Cybersecurity in Europe
The most recent report from the EU Agency for Cybersecurity (ENISA) has been issued, pointing to a hike in cyberattacks
Corina Cristea, 06.11.2020, 13:30
The most recent report from the EU Agency for Cybersecurity (ENISA) has been issued, pointing to a hike in cyberattacks, which it says are becoming more and more sophisticated, better directed and more widespread, most times with impunity. In most cases, the motivation is mostly financial. The consequences of such attacks are fairly hard to quantify, and sometimes they are quite dramatic.
Our guest on Radio Romania was Andrei Bozeanu, and expert with the National Center for Response to Cybersecurity Incidents. He talked to us about one such case, which occurred in September, an attack against a hospital in Dusseldorf, which led to the death of a woman who could not get the proper help in time:
“Unfortunately, recently in Germany we had the first human victim, who lost their lives because of a ransomware attack. Basically, it was a virus which, the moment it took control of the hospitals network, encrypted all the data, which had a negative impact on the treatment that the patient needed. I believe this should raise alarms, since we live in a world in which a cyberattack may have real world consequences on human life, reason for which we have to take all these things very seriously.”
Among the most dangerous attack vectors right now are e-mails. For instance, according to experts, over the last few months, several public and private entities in Romania have been strongly affected by a series of EMOTET malware attacks, which exploit vulnerabilities in Microsoft Windows systems, using links or infected attachments such as PDFs and documents. At the European level, there is a rise in phishing attacks, spam attacks, and attacks targeted specifically at social networks, the ENISA analysis shows. The healthcare context had an exacerbating role in all this, since the pandemic forced a massive increase in use of the online environment. Working and studying from home, with a massive increase in teleconferencing are some of the factors that led to this. This trend is confirmed by suppliers of digital solutions, who said that, in years previous, companies were rather reticent, and focused on priorities, but lately the number of companies focused on this area is rising. Experts point out that multiple risks are on the rise, once work behavior changed, and there was a very speedy adoption of new technologies, without a solid understanding of them, starting with the multitude of applications we use more and more to communicate.
A reaction is needed to match the threat, which should include a very strong educational component, says Mihai Sebe from the European Institute in Romania:
“Unfortunately, cyberattacks risk becoming the new normal, and any action and investment at the European level has to take this into account. Investments will have to be boosted in terms of the physical infrastructure, but I believe more so in terms of educating users. An information system is as strong as the users are educated. Also, one important aspect that the report points out is that there is a massive expansion in fake shopping websites, which mimic real ones, and that incur a lot of losses for citizens. Also noticeable was increased use of social media platforms to launch attacks, in addition to the already known problems of online disinformation and the spread of fake news about the pandemic. Also on the rise is cyberbullying, which affects mostly young people, but not only, as well as all sorts of digital attacks. They are mostly financially motivated, extorting significant amounts of money from victims. But there are also state and non-state actors initiating them, which are not always financially motivated.”
In this context, the EU has decided to take firm measures of consolidating its security capacity. One very important element is investing in human resources, and developing new applications, as well as measures to secure the infrastructure, says Mihai Sebe:
“The measures include political measures, and greater involvement from member states in punishing the perpetrators. I would also mention, very importantly, that this summer in July the EU issued its first indictments against attackers, namely six persons and three entities responsible for cyberattacks. These sanctions include travel bans and freezing of assets, as well as forbidding any EU citizens from providing funds to those on the blacklist. I believe that this political component is very important as a deterrent, in addition to the educational component.”
The EU has announced firm measures to consolidate its security: updating its legislation that is relevant to cybersecurity, and adopting a new cybersecurity strategy by the end of this year.
