Feeds

EU: We'll force power plants, Apple and pals to admit hack attacks

New rules on reporting breaches proposed in cyber-strategy

Security for virtualized datacentres

Power stations, banks, online shops, cloud providers, search engines, app stores, social networks and governments may soon be required by law to disclose ALL major security breaches.

In a strategy titled An Open, Safe and Secure Cyberspace, the European Commission proposed this new directive for the continent:

Operators of critical infrastructures in some sectors (financial services, transport, energy, health), enablers of information society services (notably: app stores, e-commerce platforms, internet payment, cloud computing, search engines, social networks) and public administrations must adopt risk management practices and report major security incidents on their core services.

The strategy also calls for every Euro nation to put together a crack team to tackle big tech security emergencies and share intelligence with neighbours, among other cyber-desires.

Most, but not all, EU member states already have their own Computer Emergency Response Team (CERT) so this major policy push seems to primarily involve forcing companies to notify the authorities of any data breaches or significant security incidents.

The strategy also advocates applying existing international laws to "cyberspace" as well as promoting international cooperation with countries outside the union.

The policy builds on other EU initiatives including establishing a European Cybercrime Centre, proposing laws on attacks against information systems, and the launch of a global alliance to fight child sex abuse. The strategy also seeks to develop and fund training schemes to combat online crime.

In a statement, Cecilia Malmström, EU commissioner for Home Affairs, said: "Many EU countries are lacking the necessary tools to track down and fight online organised crime. All member states should set up effective national cybercrime units that can benefit from the expertise and the support of the European Cybercrime Centre, EC3."

During a 30-minute press conference, Euro bigwigs were grilled on what they were doing to end corporate espionage; Chinese hackers are consistently accused of accessing companies' private servers and swiping secrets.

Catherine Ashton, high representative of the union for foreign affairs and security policy, refused to comment on investigations by Europe's spooks into these intrusions, but said the EU was monitoring the situation closely and is in talks with China, India and the US. Officials in Brussels have, we're told, come to the conclusion that these attacks are increasing and damaging economies.

Last year, 56.8 per cent of businesses in Europe suffered a computer security breach that seriously derailed their operations. Yet only 26 per cent of the union's enterprises had a formal ICT security policy. That's according to Eurostat figures from January 2012.

Chinese networking kit giant Huawei, occasionally on the end of a shoeing from Western politicians, put out a statement supporting the EU’s call for greater international cooperation.

“The strategy comes at a crucial moment, providing the public and the private sector with the tools they need to move beyond debating the problem and take concrete steps to tackle security issues,” said Huawei’s global security officer John Suffolk. “The time has come to stop talking about the threat, stop talking about the challenges and start talking about the actions we have taken and will take.”

Jason Hart, VP of cloud solutions at SafeNet, also welcomed the EU strategy but said that it needed to be supplemented with a greater increase of encryption to protect sensitive data.

“This move is a welcome change as past breaches have demonstrated that delays in reporting may have exacerbated the initial problem," Hart said. "However reporting the breach itself is only a small part of the equation. What is of real importance is preventing the damage that the exposure of unencrypted data can cause in the event of a security breach.

"Therefore, a key solution to tackle cyber security issues lies within pushing for more wide-scale mandatory encryption of all data, including soft data which has been aggressively targeted by cybercriminals over the last few years. New legislations that come into play will need to provide a comprehensive set of measures based on the fundamentals of information security to ensure wider adoption of encryption and authentication as a way of mitigating the damage of a potential security breach." ®

Internet Security Threat Report 2014

More from The Register

next story
UK smart meters arrive in 2020. Hackers have ALREADY found a flaw
Energy summit bods warned of free energy bonanza
DRUPAL-OPCALYPSE! Devs say best assume your CMS is owned
SQLi hole was hit hard, fast, and before most admins knew it needed patching
Knock Knock tool makes a joke of Mac AV
Yes, we know Macs 'don't get viruses', but when they do this code'll spot 'em
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
Mozilla releases geolocating WiFi sniffer for Android
As if the civilians who never change access point passwords will ever opt out of this one
Why weasel words might not work for Whisper
CEO suspends editor but privacy questions remain
prev story

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Simplify SSL certificate management across the enterprise
Simple steps to take control of SSL across the enterprise, and recommendations for a management platform for full visibility and single-point of control for these Certificates.