Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

12/5/2018
11:20 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Former Estonian Foreign Minister Urges Cooperation in Cyberattack Attribution, Policy

Nations must band together to face nation-state cyberattack threats, said Marina Kaljurand.

BLACK HAT EUROPE 2018 – London – As nation-state cyberattacks continue to evolve into more complex and disruptive campaigns, the pressure is on for countries to set specific cybernorms and support one another in the attribution of nation-state hacks, according to Marina Kaljurand, chair of the Global Commission on the Stability of Cyberspace (GCSC) and Member of the UN Secretary General's High Level Panel on Digital Cooperation.

The former Estonian Foreign Minister, who was serving as the ambassador to Russia in 2007 when her country was hit with historic distributed denial-of-service (DDoS) attacks by Russia, said in an interview with Dark Reading that without "a clear understanding" of attack attribution, bad actors continue to operate in the "gray zone."

"Russia attacked Estonia, and nothing really happened. The next year it was the war and cyberattacks on Georgia, and nothing really happened. Then the attack on the Ukraine power grid, and nothing happened," Kaljurand said of Russia's increasingly aggressive cyberattack campaigns. It wasn't until the US, under President Barack Obama, called out Russian actors in the hack of the Democratic National Committee (DNC) that nations began to name the culprits behind state-sponsored hacking, she said. 

Kaljurand, who delivered the keynote address here today, was serving as the Estonian ambassador to Russia when Russian hackers took down her country's government and bank websites with a weeks-long DDoS attack wave. "We were the first country to fall victim to politically motivated attacks. Those DDoS attacks were primitive by today's standards. ... They didn't [destroy] anything; they were humiliating and disturbing," she said.

As the ambassador to Russia, she then "had to learn in 15 minutes what does DDoS mean and explain it to others," she said. "My second task was to find cooperation with Russia. I failed: It takes two to tango."

Kaljurand said one of the main lessons from the Estonia attacks was that international cooperation is the key to thwarting malicious nation-state attacks. This new normal of nation-state cyberattacks requires educating nations that are not as up to speed on the issues, as well as fostering cooperation among like-minded nations to set and support cybernorms. "States alone can't be efficient," she said. "We need responsible laws, regulations, authority, and thinking out of the box."

The multination naming of Russia as the actor behind the NotPetya data-destruction attacks in 2013 was the first time multiple countries issued attribution statements at the same time, as well as sanctions in some cases. "To get a state to make [such a] statement wasn't easy," Kaljurand told Dark Reading.   

Offensive cyber operations are another area that must be addressed, she said. "Whatever measures that are taken must be in correspondence with international law," Kaljurand stated in the keynote. "It's important to consider the necessity, specificity, proportionality, and harm in case offensive capabilities are used. To have an open discussion on this is better than not having it or having it behind closed doors."

While some 60 to 70 countries today are talking about cybersecurity, hundreds in the developing world are not and need to be reached out to, she said.  

The GCSC so far has issued its set of recommended cybernorms for the protection of the public core of the Internet, but is still working on other security issues.  

How can cyberspace norms be enforced if not all nations comply? "Start with a political statement supporting it and then introduce it as practice, with clear rules of what is allowed and what is not," Kaljurand said in the interview. Ultimately, that will require some sort of international watchdog organization, she added.

Meanwhile, Estonia, like other nations, continues to be targeted by nation-state hackers. "I can't be specific" about the threats, Kaljurand told Dark Reading, but Russia remains active as well as other nations. 

Related Content:

 

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
When It Comes To Security Tools, More Isn't More
Lamont Orange, Chief Information Security Officer at Netskope,  1/11/2021
US Capitol Attack a Wake-up Call for the Integration of Physical & IT Security
Seth Rosenblatt, Contributing Writer,  1/11/2021
IoT Vendor Ubiquiti Suffers Data Breach
Dark Reading Staff 1/11/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-25533
PUBLISHED: 2021-01-15
An issue was discovered in Malwarebytes before 4.0 on macOS. A malicious application was able to perform a privileged action within the Malwarebytes launch daemon. The privileged service improperly validated XPC connections by relying on the PID instead of the audit token. An attacker can construct ...
CVE-2021-3162
PUBLISHED: 2021-01-15
Docker Desktop Community before 2.5.0.0 on macOS mishandles certificate checking, leading to local privilege escalation.
CVE-2021-21242
PUBLISHED: 2021-01-15
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability which can lead to pre-auth remote code execution. AttachmentUploadServlet deserializes untrusted data from the `Attachment-Support` header. This Servlet does not enforce any authentication or a...
CVE-2021-21245
PUBLISHED: 2021-01-15
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, AttachmentUploadServlet also saves user controlled data (`request.getInputStream()`) to a user specified location (`request.getHeader("File-Name")`). This issue may lead to arbitrary file upload which can be used to u...
CVE-2021-21246
PUBLISHED: 2021-01-15
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, the REST UserResource endpoint performs a security check to make sure that only administrators can list user details. However for the `/users/` endpoint there are no security checks enforced so it is possible to retrieve ar...