Tuesday

19th Mar 2024

Opinion

Cyber threats are inevitable, paralysing impact is not

  • Ransomware works by infecting a machine, encrypting its hard drive and then displaying a message that promises functionality will be returned to normal upon payment of a fee. (Photo: Pixabay)

Ten years ago, almost to the day, Estonia came under sustained cyberattacks, which targeted our banks, media and government.

While the attacks themselves ultimately proved merely a nuisance, they raised global awareness of the vulnerabilities networked societies face and put a new, fundamental security challenge on the global agenda.

Read and decide

Join EUobserver today

Get the EU news that really matters

Instant access to all articles — and 20 years of archives. 14-day free trial.

... or subscribe as a group

Over 200,000 victims in more than 150 countries across the globe have recently been hit by perhaps the most significant global cyberattack to date. Among them were hospitals in the UK, which had to cancel medical procedures, and large corporations such as Telefonica and Renault-Nissan.

Ransomware attacks like the WannaCry campaign have been a growing problem for several years.

They work by infecting a machine, encrypting its hard drive and then displaying a message that promises functionality will be returned to normal upon payment of a fee – in this case 300-600 dollars per system.

When it hits unprepared organisations, a cyberattack can bring mission-critical operations to a standstill.

While ransomware can sometimes be removed, the only solution is often to wipe the affected machines and revert to a backup, if one exists.

Otherwise, data could be lost forever, as there are still no reliable reports of data recovery from systems encrypted with the WannaCry ransomware.

The events over the past two weeks have highlighted our collective reliance on the digital domain, but they have also shown its vulnerabilities.

In general, a digital way of life does not necessarily carry with it greater risks, but it is different from paper-based bureaucracies.

No victims in Estonia

Yet vulnerability does not inevitably mean compromise. This particular attack could easily have been avoided by basic security practices, such as replacing out-dated software and installing critical updates.

Indeed, some countries were not seriously impacted. In fact, no Estonian computer or system fell victim to this attack. And part of the reason was preparedness.

Estonian authorities have been working for several years to raise awareness of the risks of ransomware – by not updating systems, addressing vulnerabilities and implementing baseline security standards.

The healthcare sector, in particular, has been a focus of improving IT management routines.

Furthermore, the risks and vulnerabilities – and ways of avoiding or mitigating them – must be driven home to anyone who owns or manages an information system or computer network, however small.

The Estonian example is encouraging.

For instance, when Windows XP – the no-longer-supported Microsoft operating system, at the heart of the ransomware attacks – was about to become obsolete in 2013, a well-targeted public awareness campaign almost halved the number of Estonians using it.

Nevertheless, there are still no grounds for complacency. Further cyberattack campaigns may exploit different vulnerabilities, and there is no silver bullet to prevent them.

Any comprehensive approach must address the full range of activities from prevention and awareness to response and recovery, while also ensuring that the malicious actors (“bad guys”) behind a cyberattack are discovered, apprehended and deterred in the future.

Cyber security, simply put, is too fundamental to everyday life to be left up to technology experts or particular national authorities.

A sustainable solution is possible, but only through intense international cooperation: no nation can be truly isolated in cyberspace, therefore going it alone is not an option.

Potential for Europe

We see a major European role in every step along the way.

First of all, Europe can contribute to preventing such attacks from occurring in the future.

Currently being transposed into domestic law, the EU directive on Network and Information Security (NIS) requires providers of essential services – including healthcare and transport – to follow certain best practices and implement baseline security standards on their systems.

A cooperation group of national authorities responsible for cyber security will coordinate national cyber standards and rules, and focus, in particular, on cross-border vulnerabilities and dependencies in vital services.

While awareness about cybercrimes has increased as a result of recent wide-impact incidents, a lack of basic check ups still enables crimes such as ransomware.

The EU agency for law enforcement training (Cepol) already provides education on ransomware for European law enforcement authorities. Awareness campaigns for law enforcement, businesses, and citizens more broadly, have also been quite effective.

When large-scale attacks do occur, the response from public authorities must be swift and coordinated. Timely international and cross-sector sharing of alerts and operational information can slow the spread of such attacks. Joint campaigns and responses are even more effective.

In February of this year, the Maltese rotating EU Council presidency launched the work of the European Computer Security Incident Response Team (CSIRT) network, tasked with ensuring the seamless cooperation of national cyber incident response teams in the EU.

The CSIRT network will reach full operational readiness in 2018, and should facilitate the sharing of information between EU member states.

The WannaCry ransomware case is certainly accelerating the process and provides a first test to the partners.

Identify and capture

After an attack, we must identify and capture the cyber criminals behind it.

The EU's police agency, Europol, already coordinates active cooperation between European law enforcement with partners beyond Europe and, in particular, provides a suite of tools to help victims of ransomware to decrypt their files.

Furthermore, the European Commission is to propose EU-level action for better cooperation on the exchange of electronic evidence, which would reinforce the ability of law enforcement and prosecutors to identify and prosecute criminals.

To enable a smoother transfer of evidence in criminal investigations between the member states, it is also crucial that the European Investigation Order directive is efficiently transposed into national legislation by all countries involved. The deadline for implementing the directive was 22 May 2017.

While the WannaCry attack appears to be criminal in nature, state actors are often involved in the activities of cyber criminals. Where this is the case, the EU should respond appropriately.

Last year, the Dutch EU Council presidency began work on an EU joint-diplomatic response to state-sponsored malicious cyber activity, which could include sanctions.

The EU will also begin several new initiatives this year when Estonia assumes the EU Council presidency for second half of the year.

In the autumn, the EU Commission will update the 2013 EU Cyber Security strategy. The new document should consolidate the work done on European and national levels, and ensure that the whole activity adds up to more than just the sum of its parts.

We also expect a proposal on European cyber security labelling and certification, which should make it easier for consumers and companies to make cyber-aware purchases and put market pressure on businesses to produce and offer more secure services and products.

Along with the updated strategy, we will begin work on revising the mandate of The European Union Agency for Network and Information Security (Enisa) – Europe’s cybersecurity agency.

Playing a central role in the implementation of NIS Directive, the agency is to provide a common threat landscape, coordinate the activities of member states and enhance the platform for information exchange. These, altogether, foster an environment in which all nations are more ready to counter cyber threats.

No choice left

Cyber security is a question of a way of life. Europeans are used to the benefits and advantages of digital services and the availability of electronic networks.

Nations have no choice but to build up robust cyber security measures – reverting to a paper-based system would not be more secure, is as prohibitively expensive as it is impractical, and would rob us of the conveniences we currently enjoy.

The almost-crippling WannaCry campaign highlighted the immediacy of truly international and cross-sector solutions. Cyber security is not simply the prerogative of a narrow range of technical experts or particular agencies.

As said previously, Estonia will hold the rotating presidency of the Council of the EU in the second half of this year.

We believe that the Digital Single Market and the free movement of data within the EU are of existential importance for Europe – we must keep pace with technological chances, and growing markets in America and Asia.

We cannot allow the fear of cyber attacks to slow us down, but we also have to invest the political effort and necessary capital to make sure that Europe can keep its citizens safe and its businesses secure.

Taimar Peterkop is the director general of the Estonian Information System Authority

Disclaimer

The views expressed in this opinion piece are the author's, not those of EUobserver.

Investigation

French election faces high cyber threat

French president Francois Hollande has called for "all necessary means" to be used to fend off cyber attacks ahead of the presidential election in April and May. But political parties are still vulnerable.

US neo-Nazis linked to Macron hack

The spread of stolen emails designed to harm Emmanuel Macron was linked to US-based neo-Nazis, according to a French investigation.

Investigation

Lessons for Germany from the Macron hack

The way the Macron team defended itself against hackers contained lessons for other political parties in Europe, but experts do not agree whether Russia did it.

Latest News

  1. Borrell: 'Israel provoking famine', urges more aid access
  2. Europol: Israel-Gaza galvanising Jihadist recruitment in Europe
  3. EU to agree Israeli-settler blacklist, Borrell says
  4. EU ministers keen to use Russian profits for Ukraine ammo
  5. Call to change EIB defence spending rules hits scepticism
  6. Potential legal avenues to prosecute Navalny's killers
  7. EU summit, Gaza, Ukraine, reforms in focus this WEEK
  8. The present and future dystopia of political micro-targeting ads

Stakeholders' Highlights

  1. Nordic Council of MinistersJoin the Nordic Food Systems Takeover at COP28
  2. Nordic Council of MinistersHow women and men are affected differently by climate policy
  3. Nordic Council of MinistersArtist Jessie Kleemann at Nordic pavilion during UN climate summit COP28
  4. Nordic Council of MinistersCOP28: Gathering Nordic and global experts to put food and health on the agenda
  5. Friedrich Naumann FoundationPoems of Liberty – Call for Submission “Human Rights in Inhume War”: 250€ honorary fee for selected poems
  6. World BankWorld Bank report: How to create a future where the rewards of technology benefit all levels of society?

Stakeholders' Highlights

  1. Georgia Ministry of Foreign AffairsThis autumn Europalia arts festival is all about GEORGIA!
  2. UNOPSFostering health system resilience in fragile and conflict-affected countries
  3. European Citizen's InitiativeThe European Commission launches the ‘ImagineEU’ competition for secondary school students in the EU.
  4. Nordic Council of MinistersThe Nordic Region is stepping up its efforts to reduce food waste
  5. UNOPSUNOPS begins works under EU-funded project to repair schools in Ukraine
  6. Georgia Ministry of Foreign AffairsGeorgia effectively prevents sanctions evasion against Russia – confirm EU, UK, USA

Join EUobserver

EU news that matters

Join us