Feeds

EU: We'll force power plants, Apple and pals to admit hack attacks

New rules on reporting breaches proposed in cyber-strategy

The Power of One eBook: Top reasons to choose HP BladeSystem

Power stations, banks, online shops, cloud providers, search engines, app stores, social networks and governments may soon be required by law to disclose ALL major security breaches.

In a strategy titled An Open, Safe and Secure Cyberspace, the European Commission proposed this new directive for the continent:

Operators of critical infrastructures in some sectors (financial services, transport, energy, health), enablers of information society services (notably: app stores, e-commerce platforms, internet payment, cloud computing, search engines, social networks) and public administrations must adopt risk management practices and report major security incidents on their core services.

The strategy also calls for every Euro nation to put together a crack team to tackle big tech security emergencies and share intelligence with neighbours, among other cyber-desires.

Most, but not all, EU member states already have their own Computer Emergency Response Team (CERT) so this major policy push seems to primarily involve forcing companies to notify the authorities of any data breaches or significant security incidents.

The strategy also advocates applying existing international laws to "cyberspace" as well as promoting international cooperation with countries outside the union.

The policy builds on other EU initiatives including establishing a European Cybercrime Centre, proposing laws on attacks against information systems, and the launch of a global alliance to fight child sex abuse. The strategy also seeks to develop and fund training schemes to combat online crime.

In a statement, Cecilia Malmström, EU commissioner for Home Affairs, said: "Many EU countries are lacking the necessary tools to track down and fight online organised crime. All member states should set up effective national cybercrime units that can benefit from the expertise and the support of the European Cybercrime Centre, EC3."

During a 30-minute press conference, Euro bigwigs were grilled on what they were doing to end corporate espionage; Chinese hackers are consistently accused of accessing companies' private servers and swiping secrets.

Catherine Ashton, high representative of the union for foreign affairs and security policy, refused to comment on investigations by Europe's spooks into these intrusions, but said the EU was monitoring the situation closely and is in talks with China, India and the US. Officials in Brussels have, we're told, come to the conclusion that these attacks are increasing and damaging economies.

Last year, 56.8 per cent of businesses in Europe suffered a computer security breach that seriously derailed their operations. Yet only 26 per cent of the union's enterprises had a formal ICT security policy. That's according to Eurostat figures from January 2012.

Chinese networking kit giant Huawei, occasionally on the end of a shoeing from Western politicians, put out a statement supporting the EU’s call for greater international cooperation.

“The strategy comes at a crucial moment, providing the public and the private sector with the tools they need to move beyond debating the problem and take concrete steps to tackle security issues,” said Huawei’s global security officer John Suffolk. “The time has come to stop talking about the threat, stop talking about the challenges and start talking about the actions we have taken and will take.”

Jason Hart, VP of cloud solutions at SafeNet, also welcomed the EU strategy but said that it needed to be supplemented with a greater increase of encryption to protect sensitive data.

“This move is a welcome change as past breaches have demonstrated that delays in reporting may have exacerbated the initial problem," Hart said. "However reporting the breach itself is only a small part of the equation. What is of real importance is preventing the damage that the exposure of unencrypted data can cause in the event of a security breach.

"Therefore, a key solution to tackle cyber security issues lies within pushing for more wide-scale mandatory encryption of all data, including soft data which has been aggressively targeted by cybercriminals over the last few years. New legislations that come into play will need to provide a comprehensive set of measures based on the fundamentals of information security to ensure wider adoption of encryption and authentication as a way of mitigating the damage of a potential security breach." ®

Designing a Defense for Mobile Applications

More from The Register

next story
DARPA-derived secure microkernel goes open source tomorrow
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
Four fake Google haxbots hit YOUR WEBSITE every day
Goog the perfect ruse to slip into SEO orfice
Putin: Crack Tor for me and I'll make you a MILLIONAIRE
Russian Interior Ministry offers big pile o' roubles for busting pro-privacy browser
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.