BIGGEST THREAT to Europe’s Cybersecurity ? Hint: Not Hackers !

Forget Cyber-Espionage, Cyber-Warfare and Cyber-Terrorism. The Biggest Threat to Europe’s Infrastructure Cybersecurity are Power Outages and Poor Communication. On Thursday, ENISA (European Network and Information Security Agency) Held its Biggest Ever Cybersecurity Exercise Involving More than 200 Organizations and 400 Cyber-Security Professionals from 29 European Countries. The Bi-Annual Event* Simulates a Lifelike Attack, Modelled on Real Events, to Test the Reaction of National 'Computer Emergency Response Teams' (CERTS), Government Ministries, Telco Companies, Energy Companies, Financial Institutions and Internet Service Providers. But, Steve Purser, Head of Operations at ENISA Explained: “The biggest threats we really see are not attacks but, hardware and software failures”. #CyberEurope2014 will Simulate More than 2,000 Separate Cyber-Incidents, including Denial of Service (DDoS) Attacks, Website Defacements, Exfiltration of Sensitive Information and Attacks on Critical Infrastructure.


Purser Says he’s Confident that, they are Testing the Right Things. “I speak at a lot of events and there are a lot of glib comments from people saying we need to share more data. But, actually we need to share LESS data. We live in an age of data pollution and we need to discuss the right things at the right level.” This Would Appear to Include a Standard Array of Attacks that Systems Need to be Tested against but, Nothing Particularly Tricky such as Exploitation of Unpatched Vulnerabilities, Custom Malware, Data Contamination or Social Engineering. The Distributed Exercise, Involving Several Exercise Centres across Europe Working with a Central Exercise Control Centre, is Designed to Test EU Cooperation and Escalation Procedures. The Exercise will also Test Out the EU-Standard Operational Procedures, a Set of Guidelines to Share Operational Information on Cyber Crisis. In the Case of the Spanish Military, at least, the Exercise Involves Military Personnel in Camouflage Uniforms Crowded Together around Laptops and Wide Screens in a Crowded Room on the Outskirts of Madrid. A Picture by OneMagazine Illustrates the Claustrophobic Scene, seemingly Devoid of Tapas, Cafe or Other Spanish Essentials. Last Year Global Web-Based Attacks Increased by Almost a Quarter and the Total Number of Data Breaches was 61% Higher than 2012 according to Symantec’s Intelligence Report.


Each of the 8 Top Data Breaches Resulted in the Loss of 10s of Millions of Data Records while 552 Million Identities were Exposed. Meanwhile, ENISA’s Threat Landscape Report Says that, Threat Agents Have Increased the Sophistication of their Attacks and their Tools and Multiple Countries Have Developed Capabilities that Can be Used to Infiltrate All Kinds of Targets, Governmental and Private. The Proposed EU Network and Information Security Directive, (a.k.a. the Cybersecurity Directive) Aims to Address these Problems. The Draft Law is currently Being Discussed by National Representatives, the European Parliament and the European Commission. Some Elements of the Original Law Have already been Substantially Watered Down. Originally “Key Internet Enablers" Faced Mandatory Security Breach and Incident Notification Requirements but, this was Changed by the European Parliament and the Provision Now Applies Only to “market operators who provide critical infrastructure”. Who and What these Market Operators are, is Vaguely Worded and a Cause for Dispute between Member States at the Negotiating Table. “Member states deal with critical infrastructure in different ways - some are asset based, some process based and the challenge is to put those together. It’s a complex situation”, Said Purser Adding that, Events like CyberEurope2014 Help to Identify Weaknesses. He Believes the Proposed Directive is a Step in the Right Direction: National Governments Would still be Required to Appoint a Competent Central Authority and Develop a National Cybersecurity Strategy. These National Authorities would be Required to Liaise with ENISA and an EU-wide “Cooperation Network”. Professor Udo Helmbrecht, Executive Director of ENISA, Commented: “Five years ago there were no procedures to drive cooperation during a cyber-crisis between EU Member States. Today we have the procedures in place collectively to mitigate a cyber-crisis on European level. The outcome of today’s exercise will tell us where we stand and identify the next steps to take in order to keep improving”.


However there is Considerable Resistance from Some National Representatives to Mandatory Sharing of Information between Countries as Envisaged in the Current Draft Law. Some Countries Fear Giving Away Too Much Information to Subjecting Companies to “Reputational Damage”. Based on Previous CyberEurope Events, Purser Thinks that, those Involved are Getting Better at Sharing Information and he was Keen to Stress that “we are not talking about industrial espionage, which I think is a false debate. [ENISA] is not interested in handling national security information. But, exercises like this provide valuable bottom-up knowledge behind the policy”. ENISA will Produce a Report on its Findings from Thursday’s Exercise by the End of the Year, while the Next Discussion between National Representatives on the Cybersecurity Directive will Take Place on November 27.


*Cyber Europe actually Takes Place in 3 Phases throughout the Year: Technical – which Involves the Incident Detection, Investigation, Mitigation and Information Exchanges (Completed in April); Operational / Tactical – Dealing with Alerting, Crisis Assessment, Cooperation, Coordination, Tactical Analysis, Advice and Information Exchanges at Operational Level (Today and Early 2015) and Strategic, which Examines Decision Making, Political Impact and Public Affairs. Thursday's Activities Form the Main Part of the Whole Exercise. ENISA Promises that, the Exercise Won't Affect Critical Information Infrastructures, Systems, or Services.




Info Sources:

http://www.onemagazine.es/noticia/20195/Industria/El-mayor-ejercicio-de-ciberseguridad-jamas-realizado-hoy-en-Europa.html

https://www.enisa.europa.eu/media/press-releases/biggest-ever-cyber-security-exercise-in-europe-today