Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

12/5/2018
11:20 AM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Former Estonian Foreign Minister Urges Cooperation in Cyberattack Attribution, Policy

Nations must band together to face nation-state cyberattack threats, said Marina Kaljurand.

BLACK HAT EUROPE 2018 – London – As nation-state cyberattacks continue to evolve into more complex and disruptive campaigns, the pressure is on for countries to set specific cybernorms and support one another in the attribution of nation-state hacks, according to Marina Kaljurand, chair of the Global Commission on the Stability of Cyberspace (GCSC) and Member of the UN Secretary General's High Level Panel on Digital Cooperation.

The former Estonian Foreign Minister, who was serving as the ambassador to Russia in 2007 when her country was hit with historic distributed denial-of-service (DDoS) attacks by Russia, said in an interview with Dark Reading that without "a clear understanding" of attack attribution, bad actors continue to operate in the "gray zone."

"Russia attacked Estonia, and nothing really happened. The next year it was the war and cyberattacks on Georgia, and nothing really happened. Then the attack on the Ukraine power grid, and nothing happened," Kaljurand said of Russia's increasingly aggressive cyberattack campaigns. It wasn't until the US, under President Barack Obama, called out Russian actors in the hack of the Democratic National Committee (DNC) that nations began to name the culprits behind state-sponsored hacking, she said. 

Kaljurand, who delivered the keynote address here today, was serving as the Estonian ambassador to Russia when Russian hackers took down her country's government and bank websites with a weeks-long DDoS attack wave. "We were the first country to fall victim to politically motivated attacks. Those DDoS attacks were primitive by today's standards. ... They didn't [destroy] anything; they were humiliating and disturbing," she said.

As the ambassador to Russia, she then "had to learn in 15 minutes what does DDoS mean and explain it to others," she said. "My second task was to find cooperation with Russia. I failed: It takes two to tango."

Kaljurand said one of the main lessons from the Estonia attacks was that international cooperation is the key to thwarting malicious nation-state attacks. This new normal of nation-state cyberattacks requires educating nations that are not as up to speed on the issues, as well as fostering cooperation among like-minded nations to set and support cybernorms. "States alone can't be efficient," she said. "We need responsible laws, regulations, authority, and thinking out of the box."

The multination naming of Russia as the actor behind the NotPetya data-destruction attacks in 2013 was the first time multiple countries issued attribution statements at the same time, as well as sanctions in some cases. "To get a state to make [such a] statement wasn't easy," Kaljurand told Dark Reading.   

Offensive cyber operations are another area that must be addressed, she said. "Whatever measures that are taken must be in correspondence with international law," Kaljurand stated in the keynote. "It's important to consider the necessity, specificity, proportionality, and harm in case offensive capabilities are used. To have an open discussion on this is better than not having it or having it behind closed doors."

While some 60 to 70 countries today are talking about cybersecurity, hundreds in the developing world are not and need to be reached out to, she said.  

The GCSC so far has issued its set of recommended cybernorms for the protection of the public core of the Internet, but is still working on other security issues.  

How can cyberspace norms be enforced if not all nations comply? "Start with a political statement supporting it and then introduce it as practice, with clear rules of what is allowed and what is not," Kaljurand said in the interview. Ultimately, that will require some sort of international watchdog organization, she added.

Meanwhile, Estonia, like other nations, continues to be targeted by nation-state hackers. "I can't be specific" about the threats, Kaljurand told Dark Reading, but Russia remains active as well as other nations. 

Related Content:

 

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
SOC 2s & Third-Party Assessments: How to Prevent Them from Being Used in a Data Breach Lawsuit
Beth Burgin Waller, Chair, Cybersecurity & Data Privacy Practice , Woods Rogers PLC,  12/5/2019
Navigating Security in the Cloud
Diya Jolly, Chief Product Officer, Okta,  12/4/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-4428
PUBLISHED: 2019-12-09
IBM Watson Assistant for IBM Cloud Pak for Data 1.0.0 through 1.3.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session....
CVE-2019-4611
PUBLISHED: 2019-12-09
IBM Planning Analytics 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 168519.
CVE-2019-4612
PUBLISHED: 2019-12-09
IBM Planning Analytics 2.0 is vulnerable to malicious file upload in the My Account Portal. Attackers can make use of this weakness and upload malicious executable files into the system and it can be sent to victim for performing further attacks. IBM X-Force ID: 168523.
CVE-2019-4621
PUBLISHED: 2019-12-09
IBM DataPower Gateway 7.6.0.0-7 throug 6.0.14 and 2018.4.1.0 through 2018.4.1.5 have a default administrator account that is enabled if the IPMI LAN channel is enabled. A remote attacker could use this account to gain unauthorised access to the BMC. IBM X-Force ID: 168883.
CVE-2019-19230
PUBLISHED: 2019-12-09
An unsafe deserialization vulnerability exists in CA Release Automation (Nolio) 6.6 with the DataManagement component that can allow a remote attacker to execute arbitrary code.