- Home >
- Services >
- Access to Knowledge >
- Trend Monitor >
- Domain of Application >
- Trend snippet: Cyber incidents that occurred in The Netherlands from March 2020 to March 2021
Trends in Security Information
The HSD Trendmonitor is designed to provide access to relevant content on various subjects in the safety and security domain, to identify relevant developments and to connect knowledge and organisations. The safety and security domain encompasses a vast number of subjects. Four relevant taxonomies (type of threat or opportunity, victim, source of threat and domain of application) have been constructed in order to visualize all of these subjects. The taxonomies and related category descriptions have been carefully composed according to other taxonomies, European and international standards and our own expertise.
In order to identify safety and security related trends, relevant reports and HSD news articles are continuously scanned, analysed and classified by hand according to the four taxonomies. This results in a wide array of observations, which we call ‘Trend Snippets’. Multiple Trend Snippets combined can provide insights into safety and security trends. The size of the circles shows the relative weight of the topic, the filters can be used to further select the most relevant content for you. If you have an addition, question or remark, drop us a line at info@securitydelta.nl.
visible on larger screens only
Please expand your browser window.
Or enjoy this interactive application on your desktop or laptop.
Cyber incidents that occurred in The Netherlands from March 2020 to March 2021
2.1 COVID-19 an opportunity for malicious actors
The global COVID-19 pandemic strongly influences the Retrospective. The pandemic was and is being exploited by malicious actors. Criminals are exploiting the COVID-19 pandemic for attacks through phishing, ransomware and distribution of malicious apps. They are increasing the pressure to pay ransom by launching ransomware attacks on the processes of organisations that are crucial in the fight against COVID-19, including patient care facilities, medical suppliers and laboratories. For example, the Dutch healthcare sector was advised by Z-CERTII in close cooperation with the NCSC following a ransomware attack on a medical supplier. The need in society for information and financial support under COVID-19 has been exploited frequently in phishing campaigns as a stepping stone for attacks. These were often pre- existing malware campaigns in which the theme of emails, malicious attachments and links were adapted to COVID-19.
2.2 Targeting facilities for remote working
Technical facilities to work remotely became necessary for continuity of business operations. In addition, the potential for exploiting vulnerabilities increased; for the attack surface had been greatly increased.
Remote working facilities can be divided into three categories:
-
Online meeting facilities such as Zoom, Teams, Jitsi, Google
meet, and Webex.
-
Facilities to remotely control the office environment or office
applications such as Virtual Desktop Infrastructure (VDI),
Remote Desktop Service (RDS) and TeamViewer.
-
Systems to connect to the office at network level: VPN
solutions.
Vulnerabilities and non-secure use were observed in all categories during the reporting period. VPN and VPN-SSL solutions are constantly being scanned for vulnerabilities by malicious parties.
Not all incidents involving home working facilities have a similar impact. This depends on the type of misuse, the processes involved and the actor. Misuse of meeting facilities is usually carried out by cyber vandals. Misuse of underlying network solutions is not readily detected, is more likely to be persistent and forms a greater risk to processes. Exploitation of existing vulnerabilities has more impact due to the increased attack surface.
There is also a fourth (unofficial) category of remote working facilities: shadow ICT; solutions that are not part of the approved office applications, but which are used for work-related purposes. Examples are messaging apps, private email and private cloud applications. This category has also gained in importance because, as a result of COVID-19, there was a need for workarounds to quickly share information and documents.
2.3 Deliberately denying access to processes
There are many ways to deliberately deny access to processes. The two most important are disruption with a DDoS attack and the use of ransomware.
DDoS: bigger, heavier and longer lasting attacks
In the reporting period, digital processes of Internet Service Providers (ISPs), the financial sector, education and public organisations were affected by DDoS attacks. Notable was the trend towards heavier and more complex attacks combining multiple attack vectors. In its annual DDoS data report, the Dutch Internet Providers Management Organisation states that DDoS attacks have become more powerful and complex in 2020, while the number and duration of DDoS attacks has also increased. Attackers are said to have above-average skills. They target the underlying infrastructure and the attackers often change misused protocols, which makes defending difficult.
Ransomware leads to inaccessible processes and irreversible damage
During the reporting period, actors held key systems hostage with ransomware attacks. As a result, digital processes of public organisations, among others, (largely) came to a standstill and irreversible damage was caused to ICT systems. The method used to perpetrate ransomware attacks has changed significantly in recent years. There has been a move towards Big Game Hunting, compromising carefully selected organisations. These are usually wealthy organisations, responsible for continuity of processes or in possession of unique data. The pressure on the victim is greatly increased by the ransomware being deployed at the most strategic location in the network. In addition, the means of applying pressure has also changed. Where initially data or systems were encrypted, now data is also stolen and threatened to be made public. This explains the selection of targets such as knowledge institutions (universities and colleges), hospitals and pharmaceutical companies and public organisations such as municipalities.
2.4 Attacks on organisations in supply chains
An attack on supply chains does not target a specific organisation, but one (or several) weak spots in the chain. The actor can hit many organisations via that weak spot(s). Conversely, every organisation has to deal with supply chains and therefore with vulnerabilities to attacks via these chains. For chains to function efficiently, it is necessary to share more and more information with chain partners. This makes cyber risks also a risk of the chain, because malicious parties will deliberately seek the weakest link.
2.5 Large amounts of business- and privacy-sensitive information made public
Digital processes are partly concerned with collecting, selecting, processing and distributing information. Virtually any disruption of a digital process therefore results in data breaches. The most important distinction is between data breaches that occur deliberately (through the actions of a malicious actor) and unintentional data breaches, leaving behind a USB stick for example. In total, tens of thousands of data breaches (deliberate and unintentional) occur in the Netherlands every year. Last year, 23,976 data breaches were reported to the Dutch Data Protection Authority (DPA). These can be extensive: in March 2021, it emerged that private data of possibly millions of Dutch car owners had been stolen and were for sale on the Internet. This includes name and address details, e-mail addresses, vehicle registration numbers, telephone numbers and dates of birth. The data was stolen from RDC, an ICT service provider for car companies.
2.6 Non-functioning processes due to system failure
A cyber incident leads to disruption of one or more processes. This may be a deliberate disruption by a malicious actor. It may also include system failures due to natural or technical causes or due to unintentional human action. In terms of concrete impact, it makes little difference whether a process is unavailable due to disruption by a malicious actor or due to system failure. The aforementioned accelerated digitisation means that analogue and physical fallback options are disappearing at an equal pace.