Companies in the Netherlands urgently need to increase their digital resilience in view of the war in Ukraine. This call comes from the FME. Although there are no concrete indications of targeted Russian cyber attacks on Dutch companies, increased vigilance is vital, according to FME.
FME warns of possible 'spillover effects' of digital attacks in Ukraine in the Netherlands. However, also consider direct attacks on Dutch organisations. For example, in retaliation for sanctions imposed by the Dutch government.
Wiper malware
Security firms have been warning for some time about cyber attacks in relation to the war in Ukraine. For instance, security researchers from the company ESET warned about IsaacWiper and HermeticWiper. These are two forms of so-called wiper malware. This is malicious software specifically designed to completely wipe systems, with the aim of causing damage.
IsaacWiper was widely deployed immediately after the start of the Russian invasion of Ukraine. The cybercriminals behind this malware seem to be setting their sights specifically on the Ukrainian government. However, a reference to the date 19 October 2021 has been found in the malware's code. If this date is correct, it would mean that the malware was in use months before the invasion.
HermeticWiper has been deployed before, in the run-up to the invasion. This malware consists of three components. HermeticWiper focuses on wiping data from infected systems. HermeticWizard takes care of spreading the malware on local networks. This allows the infection to jump from PC to PC. HermeticRansom is component used as a diversion strategy, according to ESET. This makes the wiper malware appear to behave like ransomware. Ransomware is common malicious software that takes data hostage on systems. Cybercriminals who deploy ransomware usually then demand a ransom from victims who want to regain access to their data.
National Cyber Security Centre also on alert
The National Cyber Security Centre (NCSC) monitors the situation in Ukraine and related cyber threats. The NCSC is a public-private organisation that has been operating since early 2012. The centre aims to increase the digital resilience of Dutch society. It is the central information hub and expertise centre for cybersecurity in the Netherlands. On a webpage, the centre shares the latest information.
The centre has as yet no concrete indications that digital attacks in relation to the war in Ukraine will impact the Netherlands. However, the NCSC does not rule out possible consequences and attacks in the Netherlands in the future.
'Notably, reports of DDoS attacks and wiper malware
Currently, DDoS attacks and attacks with the aforementioned wiper malware are being reported internationally in particular. Several international hacker groups are also involved in the war. The NCSC warns that this involvement could lead to an increase in digital attacks. And that these attacks may also impact Dutch organisations in the future.
The NCSC therefore advises Dutch organisations to put their digital resilience in order. Among other things, it recommends at least following the NCSC basic measures. These include keeping systems up-to-date and backed up, applying multi-factor authentication and adequate access management. However, also consider network segmentation, mapping devices and services accessible via the internet and encrypting sensitive information.
The NCSC also advises Dutch organisations to study the publication ‘Points to consider regarding crisis management and crisis communication in the event of digital incidents ’. This document contains practical information on crisis management and crisis communication. This information helps organisations to organise their response to digital incidents as effectively as possible. On its website, the NCSC also compiles, in chronological order, all attacks related to the conflict in Ukraine.
Advice from the NCSC
Finally, the NCSC also offers some short-term advice:
- Make sure updates are installed. This applies to all systems that have a direct link to the internet.
- Go through your incident response plans and ensure they are up to date.
- Make contact lists ok available offline. Also consider external contacts such as service providers.
- Inform your employees who within the organisation they should and can reach if they observe suspicious signals.
- Test existing backups. In addition, make an offline backup, even if you do not normally do so.
- Ensure logical and physical network drawings are available offline.
- Improve email server security by implementing techniques such as SPF, DKIM and DMARC.
- For key information and information systems, check now what you would want to know in case of an attack and ensure that the logging required for this is in place.
NCSC also shares some advice towards suppliers:
- Map which suppliers you depend on for your primary services.
- Update your overview of supplier contacts.
- Pay extra attention to possible disinformation in communications with suppliers.
- Ask suppliers to check systems they manage for you for serious security problems.
- Check whether you are using software from Russian and Ukrainian supplier. And map the impact of the war on the supply, support and warranty of and on this software.
Much of the above advice also applies to industrial organisations with primary processes that rely heavily on operational technology. Regarding operational technology, the NCSC additionally shares some specific advice:
- Ensure adequate security of systems that provide access to networks to which operational technology is connected. Consider VPNs and firewalls.
- Check that access to environments with operational technology is adequately protected. For example, by using network segmentation.
- Be extra vigilant when using data carriers in environments where operational technology is present. Data carriers can be infected with malware and thus contaminate operational technology. Think of data carriers as USB sticks, but also smartphones and laptops.
Finally, the NCSC has made the ICS/SCADA Security Checklist and the report ‘Success Factors for Digital Security in OT’ available, along with additional measures.
Author: Wouter Hoeffnagel
