Threat Intelligence

12/5/2018
11:20 AM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Former Estonian Foreign Minister Urges Cooperation in Cyberattack Attribution, Policy

Nations must band together to face nation-state cyberattack threats, said Marina Kaljurand.

BLACK HAT EUROPE 2018 – London – As nation-state cyberattacks continue to evolve into more complex and disruptive campaigns, the pressure is on for countries to set specific cybernorms and support one another in the attribution of nation-state hacks, according to Marina Kaljurand, chair of the Global Commission on the Stability of Cyberspace (GCSC) and Member of the UN Secretary General's High Level Panel on Digital Cooperation.

The former Estonian Foreign Minister, who was serving as the ambassador to Russia in 2007 when her country was hit with historic distributed denial-of-service (DDoS) attacks by Russia, said in an interview with Dark Reading that without "a clear understanding" of attack attribution, bad actors continue to operate in the "gray zone."

"Russia attacked Estonia, and nothing really happened. The next year it was the war and cyberattacks on Georgia, and nothing really happened. Then the attack on the Ukraine power grid, and nothing happened," Kaljurand said of Russia's increasingly aggressive cyberattack campaigns. It wasn't until the US, under President Barack Obama, called out Russian actors in the hack of the Democratic National Committee (DNC) that nations began to name the culprits behind state-sponsored hacking, she said. 

Kaljurand, who delivered the keynote address here today, was serving as the Estonian ambassador to Russia when Russian hackers took down her country's government and bank websites with a weeks-long DDoS attack wave. "We were the first country to fall victim to politically motivated attacks. Those DDoS attacks were primitive by today's standards. ... They didn't [destroy] anything; they were humiliating and disturbing," she said.

As the ambassador to Russia, she then "had to learn in 15 minutes what does DDoS mean and explain it to others," she said. "My second task was to find cooperation with Russia. I failed: It takes two to tango."

Kaljurand said one of the main lessons from the Estonia attacks was that international cooperation is the key to thwarting malicious nation-state attacks. This new normal of nation-state cyberattacks requires educating nations that are not as up to speed on the issues, as well as fostering cooperation among like-minded nations to set and support cybernorms. "States alone can't be efficient," she said. "We need responsible laws, regulations, authority, and thinking out of the box."

The multination naming of Russia as the actor behind the NotPetya data-destruction attacks in 2013 was the first time multiple countries issued attribution statements at the same time, as well as sanctions in some cases. "To get a state to make [such a] statement wasn't easy," Kaljurand told Dark Reading.   

Offensive cyber operations are another area that must be addressed, she said. "Whatever measures that are taken must be in correspondence with international law," Kaljurand stated in the keynote. "It's important to consider the necessity, specificity, proportionality, and harm in case offensive capabilities are used. To have an open discussion on this is better than not having it or having it behind closed doors."

While some 60 to 70 countries today are talking about cybersecurity, hundreds in the developing world are not and need to be reached out to, she said.  

The GCSC so far has issued its set of recommended cybernorms for the protection of the public core of the Internet, but is still working on other security issues.  

How can cyberspace norms be enforced if not all nations comply? "Start with a political statement supporting it and then introduce it as practice, with clear rules of what is allowed and what is not," Kaljurand said in the interview. Ultimately, that will require some sort of international watchdog organization, she added.

Meanwhile, Estonia, like other nations, continues to be targeted by nation-state hackers. "I can't be specific" about the threats, Kaljurand told Dark Reading, but Russia remains active as well as other nations. 

Related Content:

 

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Higher Education: 15 Books to Help Cybersecurity Pros Be Better
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
Worst Password Blunders of 2018 Hit Organizations East and West
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
2019 Attacker Playbook
Ericka Chickowski, Contributing Writer, Dark Reading,  12/14/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
The Year in Security 2018
This Dark Reading Tech Digest explores the biggest news stories of 2018 that shaped the cybersecurity landscape.
Flash Poll
[Sponsored Content] The State of Encryption and How to Improve It
[Sponsored Content] The State of Encryption and How to Improve It
Encryption and access controls are considered to be the ultimate safeguards to ensure the security and confidentiality of data, which is why they're mandated in so many compliance and regulatory standards. While the cybersecurity market boasts a wide variety of encryption technologies, many data breaches reveal that sensitive and personal data has often been left unencrypted and, therefore, vulnerable.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-19790
PUBLISHED: 2018-12-18
An open redirect was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x before 4.0.15, 4.1.x before 4.1.9 and 4.2.x before 4.2.1. By using backslashes in the `_failure_path` input field of login forms, an attacker can work around the redirection target restricti...
CVE-2018-19829
PUBLISHED: 2018-12-18
Artica Integria IMS 5.0.83 has CSRF in godmode/usuarios/lista_usuarios, resulting in the ability to delete an arbitrary user when the ID number is known.
CVE-2018-16884
PUBLISHED: 2018-12-18
A flaw was found in the Linux kernel in the NFS41+ subsystem. NFS41+ shares mounted in different network namespaces at the same time can make bc_svc_process() use wrong back-channel id and cause a use-after-free. Thus a malicious container user can cause a host kernel memory corruption and a system ...
CVE-2018-17777
PUBLISHED: 2018-12-18
An issue was discovered on D-Link DVA-5592 A1_WI_20180823 devices. If the PIN of the page "/ui/cbpc/login" is the default Parental Control PIN (0000), it is possible to bypass the login form by editing the path of the cookie "sid" generated by the page. The attacker will have acc...
CVE-2018-18921
PUBLISHED: 2018-12-18
PHP Server Monitor before 3.3.2 has CSRF, as demonstrated by a Delete action.