Magazine menu Close Magazine menu

global

Latest stories

One click to attack critical infrastructure: What can we do?

  • min read
    • Growing digitalization in the industrial sector makes attacking critical infrastructure (CI) easy for cybercriminals. For example, ransomware attacks on critical sectors hit headlines in 2021. But what can we do about it? Can the international community cooperate across borders to respond fast and effectively? I've written before on how the world could improve its cross-border firefighting. Now there's a new UN cyber dialog with diplomats from 193 countries getting together to discuss using information and communication technologies (ICTs) for cyber stability, security and peace. And we may now be a step closer to a solution. Kaspersky organized the workshop, One click to attack critical infrastructure: What can we do? at the 2021 UN Internet Governance Forum (IGF) with experts from cyber diplomacy, cybersecurity research and incident response worldwide. Many national perspectives We looked at national approaches and existing good practice in critical infrastructure protection and heard how states implement the UN cyber agreements and critical infrastructure protection norms. Germany: Cyber protection is a whole-of-society issue Ambassador Regine Grienberger (@GERonCyber) of Germany's Federal Foreign Office said Germany's approach to critical infrastructure protection is whole-of-government and whole-of-society. Close public-private cooperation with sharing information and lessons learned are essential parts of it. Ambassador Grienberger says, "In Germany, we've built a national framework for critical infrastructure protection, which is embedded in the legal framework at European Union level and complemented by our cooperation with our international partners. Lack of human resources remains a serious challenge. We need greater investments in cyber capacity building." Switzerland: Sharing responsibility Daniel Klingele, Senior Advisor at Switzerland's International Security Division of the Federal Department of Foreign Affairs, said cost of regulatory action versus incentives, decentralized structure of responsibilities and building an inventory of critical functions all guide their regulatory approach. Mr. Klingele also thinks it's important to focus on public-private partnerships to ensure a shared responsibility, but critical infrastructure operators must also understand their responsibilities to manage cyber risks. Singapore: Three areas for international cooperation Dan Yock Hau is Assistant Chief Executive for National Cyber Resilience at Singapore's Cyber Security Agency. Mr. Dan highlights three areas for international cooperation: Consensus (states agreeing on 'rules of the road',) collaboration (keeping digital domain safe and secure through effective collaboration and partnerships) and capabilities (investing in capacity building to spearhead a systemic response to cybersecurity.) Mr. Dan believes governments should lead in strengthening cooperation because the weakest link can provide an entry point to a system but also risk to other countries. He says, "Cyber threats are not confined within geographical boundaries. Bilateral, multilateral cooperation are key to share timely information and respond to incidents swiftly." Australia: Mandatory reporting requirements for operators Johanna Weaver (@_johannaweaver) Director of Tech Policy Design Centre, Australian National University, highlighted Australia's new legislation outlines mandatory reporting requirements for critical infrastructure operators and extends government powers to take control of infrastructure if there's a serious cyberattack. Ms. Weaver says governments and the private sector must have regularly tested plans for effective incident response. "All states have now agreed they should protect critical infrastructure and they are not going to intentionally damage other states' critical infrastructure using ICTs. But not enough countries are being transparent about the use and development of offensive cyber capabilities. Australia is among the few countries that publicly commit that we are not going to use these to damage other states' critical infrastructure." A UN cyber emergency phonebook? We also explored the idea of a UN 'cyber emergency phonebook' in our workshop. If an attacked state can't respond and protect itself, who should it ask for help? And where a cyberattack affects critical infrastructure in several jurisdictions, how should cross-border cooperation happen? Serge Droz, Board of Directors at Forum of Incident Response and Security Teams (FIRST,) said most incident response teams run into limits handling incidents and don't have access to infrastructure operated by third parties. Mr. Droz says the international community should invest in developing trusted relationships, but trust is hard to institutionalize. Regular collaboration helps, and trust between individuals spreads further into teams. Mr. Droz also highlighted the importance of neutrality in Computer Emergency Response Teams (CERTs.) "CERTs' key role is to respond to incidents. They shouldn't be party to other activity like attribution or using offensive capabilities. Focusing on their role is key to ensuring their neutrality during a cyber emergency." Carmen Corbin, Head of Counter Cybercrime Programming for West and Central Africa, UN Global Programme on Cybercrime (UNODC,) agreed with Mr. Droz and added the need to keep an ongoing focus on capacity building and training in helping states be more effective in protecting critical infrastructure. "Experiencing cyber emergencies together helps experts and communities build closer and trusted relationships." Pierre Delcher, Senior Security Researcher at Kaspersky, said multiple factors trigger cooperation – like common values, shared commitments and compatible capabilities – but trust underpins it all. He believes continuous collaboration and experiencing common events develops trust. "Cybersecurity incidents are usually global, but the response, almost never. Cross-border cooperation should bring better results," says Mr. Delcher. "An emergency phonebook may be a good start. It could be done through existing cooperation mechanics." What should happen next? We're not alone in the wilderness when dealing with critical infrastructure incidents. Since 1998, states have talked about working with ICTs in the interests of peace and security. The new five-year long round of the UN cyber dialog continues soon. Hopefully the international community will have new practical achievements even sooner.
global cyberincident response

How the world could improve its cross-border cyber firefighting

  • min read
    • If a cyberattack knocked out the energy grid or hospital in your town, you'd expect a fast response. You'd perhaps imagine critical infrastructure operators, computer emergency response teams and cybersecurity vendors would coordinate, exchanging information and helping victims. But today, global cross-border coordination mechanisms for a major attack on critical infrastructure aren't there yet. In the event of an attack, those affected tend to look around for the right person to call and ask for help, delaying response and putting users and cyber stability at greater risk. What can be done about this lack of a system? What's been achieved so far? We're not entirely alone in the wilderness when dealing with critical infrastructure incidents. Since 1998, states have been talking about working with information and communication technology in the interests of peace and security. Countries have agreed on three international documents that pave the way for a global response to a critical infrastructure attack. The 2015 UN Group of Governmental Experts (GGE) report includes non-binding norms for critical infrastructure protection and asks governments to "take appropriate measures to protect their critical infrastructure from ICT threats." It also promotes assisting victim states. The 2021 UN Open-Ended Working Group (OEWG) consensus report recommends states "consider nominating a national Point of Contact (PoC) at technical, policy and diplomatic levels." In the advance copy of the 2021 GGE report, 25 government experts elaborate on how to implement norms, including on critical infrastructure protection and assistance. States also clarify how Points of Contact (PoCs) can work. With these steps, the global community has a good base for developing a global incident response. But it's important to start implementing these agreements while clarifying what victims should and shouldn't do, the private sector's role and how any party should gather and exchange information for incident response and mitigation. High on the cyber expert agenda Experts have been discussing improving global response mechanisms, for example, at the world cybersecurity conference, RSA, in 2021. One RSA Conference session saw experts from INTERPOL, the global Forum of Incident Response and Security Teams (FIRST) and Switzerland's Federal Department of Foreign Affairs (FDFA) sharing views. Craig Jones, INTEROL's Director of Cybercrime, said information and communication technology incidents are underreported and under-investigated because there's no unified mechanism to inform everyone of an attack. Jones continued, "It's in everyone's interests to thoroughly investigate incidents and to gather and share as much information as possible." Despite the value of unified action, the current geopolitical situation contributes to a lack of information-sharing and low trust between states. Serge Droz, Chair of FIRST, says building trust in a difficult political environment can't be rushed. "Cybercriminals love 'divide and conquer.' That's why our biggest challenge is to decide how we'll all work better together." Building trust and cooperation between states Jon Fanzun, Special Envoy for Cyber Foreign and Security Policy at Switzerland's FDFA, spoke of what's needed for greater trust between states and between states and the private sector. The Geneva Dialogue on Responsible Behavior in Cyberspace, led by the Swiss FDFA and implemented by DiploFoundation, is an example of building greater trust and closer community. The dialogue shapes a joint vision of digital security and global policy processes for a trusted, secure and stable cyberspace. What should the mechanism be like? The mechanism should start by giving recommended technical and operational national Points of Contact (PoCs) in the event of an attack. These would serve as a 'final station' in reaching out to a national computer emergency response team, law enforcement agency or cybersecurity professionals to exchange technical information to help cross-border cooperation and incident response. How a global incident response mechanism might work There could be a three-step process in a scenario such as a country's energy grid being attacked. Step 1: National Points of Contact (PoCs) would facilitate further coordination with the country's other authorities, as they organize cyber exercises regularly and have developed incident notification cross-border procedures, tools and templates. Step 2: PoCs would connect the attacked energy grid with the software manufacturer and a cybersecurity company, and CERTs of the attacked country and software manufacturer's country. Step 3: PoCs would quickly exchange information on the threat and analyze and compare forensic samples to address the incident. This mechanism would ensure a timely and coordinated global response and mitigation, and enhance the global community's technical and operational capacities, contributing to cyber stability. There are encouraging signs like the UN open-ended working group on cyber and the sixth GGE process. It shows, despite confrontations in cyberspace, states want to keep up critical dialogue for cyber stability. For everyone else, including us at Kaspersky, it's important to follow these processes and engage proactively, supporting states with our expertise to help keep our shared cyberspace open, stable and secure.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries