Friday

23rd Jun 2017

Opinion

Cyber threats are inevitable, paralyzing impact is not

  • Ransomware works by infecting a machine, encrypting its hard drive and then displaying a message that promises functionality will be returned to normal upon payment of a fee. (Photo: Pixabay)

Ten years ago, almost to the day, Estonia came under sustained cyberattacks, which targeted our banks, media and government.

While the attacks themselves ultimately proved merely a nuisance, they raised global awareness of the vulnerabilities networked societies face and put a new, fundamental security challenge on the global agenda.

Over 200,000 victims in more than 150 countries across the globe have recently been hit by perhaps the most significant global cyberattack to date. Among them were hospitals in the UK, which had to cancel medical procedures, and large corporations such as Telefonica and Renault-Nissan.

Ransomware attacks like the WannaCry campaign have been a growing problem for several years.

They work by infecting a machine, encrypting its hard drive and then displaying a message that promises functionality will be returned to normal upon payment of a fee – in this case 300-600 dollars per system.

When it hits unprepared organisations, a cyberattack can bring mission-critical operations to a standstill.

While ransomware can sometimes be removed, the only solution is often to wipe the affected machines and revert to a backup, if one exists.

Otherwise, data could be lost forever, as there are still no reliable reports of data recovery from systems encrypted with the WannaCry ransomware.

The events over the past two weeks have highlighted our collective reliance on the digital domain, but they have also shown its vulnerabilities.

In general, a digital way of life does not necessarily carry with it greater risks, but it is different from paper-based bureaucracies.

No victims in Estonia

Yet vulnerability does not inevitably mean compromise. This particular attack could easily have been avoided by basic security practices, such as replacing out-dated software and installing critical updates.

Indeed, some countries were not seriously impacted. In fact, no Estonian computer or system fell victim to this attack. And part of the reason was preparedness.

Estonian authorities have been working for several years to raise awareness of the risks of ransomware – by not updating systems, addressing vulnerabilities and implementing baseline security standards.

The healthcare sector, in particular, has been a focus of improving IT management routines.

Furthermore, the risks and vulnerabilities – and ways of avoiding or mitigating them – must be driven home to anyone who owns or manages an information system or computer network, however small.

The Estonian example is encouraging.

For instance, when Windows XP – the no-longer-supported Microsoft operating system, at the heart of the ransomware attacks – was about to become obsolete in 2013, a well-targeted public awareness campaign almost halved the number of Estonians using it.

Nevertheless, there are still no grounds for complacency. Further cyberattack campaigns may exploit different vulnerabilities, and there is no silver bullet to prevent them.

Any comprehensive approach must address the full range of activities from prevention and awareness to response and recovery, while also ensuring that the malicious actors (“bad guys”) behind a cyberattack are discovered, apprehended and deterred in the future.

Cyber security, simply put, is too fundamental to everyday life to be left up to technology experts or particular national authorities.

A sustainable solution is possible, but only through intense international cooperation: no nation can be truly isolated in cyberspace, therefore going it alone is not an option.

Potential for Europe

We see a major European role in every step along the way.

First of all, Europe can contribute to preventing such attacks from occurring in the future.

Currently being transposed into domestic law, the EU directive on Network and Information Security (NIS) requires providers of essential services – including healthcare and transport – to follow certain best practices and implement baseline security standards on their systems.

A cooperation group of national authorities responsible for cyber security will coordinate national cyber standards and rules, and focus, in particular, on cross-border vulnerabilities and dependencies in vital services.

While awareness about cybercrimes has increased as a result of recent wide-impact incidents, a lack of basic check ups still enables crimes such as ransomware.

The EU agency for law enforcement training (Cepol) already provides education on ransomware for European law enforcement authorities. Awareness campaigns for law enforcement, businesses, and citizens more broadly, have also been quite effective.

When large-scale attacks do occur, the response from public authorities must be swift and coordinated. Timely international and cross-sector sharing of alerts and operational information can slow the spread of such attacks. Joint campaigns and responses are even more effective.

In February of this year, the Maltese rotating EU Council presidency launched the work of the European Computer Security Incident Response Team (CSIRT) network, tasked with ensuring the seamless cooperation of national cyber incident response teams in the EU.

The CSIRT network will reach full operational readiness in 2018, and should facilitate the sharing of information between EU member states.

The WannaCry ransomware case is certainly accelerating the process and provides a first test to the partners.

Identify and capture

After an attack, we must identify and capture the cyber criminals behind it.

The EU's police agency, Europol, already coordinates active cooperation between European law enforcement with partners beyond Europe and, in particular, provides a suite of tools to help victims of ransomware to decrypt their files.

Furthermore, the European Commission is to propose EU-level action for better cooperation on the exchange of electronic evidence, which would reinforce the ability of law enforcement and prosecutors to identify and prosecute criminals.

To enable a smoother transfer of evidence in criminal investigations between the member states, it is also crucial that the European Investigation Order directive is efficiently transposed into national legislation by all countries involved. The deadline for implementing the directive was 22 May 2017.

While the WannaCry attack appears to be criminal in nature, state actors are often involved in the activities of cyber criminals. Where this is the case, the EU should respond appropriately.

Last year, the Dutch EU Council presidency began work on an EU joint-diplomatic response to state-sponsored malicious cyber activity, which could include sanctions.

The EU will also begin several new initiatives this year when Estonia assumes the EU Council presidency for second half of the year.

In the autumn, the EU Commission will update the 2013 EU Cyber Security strategy. The new document should consolidate the work done on European and national levels, and ensure that the whole activity adds up to more than just the sum of its parts.

We also expect a proposal on European cyber security labelling and certification, which should make it easier for consumers and companies to make cyber-aware purchases and put market pressure on businesses to produce and offer more secure services and products.

Along with the updated strategy, we will begin work on revising the mandate of The European Union Agency for Network and Information Security (Enisa) – Europe’s cybersecurity agency.

Playing a central role in the implementation of NIS Directive, the agency is to provide a common threat landscape, coordinate the activities of member states and enhance the platform for information exchange. These, altogether, foster an environment in which all nations are more ready to counter cyber threats.

No choice left

Cyber security is a question of a way of life. Europeans are used to the benefits and advantages of digital services and the availability of electronic networks.

Nations have no choice but to build up robust cyber security measures – reverting to a paper-based system would not be more secure, is as prohibitively expensive as it is impractical, and would rob us of the conveniences we currently enjoy.

The almost-crippling WannaCry campaign highlighted the immediacy of truly international and cross-sector solutions. Cyber security is not simply the prerogative of a narrow range of technical experts or particular agencies.

As said previously, Estonia will hold the rotating presidency of the Council of the EU in the second half of this year.

We believe that the Digital Single Market and the free movement of data within the EU are of existential importance for Europe – we must keep pace with technological chances, and growing markets in America and Asia.

We cannot allow the fear of cyber attacks to slow us down, but we also have to invest the political effort and necessary capital to make sure that Europe can keep its citizens safe and its businesses secure.

Taimar Peterkop is the director general of the Estonian Information System Authority

Investigation

French election faces high cyber threat

French president Francois Hollande has called for "all necessary means" to be used to fend off cyber attacks ahead of the presidential election in April and May. But political parties are still vulnerable.

US neo-Nazis linked to Macron hack

The spread of stolen emails designed to harm Emmanuel Macron was linked to US-based neo-Nazis, according to a French investigation.

Investigation

Lessons for Germany from the Macron hack

The way the Macron team defended itself against hackers contained lessons for other political parties in Europe, but experts do not agree whether Russia did it.

A positive agreement for Greece

The outcome of the Eurogroup meeting this week leaves a positive footprint, setting the basis for the Greek economy to exit the vicious circle of austerity and debt.

Are MEPs too 'free' to be accountable?

The European Parliament is currently fine-tuning its negotiating position on the Commission's proposal from September 2016 for a mandatory transparency register. Sadly, so far it seems to prefer empty statements to bold action.

News in Brief

  1. Juncker has 'no' clear idea of kind of Brexit UK wants
  2. Belgian PM calls May's proposal on EU citizens 'vague'
  3. UK lacks support of EU countries in UN vote
  4. Spain to command anti-smuggler Mediterranean force
  5. Estonia confirms opposition to Nord Stream 2 pipeline
  6. Ireland and Denmark outside EU military plan
  7. EU leaders renew vows to uphold Paris climate deal
  8. US issues warrant for VW managers, German media say

Stakeholders' Highlights

  1. EGBAOnline Gambling: The EU Court Rejects Closed Licensing Regimes In Member States
  2. World VisionFaces of Today, Leaders of Tomorrow: Join the Debate on Violence Against Girls - 29 June
  3. ECR GroupThe EU Must Better Protect Industry from Unfair Competition
  4. Malta EU 2017Better Protection for Workers From Cancer-Causing Substances
  5. EPSUAfter 9 Years of Austerity Europe's Public Sector Workers Deserve a Pay Rise!
  6. Dialogue PlatformGlobalised Religions and the Dialogue Imperative. Join the Debate!
  7. UNICEFEU Trust Fund Contribution to UNICEF's Syria Crisis Response Reaches Nearly €200 Million
  8. EUSEW17Bringing Buildings Into the Circular Economy. Discuss at EU Sustainable Energy Week
  9. European Healthy Lifestyle AllianceCan an Ideal Body Weight Lead to Premature Death?
  10. Malta EU 2017End of Roaming Charges: What Does It Entail?
  11. World VisionWorld Refugee Day, a Dark Reminder of the Reality of Children on the Move
  12. European Social Services ConferenceDriving innovation in the social sector – 26-28 June

Stakeholders' Highlights

  1. Dialogue PlatformMuslims Have Unique Responsibility to Fight Terror: Opinon From Fethullah Gülen
  2. EUSEW17Check out This Useful Infographic on How to Stay Sustainable and Energy Efficient.
  3. Counter BalanceEuropean Parliament Criticises the Juncker Plan's Implementation
  4. The Idealist QuarterlyDoes Europe Really Still Need Feminism? After-Work Chat on 22 June
  5. EUSEW17Create an Energy Day Event Before the End of June. Join the Call for Clean Energy
  6. UNICEF1 in 5 Children in Rich Countries Lives in Relative Income Poverty, 1 in 8 Faces Food Insecurity
  7. International Partnership for Human Rights26 NGOs Call on Interpol Not to Intervene Versus Azerbaijani Human Rights Defenders
  8. Malta EU 2017Significant Boost in Financing for SMEs and Entrepreneurs Under New Agreement
  9. World VisionYoung People Rise up as EU Signs Consensus for Development at EU Development Days
  10. ILGA-EuropeLGBTI Activists and Businesses Fighting Inequality Together
  11. Nordic Council of MinistersNordic Prime Ministers Respond to Trump on Paris Agreement
  12. European Healthy Lifestyle AllianceNutrition and Heart Disease: Time to Raise Our Standards