third Cyber Security Assessment Netherlands - NCSC

car park will not open. It is annoying that staff and visitors have
to park somewhere else or that employees feel cold or hot, but it
generally does not mean anything worse than that.
Year # Reports # Investigations
2010 39 57
Local/Regional
2011 204 70
(for example traffic installations, sewer pump and
2012 138 89
bridge operation, individual windmills)
Digital incidents at this level can have a major impact, but the
Table 11. Developments in number of reports in the US
damage remains limited to a local or regional level and is primarily
practical and financial in nature. An example is a bridge that stays
opens so that traffic comes to a halt or a company that suffers major
financial harm because one of its factory’s systems fails bringing
production to a stop for a few days.
National
(vital infrastructure, for example the energy and
drinking water supply)
Digital incidents in the vital sectors may lead to social instability
and therefore affect national security. There could be many victims
and/or severe economic damage and recover may be lengthy, while
these products and services are essential. IT, telecommunications
(fixed and mobile) and electricity are crucial for society’s vital
sectors to function. Failure of these can lead to harmful effects in
other sectors and the impact of an incident may intensify even
further. These incidents are the most relevant to the CSAN because
they can have a direct impact on large groups of citizens, companies
The number of investigations continues to rise, which indicates
an increasing number of incidents. Based on the limited detailed
information about ICS-related incidents, these are ranked in the
three categories below.
Incidents caused by internet connectivity
Since 2011, various researchers have been focusing attention on
systems which, by using Shodan [219] and other search engines, can
be reached through the internet [220] . Smaller companies, local
authorities and private individuals in particular are not sufficiently
aware that their systems (generally SOHO and private applications)
are directly accessible on the internet. The combination of
vulnerabilities in the software and the use of weak passwords, etc.
means that in many cases unauthorised access can be obtained
to these systems. These vulnerabilities often arise because of
insufficient agreements regarding security with third parties taking
care of the installation and/or management.
and governments.
9.3 Incidents involving ICSs
Particularly at the beginning of 2012 there was increased focus on
the risks of connecting ICSs to the internet that resulted in many
It is impossible to provide proper statistics about ICS-related
incidents in the Netherlands. Organisations involved are still
reticent about sharing information on this subject. In the period
from June 2011 to November 2012, NCSC.nl received just 11 reports.
Because of this low number, the American ICS-CERT has been
reviewed as one of the few available public sources. Furthermore, a
public incident reports. All the reports concerned systems that
could be found through the internet using the Shodan search
engine. [221] Although this category of vulnerabilities attracts by far
the most attention and publicity, this is not where the biggest risks
to national security currently lies because the vast majority of these
fall in the SOHO category.
broad reporting period was assessed to give insight into the gradual
developments. The ICS-CERT annual overview with reports of
218 There is no report as to whether these are truly ICS incidents. Following investigation, it may
emerge that there was no security incident (simply a disruption) or that no ICS/SCADA was
involved. There may also have been multiple reports of the same incident.
219 SHODAN is an internet search engine that facilitates targeted searching of computers that are
connected to the internet.
220 Examples include: Eirann Leverett: http://www.blackhat.com/usa/speakers/Eireann-Leverett.
html, Project SHINE: http://ics-cert.us-cert.gov/pdf/ICS-CERT_Monthly_Monitor_Oct-
Dec2012.pdf and HD Moore: https://community.rapid7.com/community/metasploit/
blog/2013/04/23/serial-offenders-widespread-flaws-in-serial-port-servers
221 The (few) cases reported to the Netherlands because of these cases proved not to be related
to vital infrastructures.
96
Incidents caused by vulnerabilities in generic IT tools
(collateral damage category)
General IT tools, known as Commercial Off-The-Shelf (COTS)
products, are increasingly being used in IT environments. This
applies not just to hardware, but primarily also to software such as
operating systems, web technologies and databases. Use of these
COTS products undoubtedly has many advantages (such as lower
costs), but it also gives vulnerabilities in these products a stepping
stone to ultimately manipulate process controls. It also makes ICS
environments more susceptible to malware that is actually (only)
intended for standard IT facilities. For example outbreaks of the
computer worms Slammer and Conficker in factory networks meant
that production had to be halted. Key loggers, banking trojans and
other generic malware that unintentionally infect ICS environments
can also lead to failures.
Incidents caused by the ‘human factor’
Around half of the investigations cited by ICS-CERT relate to cases of
spear phishing, possibly with the intention of penetrating the ICS