EU: We'll force power plants, Apple and pals to admit hack attacks
New rules on reporting breaches proposed in cyber-strategy
Agentless Backup is Not a Myth
Power stations, banks, online shops, cloud providers, search engines, app stores, social networks and governments may soon be required by law to disclose ALL major security breaches.
In a strategy titled An Open, Safe and Secure Cyberspace, the European Commission proposed this new directive for the continent:
Operators of critical infrastructures in some sectors (financial services, transport, energy, health), enablers of information society services (notably: app stores, e-commerce platforms, internet payment, cloud computing, search engines, social networks) and public administrations must adopt risk management practices and report major security incidents on their core services.
The strategy also calls for every Euro nation to put together a crack team to tackle big tech security emergencies and share intelligence with neighbours, among other cyber-desires.
Most, but not all, EU member states already have their own Computer Emergency Response Team (CERT) so this major policy push seems to primarily involve forcing companies to notify the authorities of any data breaches or significant security incidents.
The strategy also advocates applying existing international laws to "cyberspace" as well as promoting international cooperation with countries outside the union.
The policy builds on other EU initiatives including establishing a European Cybercrime Centre, proposing laws on attacks against information systems, and the launch of a global alliance to fight child sex abuse. The strategy also seeks to develop and fund training schemes to combat online crime.
In a statement, Cecilia Malmström, EU commissioner for Home Affairs, said: "Many EU countries are lacking the necessary tools to track down and fight online organised crime. All member states should set up effective national cybercrime units that can benefit from the expertise and the support of the European Cybercrime Centre, EC3."
During a 30-minute press conference, Euro bigwigs were grilled on what they were doing to end corporate espionage; Chinese hackers are consistently accused of accessing companies' private servers and swiping secrets.
Catherine Ashton, high representative of the union for foreign affairs and security policy, refused to comment on investigations by Europe's spooks into these intrusions, but said the EU was monitoring the situation closely and is in talks with China, India and the US. Officials in Brussels have, we're told, come to the conclusion that these attacks are increasing and damaging economies.
Last year, 56.8 per cent of businesses in Europe suffered a computer security breach that seriously derailed their operations. Yet only 26 per cent of the union's enterprises had a formal ICT security policy. That's according to Eurostat figures from January 2012.
Chinese networking kit giant Huawei, occasionally on the end of a shoeing from Western politicians, put out a statement supporting the EU’s call for greater international cooperation.
“The strategy comes at a crucial moment, providing the public and the private sector with the tools they need to move beyond debating the problem and take concrete steps to tackle security issues,” said Huawei’s global security officer John Suffolk. “The time has come to stop talking about the threat, stop talking about the challenges and start talking about the actions we have taken and will take.”
Jason Hart, VP of cloud solutions at SafeNet, also welcomed the EU strategy but said that it needed to be supplemented with a greater increase of encryption to protect sensitive data.
“This move is a welcome change as past breaches have demonstrated that delays in reporting may have exacerbated the initial problem," Hart said. "However reporting the breach itself is only a small part of the equation. What is of real importance is preventing the damage that the exposure of unencrypted data can cause in the event of a security breach.
"Therefore, a key solution to tackle cyber security issues lies within pushing for more wide-scale mandatory encryption of all data, including soft data which has been aggressively targeted by cybercriminals over the last few years. New legislations that come into play will need to provide a comprehensive set of measures based on the fundamentals of information security to ensure wider adoption of encryption and authentication as a way of mitigating the damage of a potential security breach." ®
COMMENTS
Point Missed: Re: More work for Mr Jobsworth
The idea is not to "frighten the criminals" the idea is to get businesses and organisations to actually admit that they have flaws in their security and *DO* something about them instead of just trying to sweep it under the carpet for fear that it might affect their share prices (and thus bonuses).
Sigh, here we go again..
*Please* don't feed politicians complicated words, the fact that they now feel qualified to use the words "Could Services" is bad enough.
Stating that "more encryption" is the way to solve problem is what I'd call the Microsoft way to solve bad engineering: stick a plaster called "anti virus measures" over the wide cracks.
First, you assess the risks, insofar that you don't just decide what has value and WHAT can be done to cause harm, but also BY WHOM - the latter is a regular omission by reports I get to read through prepared by far-to-expesive consultancies. Only then do you design (greenfield) or adjust (established platform) your architecture, and put in place the procedures to keep it safe, in parallel with educating your users to a standard than can be proven (gives you a way to identify possible problem sources and take measures so that they cannot make a mess). Information storage, backup, recovery and age management are fun things to look at too (especially aged personal data can get you into a mess with Data Protection). After that, have a look at encryption, fine - that's where your next challenge arrives. CA and key management, key disposal (never zap a key unless you have a log of it or you'll be done for under UK's RIPA). Encryption is also good to manage the insider threat, but it means your intrusion detection ability degrades.
In short, just yelling "more encryption" is not helping. The whole picture needs to be improved.
Re: Point Missed: More work for Mr Jobsworth
My feeling is that the best people to report things to are people who will roll up their sleeves , put on big boots, and say "Ok, let's go get them!".
OK , having to report you have a broken fence may be embarrasing, but only if the broken fence register is posted on the outside of the town hall, and people who own fences go and look at it. If it just gets filed in the 'broken fence' drawer and never sees the light of day, all you have done is make extra work.
Perhaps companies should have to report such failures in thier annual reports, and on a case-by-case basis to shareholders?
But if officialdom wants reports, then officialdom should send a 'policeman' out to respond.
IT infrastructure monitoring strategies
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
Data control in the cloud
Cloud based data management
Agentless Backup is Not a Myth
