In May 2018, the new Dutch Intelligence and Security Services Act 2017 (Wet op de Inlichtingen- en veiligheidsdiensten, Wiv) will enter into force. It replaces the previous 2002 Act and incorporates many reforms to the information gathering powers of the two intelligence and security services as well as to the accountability and oversight mechanisms. Due to the technologyneutral approach, both the civil and the military intelligence services are now authorized to, for example, intercept communications in bulk, hack third parties, decrypt files, store DNA or use any other future innovative technology. Also, the national security legislation extends the possibilities for the indiscriminate collection of data, and for the processing, storage and analysis thereof. The process leading to the law includes substantial criticism from the various stakeholders involved. Upon publication of this report, an official consultative referendum is being organized on the new act. The aim of this policy brief is to provide an international audience with a comprehensive overview of the most relevant aspects of the act and its context. In addition, there is considerable focus on the checks and balances as well as the bottlenecks of the Dutch intelligence gathering reform. The selection of topics is based on the core issues addressed during the parliamentary debate and on the authors’ insights.
Worldwide there is a lack of well-educated and experienced information security specialists. The first step to address this issue is arranging enough people with a well-known and acceptable basic level of information security competences. However, there might be a lot of information security education and training, but there is anything but a well-defined outflow level with a known and acceptable basic level of information security competences. There exists a chaotic situation in respect of the qualification of information security professionals, with the emergence of a large number of difficult to compare certificates and job titles. Apparently the information security field requires uniform qualifications that are internationally recognized. Such qualifications could be an excellent way of unambiguously clarifying the knowledge and skills of information security professionals. Furthermore it gives educational institutions a framework which facilitates the development of appropriate information security education and training.
From the article: This paper describes the external IT security analysis of an international corporate organization, containing a technical and a social perspective, resulting in a proposed repeatable approach and lessons learned for applying this approach. Part of the security analysis was the utilization of a social engineering experiment, as this could be used to discover employee related risks. This approach was based on multiple signals that indicated a low IT security awareness level among employees as well as the results of a preliminary technical analysis. To carry out the social engineering experiment, two techniques were used. The first technique was to send phishing emails to both the system administrators and other employees of the company. The second technique comprised the infiltration of the office itself to test the physical security, after which two probes were left behind. The social engineering experiment proved that general IT security awareness among employees was very low. The results allowed the research team to infiltrate the network and have the possibility to disable or hamper crucial processes. Social engineering experiments can play an important role in conducting security analyses, by showing security vulnerabilities and raising awareness within a company. Therefore, further research should focus on the standardization of social engineering experiments to be used in security analyses and further development of the approach itself. This paper provides a detailed description of the used methods and the reasoning behind them as a stepping stone for future research on this subject. van Liempd, D., Sjouw, A., Smakman, M., & Smit, K. (2019). Social Engineering As An Approach For Probing Organizations To Improve It Security: A Case Study At A Large International Firm In The Transport Industry. 119-126. https://doi.org/10.33965/es2019_201904l015
MULTIFILE
In de Smart Industry –ook wel aangeduid als Industrie 4.0- staat Machine2Machine (M2M) communicatie centraal: door machines in productieprocessen, assemblagelijnen en opslagsystemen te verbinden wordt verbeteringen verwacht. In de Smart Industry wordt per definitie veel slimme software systemen gebruikt. Dit zijn vaak autonome, en min of meer intelligente systemen, waarbij internet connectiviteit direct of indirect nodig is. Cyber security is daarmee een belangrijk aandachtspunt voor Smart Industry. De risico’s op security incidenten worden immers groter naar mate steeds meer systemen op het internet zijn aangesloten. We zien op dit moment beperkte aandacht voor robot security, ondanks het feit dat iedereen het belang van cyber security onderschrijft. Dit project richt zich op exploratief onderzoek rondom de cyber security bedreigingen van robots als onderdeel van Smart Industry. Hierbij kijken we naar de technische aspecten van sensoren, communicatie en het geprogrammeerde gedrag van robots. Daarnaast wordt gekeken ook naar de keten waarin Smart Industry/robot toepassingen tot stand komen en worden gebruikt.
Uit vooronderzoek van het lectoraat Cybersecurity in het mkb blijkt dat 39% van de metaalbedrijven slachtoffer is geworden van een cyberaanval. Doordat metaalbedrijven in grote mate afhankelijk zijn van informatietechnologie (IT) is de impact van dergelijke aanvallen groot. Zo rapporteerden directeuren van mkb bedrijven directe financiële schade, verlies of beschadiging van gegevens en tijdsverlies. Vooronderzoek laat zien dat bedrijven te weinig maatregelen nemen om zichzelf te beschermen. Dit komt doordat bestaande risicomodellen voor cybersecurity - deze zijn ontwikkeld voor experts - niet goed toepasbaar zijn voor directeuren in het mkb. Om in die leemte te voorzien vraagt de Haagse Hogeschool samen met de Koninklijke Metaalunie en 12 metaalbedrijven subsidie aan om een risicomodel te ontwikkelen dat wel toegepast kan warden door mkb bedrijven in de metaalsector. Dit onderzoek gaat uit van IS0 270011 en levert een risicomodel op dat door het mkb gebruikt kan warden om op een eenvoudige wijze basale processen random cybersecurity in te richten. Hiermee geven we ondernemers handvaten om zelf hun cybersecurity op orde te kunnen brengen. De uitkomsten van dit project dienen als basis voor een omvangrijker projectvoorstel waarbij we het model verder verdiepen en ook toepasbaar maken voor mkb bedrijven binnen andere branches van de smart industry.
Today, embedded devices such as banking/transportation cards, car keys, and mobile phones use cryptographic techniques to protect personal information and communication. Such devices are increasingly becoming the targets of attacks trying to capture the underlying secret information, e.g., cryptographic keys. Attacks not targeting the cryptographic algorithm but its implementation are especially devastating and the best-known examples are so-called side-channel and fault injection attacks. Such attacks, often jointly coined as physical (implementation) attacks, are difficult to preclude and if the key (or other data) is recovered the device is useless. To mitigate such attacks, security evaluators use the same techniques as attackers and look for possible weaknesses in order to “fix” them before deployment. Unfortunately, the attackers’ resourcefulness on the one hand and usually a short amount of time the security evaluators have (and human errors factor) on the other hand, makes this not a fair race. Consequently, researchers are looking into possible ways of making security evaluations more reliable and faster. To that end, machine learning techniques showed to be a viable candidate although the challenge is far from solved. Our project aims at the development of automatic frameworks able to assess various potential side-channel and fault injection threats coming from diverse sources. Such systems will enable security evaluators, and above all companies producing chips for security applications, an option to find the potential weaknesses early and to assess the trade-off between making the product more secure versus making the product more implementation-friendly. To this end, we plan to use machine learning techniques coupled with novel techniques not explored before for side-channel and fault analysis. In addition, we will design new techniques specially tailored to improve the performance of this evaluation process. Our research fills the gap between what is known in academia on physical attacks and what is needed in the industry to prevent such attacks. In the end, once our frameworks become operational, they could be also a useful tool for mitigating other types of threats like ransomware or rootkits.
