Feeds

EU: We'll force power plants, Apple and pals to admit hack attacks

New rules on reporting breaches proposed in cyber-strategy

SANS - Survey on application security programs

Power stations, banks, online shops, cloud providers, search engines, app stores, social networks and governments may soon be required by law to disclose ALL major security breaches.

In a strategy titled An Open, Safe and Secure Cyberspace, the European Commission proposed this new directive for the continent:

Operators of critical infrastructures in some sectors (financial services, transport, energy, health), enablers of information society services (notably: app stores, e-commerce platforms, internet payment, cloud computing, search engines, social networks) and public administrations must adopt risk management practices and report major security incidents on their core services.

The strategy also calls for every Euro nation to put together a crack team to tackle big tech security emergencies and share intelligence with neighbours, among other cyber-desires.

Most, but not all, EU member states already have their own Computer Emergency Response Team (CERT) so this major policy push seems to primarily involve forcing companies to notify the authorities of any data breaches or significant security incidents.

The strategy also advocates applying existing international laws to "cyberspace" as well as promoting international cooperation with countries outside the union.

The policy builds on other EU initiatives including establishing a European Cybercrime Centre, proposing laws on attacks against information systems, and the launch of a global alliance to fight child sex abuse. The strategy also seeks to develop and fund training schemes to combat online crime.

In a statement, Cecilia Malmström, EU commissioner for Home Affairs, said: "Many EU countries are lacking the necessary tools to track down and fight online organised crime. All member states should set up effective national cybercrime units that can benefit from the expertise and the support of the European Cybercrime Centre, EC3."

During a 30-minute press conference, Euro bigwigs were grilled on what they were doing to end corporate espionage; Chinese hackers are consistently accused of accessing companies' private servers and swiping secrets.

Catherine Ashton, high representative of the union for foreign affairs and security policy, refused to comment on investigations by Europe's spooks into these intrusions, but said the EU was monitoring the situation closely and is in talks with China, India and the US. Officials in Brussels have, we're told, come to the conclusion that these attacks are increasing and damaging economies.

Last year, 56.8 per cent of businesses in Europe suffered a computer security breach that seriously derailed their operations. Yet only 26 per cent of the union's enterprises had a formal ICT security policy. That's according to Eurostat figures from January 2012.

Chinese networking kit giant Huawei, occasionally on the end of a shoeing from Western politicians, put out a statement supporting the EU’s call for greater international cooperation.

“The strategy comes at a crucial moment, providing the public and the private sector with the tools they need to move beyond debating the problem and take concrete steps to tackle security issues,” said Huawei’s global security officer John Suffolk. “The time has come to stop talking about the threat, stop talking about the challenges and start talking about the actions we have taken and will take.”

Jason Hart, VP of cloud solutions at SafeNet, also welcomed the EU strategy but said that it needed to be supplemented with a greater increase of encryption to protect sensitive data.

“This move is a welcome change as past breaches have demonstrated that delays in reporting may have exacerbated the initial problem," Hart said. "However reporting the breach itself is only a small part of the equation. What is of real importance is preventing the damage that the exposure of unencrypted data can cause in the event of a security breach.

"Therefore, a key solution to tackle cyber security issues lies within pushing for more wide-scale mandatory encryption of all data, including soft data which has been aggressively targeted by cybercriminals over the last few years. New legislations that come into play will need to provide a comprehensive set of measures based on the fundamentals of information security to ensure wider adoption of encryption and authentication as a way of mitigating the damage of a potential security breach." ®

High performance access to file storage

More from The Register

next story
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
prev story

Whitepapers

Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.