of our daily lives. Access to the
internet is currently embedded in all sorts of devices: computers
and telephones, of course, but also cars, televisions, thermostats,
weighing scales and so on. This ever-increasing digitalisation
is not just for our comfort and pleasure, it is an important
driver of innovations that increase productivity and enhance
economic growth.
The risks attached to digitalisation have become all too apparent,
partly due to various incidents in the past year. IT is often vulnerable.
The way digitally stored or exchanged information is handled
gains importance every day. It makes IT and confidential information
an interesting target for people with malicious intentions,
from the criminal world right up to governments. The incidents that
took place show that many organisations do not have the digital
resilience at the level required for the risks involved. Cyber security
has therefore increasing importance.
Core findings
The most important findings of CSAN-3 are as follows:
1. Several trends show considerable IT dependence, rising fast due
to advances such as hyperconnectivity, cloud computing and the
ease with which the internet is used as an enabler. The potential
impact of incidents occurring is all the more obvious.
2. Digital espionage and cyber crime remain the biggest threats to
both government and the business community. This concerns:
a) Digital espionage originating from a foreign state, aimed
at government and the business community. Activities have
been identified originating from, among other countries,
China, Russia, Iran, and Syria.
b) IT takeovers by criminals by means of malware infections,
aimed at government, the business community and
citizens. Criminals are becoming more daring in their ways
of earning money quickly, for example, phoning citizens,
or confronting them with shocking images in ransomware.
c) Manipulation of information (fraud) by criminals, aimed
at the business community, most obviously internet
banking fraud, which victimises both banks and citizens.
3. States can develop and deploy advanced tools, while cyber
criminals continue to develop their existing tools. Clearly visible
in the past year has been the rise of a commercially available
cyber services sector, ‘cyber crime as a service’, which offers far
easier access to criminal tools to various parties.
4. Citizens, businesses, and governments alike are regular victims
of botnets and ransomware. Malware can mutate so quickly
that anti-virus programs are unable to even detect its presence.
Although botnets are mainly used to manipulate (financial)
transactions, certain incidents (such as Pobelka) show that
the collateral damage of information stolen through botnets
can be enormous.
5. The IT sector continues to be vulnerable. Following a few years
of reduced levels, the number of openly published vulnerabilities
in software is increasing again. Cloud services, mobile
services and innovative devices all result in new vulnerabilities.
6. The end-user is burdened with a big responsibility for security,
but more often than not has little influence or even knowledge
of the vulnerabilities he confronts in the devices and services.
7. Public and private parties are starting up initiatives, both
separately and together, to increase digital resilience and
in anticipation of the ever-increasing dependence on IT and
changing threats. The effectiveness of these initiatives can only
be measured in the long term.
8. Disruption in the IT sector is displayed publicly, particularly
when it comes from Distributed Denial of Service (DDoS)
attacks. Resilience has been inadequate at times, which led
to a decline in the availability of online services provided
by organisations. In addition, DDoS attacks disrupted basic
services such as DigiD and iDeal, and this had a chain effect
7