Feeds

Europe UNDER ATTACK in simulated cyber security test

This is a drill. No networks will be harmed in this exercise

The Power of One eBook: Top reasons to choose HP BladeSystem

European banks teamed up with information security agencies and governments to run a DDoS cyber-attack preparedness exercise today.

Cyber Europe 2012, a simulated cyber security attack involving 300 cyber security professionals, is being co-ordinated by European Union security agency ENISA. It's the second exercise of its type, following the running of a similar pan-European simulated DDoS attack scenario two years ago. "Compared to the 2010 exercise, Cyber Europe 2012 has grown considerably in scope, scale and complexity," according to a statement by ENISA.

Four countries are observing the exercise and 25 countries are actively participating. Using the lessons learned from Cyber Europe 2010, the private sector (from finance, ISPs and eGovernment) is taking part for the first time. In the exercise, public and private participants across Europe will take action at the national level. At the same time, public participants will cooperate across borders.

The scenario for Cyber Europe 2012 combines several technically realistic threats into one simultaneously escalating Distributed Denial of Service (DDoS) attack on online services in all participating countries. This kind of scenario would disrupt services for millions of citizens across Europe.

The complexity of the scenario allows for the creation of enough cyber incidents to challenge the several hundred public and private sector participants from throughout Europe, while at the same time triggering cooperation. By the end of the exercise, the participants will have had to handle more than 1000 injects (simulated cyber incidents).

The exercise is designed so that it avoids affect real networks, systems or services.

Paul Lawrence, VP International Operations at Corero Network Security, praised the exercise as a useful step towards enabling government to work together with the private sector in coming up with best practice for repelling cyber-attacks.

"What is interesting about the ENISA’s 2012 attack scenario is that it will combine several technically realistic threats into one simultaneously escalating Distributed Denial of Service (DDoS) attack," Lawrence said. "This goes to show that DDoS attacks have gone from a minor annoyance carried out by bedroom hackers, to a serious security threat that ENISA feels needs to be addressed. The recent attacks on US banks just goes to show the increasing sophistication of hackers, or cyber criminals, and that any site can be brought down - even some of the most well-protected organisations."

DDoS attacks "have become a regular staple in many hackers’ toolkits", Lawrence commented, adding that firewalls alone provide little effective protection.

Other security watchers question how useful and realistic the simulated attacks will be. After all, DDoS attacks are only one of the threats that businesses face. Hacking using malware or other tactics to obtain corporate secrets or financial data is an even more potent threat. All this is outside the scope of the simulated attacks Cyber Europe 2012 will test against.

A six-minute video nicely illustrating the varied techniques a hacking crew might use to break through corporate security before extracting valuable security can be found here. The dramatisation, put together by Rik Ferguson of Trend Micro, is based on a true story of how an (unnamed) global corporation was hacked, costing the victim more than $60m. ®

Designing a Defense for Mobile Applications

More from The Register

next story
DARPA-derived secure microkernel goes open source tomorrow
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
Four fake Google haxbots hit YOUR WEBSITE every day
Goog the perfect ruse to slip into SEO orfice
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.