Feeds

Europe UNDER ATTACK in simulated cyber security test

This is a drill. No networks will be harmed in this exercise

Top three mobile application threats

European banks teamed up with information security agencies and governments to run a DDoS cyber-attack preparedness exercise today.

Cyber Europe 2012, a simulated cyber security attack involving 300 cyber security professionals, is being co-ordinated by European Union security agency ENISA. It's the second exercise of its type, following the running of a similar pan-European simulated DDoS attack scenario two years ago. "Compared to the 2010 exercise, Cyber Europe 2012 has grown considerably in scope, scale and complexity," according to a statement by ENISA.

Four countries are observing the exercise and 25 countries are actively participating. Using the lessons learned from Cyber Europe 2010, the private sector (from finance, ISPs and eGovernment) is taking part for the first time. In the exercise, public and private participants across Europe will take action at the national level. At the same time, public participants will cooperate across borders.

The scenario for Cyber Europe 2012 combines several technically realistic threats into one simultaneously escalating Distributed Denial of Service (DDoS) attack on online services in all participating countries. This kind of scenario would disrupt services for millions of citizens across Europe.

The complexity of the scenario allows for the creation of enough cyber incidents to challenge the several hundred public and private sector participants from throughout Europe, while at the same time triggering cooperation. By the end of the exercise, the participants will have had to handle more than 1000 injects (simulated cyber incidents).

The exercise is designed so that it avoids affect real networks, systems or services.

Paul Lawrence, VP International Operations at Corero Network Security, praised the exercise as a useful step towards enabling government to work together with the private sector in coming up with best practice for repelling cyber-attacks.

"What is interesting about the ENISA’s 2012 attack scenario is that it will combine several technically realistic threats into one simultaneously escalating Distributed Denial of Service (DDoS) attack," Lawrence said. "This goes to show that DDoS attacks have gone from a minor annoyance carried out by bedroom hackers, to a serious security threat that ENISA feels needs to be addressed. The recent attacks on US banks just goes to show the increasing sophistication of hackers, or cyber criminals, and that any site can be brought down - even some of the most well-protected organisations."

DDoS attacks "have become a regular staple in many hackers’ toolkits", Lawrence commented, adding that firewalls alone provide little effective protection.

Other security watchers question how useful and realistic the simulated attacks will be. After all, DDoS attacks are only one of the threats that businesses face. Hacking using malware or other tactics to obtain corporate secrets or financial data is an even more potent threat. All this is outside the scope of the simulated attacks Cyber Europe 2012 will test against.

A six-minute video nicely illustrating the varied techniques a hacking crew might use to break through corporate security before extracting valuable security can be found here. The dramatisation, put together by Rik Ferguson of Trend Micro, is based on a true story of how an (unnamed) global corporation was hacked, costing the victim more than $60m. ®

Combat fraud and increase customer satisfaction

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.