Industrial Internet of Things (IIoT) can generate opportunities for the aviation industry

From the perspective of the Dutch population, it is estimated that the occurrence of wildfires, extreme weather, radiation accidents and financial crises are more frequent.

Cyberattacks to Industrial Automation Control Systems (IACS) in vital infrastructure could lead to large incidents and consequences. Therefore, the government should keep an eye on organisations in the vital sector. Involved sectors believe it is important to show to the public that they are secured and safe out of their social responsibility.

Most risk profiles focus on the failure of utilities (especially ICT and telecommunications), failures at hospitals and BRZO companies and cascade effects. The top 4 risks include failure of vital infrastructure, disruption of the continuity of own assistance, disruption of BRZO companies, and hack of data centers.

The number of left-wing and anarchist related terrorist attacks has varied since 2015. Whilst in 2015 the number of incidents was 13, an increase can be seen in 2016 (27) and 2017 (24). A drop in the number incidents followed in 2018 (19), but reached the levels of 2016 and 2017 again in 2019 (26). In 2019, all of the attacks were committed in Greece (2), Italy (22) and Spain (2).

In 2019, a sharp increase can be seen regarding the number of arrests on suspicion of left-wing or anarchist terrorism. Whilst the number of arrests was respectively 36 and 34 in 2017 and 2018, in 2019 this number increased to 111. Most of the arrests were related to confrontations and violent demonstrations in Italy (71 of 111). These arrests were made on the suspicion to commit a terrorist attack in combination with membership to a terrorist group.

Because of the increasing digitalization criminality also made a move in that direction. Cyber criminals have become increasingly professional and make use of advanced and refined techniques. Because there is relatively a lot of news coverage on cyber incidents and there is a significant threat of cyber criminality in the privates sphere the awareness of the threats has increased. Unfortunately this awareness does not translate into awareness on the work floor even though companies are also a target of cyber criminals.

The two primary risks facing IoT are: 1. Consumer privacy and safety are being undermined by the vulnerability of individual devices, connectivity, and back-ends; and 2. The wider economy and critical infrastructures face an increasing threat of large-scale cyber-attacks launched from massive numbers of insecure IoT devices. At this moment less than 4% of IoT devices are secure by design Additionally, IoT faces several threats and vulnerabilities, namely: vulnerable device software, privacy threat, eavesdropping, DDoS, firmware-level attack, device cloning or substitution, data leakage, malware, and weak user/admin credentials and authentication.

A complete and clear picture of the digital resilience of vital processes and associated systems is (still) lacking. Gaining a complete understanding, including the extent to which measures are effective and efficient, is complex. For example, reliable methods and techniques to measure resilience for an assessment of the risks to national security are still under development. The supervision of cyber security in the context of the Wbni has not existed for very long for a number of supervisors. This year, however, the first effects are visible of better insight among regulators into the digital resilience of providers of vital processes.

The AIVD and MIVD regard the possible digital disruption and sabotage of the vital infrastructure as one of the greatest cyber threats to the Netherlands and its allies. Multiple states have demonstrated the ability and willingness to deploy digital sabotage to achieve their geopolitical goals. The AIVD has been observing for some time that some of these states are making preparations to make digital sabotage possible for future use. These preparations consist of the embedding in ICT systems of, among other things, vital infrastructure. In 2019, the MIVD also recognized various preparatory sabotage activities aimed at Western countries and allied interests. At the moment, states lack the intention to use digital sabotage against the Netherlands. However, this intention is changeable and depends on geopolitical developments.

CHERNOVITE is the developer of PIPEDREAM, a modular ICS attack framework and the seventh known ICS-specific malware, following STUXNET, HAVEX, BLACKENERGY2, CRASHOVERRIDE, TRISIS, and Industroyer2. CHERNOVITE’s PIPEDREAM is the first ever cross-industry disruptive/destructive ICS/ OT capability. It represents a substantial escalation in adversarial capabilities. CHERNOVITE possesses a breadth of ICS-specific knowledge beyond what has been demonstrated by previously discovered threat groups. The ICS expertise demonstrated in the PIPEDREAM malware includes capabilities to disrupt, degrade, and potentially destroy physical processes in industrial environments. PIPEDREAM is the first scalable, cross-industry ICS attack framework known to date. While PIPEDREAM itself is a new ICS capability, its emergence is also indicative of the trend toward more technically capable and adaptable adversaries targeting ICS/OT. In addition to implementing common ICS/ OT-specific protocols in PIPEDREAM, CHERNOVITE improved the techniques from prior ICS malware. CRASHOVERRIDE, and the associated threat group, ELECTRUM, exploited the OPC Data Access (OPC DA) protocol to manipulate breakers and electrical switchgear. CHERNOVITE, on the other hand, uses the newer but comparable OPC UA protocol. Dragos assesses with high confidence that a state actor developed PIPEDREAM intending to leverage it in future operations for disruptive or destructive purposes. Dragos assesses with moderate confidence that CHERNOVITE represents an “effects/impact team” instead of an “access team” — meaning, that PIPEDREAM was designed to be leveraged for impact after the initial access into the target environment has been obtained by another threat group. Most likely, CHERNOVITE developed PIPEDREAM’s capabilities for a malicious operator with the intent and motivation to access, manipulate, and disrupt OT environments and processes. PIPEDREAM’s capabilities can provide an adversary with a range of options for learning about a target’s OT network architecture and identifying its assets and processes. This information can set the stage for disruptive and destructive effects, but it also increases an adversary’s knowledge to develop even more capabilities to disrupt or destroy on a much broader scale. In its present form, the PIPEDREAM attack framework could be leveraged to target equipment in multiple sectors and industries. Given PIPEDREAM’s modular nature, CHERNOVITE could easily adapt it to compromise and disrupt a broader set of targets.

During 2022, Ukraine saw increased threat group activity targeting its energy and critical industrial infrastructure sectors. Russia’s 2022 invasion of Ukraine provided opportunities for Russia-aligned actors to use their cyber offensive capabilities preemptively and in parallel to its kinetic attacks. As Western countries placed sanctions on Russia and indicted key members of Russian cyber operations, the U.S. government’s Cybersecurity and Infrastructure Security Agency (CISA) prepared for potential retaliation by issuing a call for “Shields Up,” which included actions to safeguard ICS and OT environments There were eight active threat groups: BENTONITE, CHERNOVITE, ELECTRUM, ERYTHRITE, KAMACITE, KOSTOVITE, WASSONITE and XENOTIME.

Due to rising cybersecurity threats, the focus in cybersecurity has shifted from prevention to resilience. Moreover, as a result of increasing IT/OT convergence, the threat landscape for OT-security, including vital infrastructure, has changed.

Ransomware remains the most dominant threat as criminals increase pressure by threatening publication of data if victims do not pay. Ransomware on third-party providers also creates potential significant damage for other organisations in the supply chain and critical infrastructure.

Cybercriminals are increasingly using ransomware to target city-wide services and municipalities. Consequently, the combination of AI and ransomware could potentially have even more damaging effects to such targets. Other targets, such as critical infrastructure and essential services are also highly vulnerable for AI-supported ransomware attacks. Damage to before mentioned targets can have serious consequences for a large geographical area.

De digitale dreiging voor de Nederlandse samenleving groeit door toenemende cyberaanvallen van statelijke actoren die inzetten op beïnvloeding, espionage, verstoring en sabotage. Sectoren zoals de gezondheidszorg, hightech, energievoorziening, vervoer en defensie lopen ernstige risico’s.

Door technologische ontwikkelingen zoals AI en quantum computing, kunnen de Nederlandse maatschappij en economie beter worden beveiligd. Het zorgt echter ook voor een toenemende mate van afhankelijkheid van digitale processen, wat leidt tot kwetsbaarheid voor cyberincidenten en -aanvallen. Het is daarom van cruciaal belang om effectieve cybersecuritymaatregelen te ontwikkelen en daarmee de scheefgroei tussen dreiging en weerbaarheid te verminderen.

The world market for IA/PP products reached $6.98Bn in 2019 and will grow to $8.83Bn in 2024 at a CAGR of approximately 4.8%, the highest growth we have recorded in the last 11 years. Perimeter security has become a much more important issue in critical infrastructures such as utilities, transportation, government and defense establishments because of the increasing number of threats, which could disrupt operations and lead to huge losses across the whole economy. Demand for IA/PP systems has grown at a faster pace through the integration with Video Surveillance and Access Control. Demand for intruder sensors and alarm products being the staple products of this business have had only a marginal impact on growth in demand. IA/PP is now pushing forward by applying and connecting; radar, thermal / multi-sensor cameras, advanced sensor technologies, wireless technology and also deeper integration with video surveillance & access control. The main driver for growth in the next five years will be the increase in investment in industrial complexes particularly in Asia and the BRIC countries and advances in sensor technologies microwave, active infrared, passive infrared, fiber optics and acoustic sensors. These sensors usually cover large areas and offer volumetric protection by detecting the motion of the intruder within the protected space.

They’ve overtaken user behavior, which was the biggest challenge from last year’s report . With a zero-trust framework, you can identify and verify every person and device trying to access your infrastructure. Zero trust is a pragmatic and future-proof framework that can help bring effective security across your architecture – spanning the workforce, workload, and workplace. A zero-trust framework achieves these three success metrics, among others: • The user is known and authenticated • The device is checked and found to be adequate • The user is limited to where they can go within your environment Having zero trust in place removes much of the guesswork in protecting your infrastructure from all potential threats, including mobile devices.

• The biggest threats are espionage, disruption and sabotage. • The government does not have sufficient resources to deal with an incident adequately. • Increasing digitization and geopolitical tensions are causing an increase in the scale, spread and impact of cyber incidents. • Improvisation based on mandate and cooperation prevails. • By practicing and experiencing a simulated cyber incident, we work on better preparation.

For the next decade, an annual investment of €1.4 billion will be made in order to improve the region of South-Holland. This investment is made in order to combat the effects of the COVID-19 crisis, high unemployment, lagging economic growth and CO2 emissions. Besides, this investment provides an impulse to the current housing challenges and accessibility and liveability of the region. Besides regional impact, the investments will also have cascading effects for the Netherlands as a whole.

This report titled "Cybersecurity Dreigingsbeeld voor de zorg 2023" by Stichting Z-CERT provides an overview of cybersecurity threats in the Dutch healthcare sector for 2023. It highlights the following key dangers: Ransomware, dataleaks (hacking), espionage, ransomware at distributor, DDoS at distributor, financial fraud, DDoS, and dataleaks (phishing). The report emphasizes the importance of cybersecurity measures like multifactor authentication and vigilance against evolving cyber threats. It also discusses the impact of generative AI in cyberattacks and the need for enhanced security protocols. Additionally, the document addresses the significance of collaboration between healthcare institutions and their suppliers to strengthen information security. Overall, the report underscores the critical need for robust cybersecurity practices to safeguard sensitive healthcare data and systems from malicious cyber activities.

Despite technology enabling threat actors to become even more sophisticated, there are still active and evolving risks from tried and tested ransomware techniques. And there is consistency of ranking for the top targeted industries throughout Q3 of calendar year 2021, with ransomware threat actors proving most successful against the manufacturing industry, followed by financial services, healthcare, technology and construction.

Accenture has observed a huge growth in the underground market for vulnerability exploits, especially for those that enable adversaries to gain unauthorized access to a corporate network. The ransomware and unauthorized network access markets almost certainly significantly affect exploit markets, as unauthorized network access is fundamental to successful ransomware operations

The Dutch ICT infrastructure is also abused by state actors in cyber attacks on other countries. The Netherlands is attractive for this because the digital infrastructure is of high quality and ICT capacity can be rented relatively easily. This form of abuse can damage the international image of the Netherlands and it can be bad for allied interests and the integrity of the Dutch ICT infrastructure. As in previous years, the Dutch ICT infrastructure was also abused for various forms of cybercrime, including for facilitating cyber attacks. Dutch servers are also abused for botnet spam. Of all servers that cyber criminals worldwide use for spamming via botnets, approximately 6.3 percent are located in the Netherlands.

Incident investigations often lead to dead ends, as asset information is often missing, including asset ownership and overall relevancy. In combination, these issues make it challenging for responders to determine what to do when they validate a compromise.

According to the ANSSI (the French counterpart of the NCSC), one of the main challenges to cybersecurity in France is that there has been an increase in attacks on vital infrastructure, including on hospitals. This could have to do with the implementation of mandatory reporting, but should still be kept in mind. Furthermore, it is important to increase awareness about the existing threat level and to increase cyber resilience.

Security experts within the healthcare sector state that data breaches are the second biggest concern (after ransomware). Data breaches can have a variety of causes. In order to get a better understanding of this threat, Z-CERT asked health care institutions in which categories they had data breaches in 2021. Based on that, the following top 9 of data breaches was made: human mistakes, unauthorized access by employees, loss of hardware or paper, theft of hardware or paper, unauthorized external access, malware on user computers, use of stolen passwords and usernames, hacking of web applications and hacking of servers.

The ten most important measures to prevent ransomware attacks from happening or to limit the impact.

Experts consider phishing to have been a major problem for healthcare facilities in 2021. These institutions regularly received phishing emails that were not always stopped by spam filters. One third of the questioned healthcare institutions admitted successful attempts to steal user names and passwords. All in all, seventy sets of login data were stolen. This did not always lead to data leaks. One healthcare institution, for example, reported ten phishing incidents within the year 2021, but none of these resulted into a data breach, thanks to the required multi-factor authentication.

The Dutch healthcare sector is interesting for state actors. A lot of innovative research is taking place in the Netherlands, for example with regard to COVID-19, which draws the attention of state actors. Different branches of the healthcare sector, like hospitals, laboratories, the GGZ and more, are conducting valuable research. Z-CERT is aware of the fact that at least thirteen cyber groups have been paid by states that have shown interest in the Netherlands and in healthcare. This poses a potential threat.

An interesting case for the Netherlands is the issue of water security. It is a traditional and typically Dutch security topic. Today, these efforts are being combined with a cyber related aspect. Today there is a desire to link the information from various water management structures together. However, this does entail increased risks.

The dark web has provided a platform for cybercriminals to exchange tools, expertise and contact details to orchestrate attacks and scams. This level of coordination is new and has resulted in more sophisticated attacks against targets in the EU.

Identificatie van risico’s (mogelijke oorzaak, kans en impact van een incident) • Identificeer vitale processen en digitale infrastructuur op het niveau van de stad. • Definieer dreiging en ontwikkel scenario’s. • Begrijp de risico’s op het niveau van de stad: welke kwetsbaarheden en (keten)afhankelijkheden zijn er? Wat is de waarschijnlijkheid dat een incident zich voordoet? En wat zijn de mogelijke gevolgen hiervan? • Ontwikkel een doorlopend situationeel beeld en publiceer hier periodiek over.

The call for more police on the streets has always been around, but recently the organization has been under a lot of pressure. People working for the police emphasize the three developments within society. These developments will have an impact on social disorder and the current police work: the corona pandemic, an increase in contradictions and tensions in society, and the declining trust in the government and its agencies. These developments will be further explained.

The physical and digital worlds are overlapping more strongly due to the pandemic. According to the National Cybersecurity Center (NCSC) the pandemic has permanently changed the digital landscape. Cybercrime took a major flight. New developments within the digital domain follow each other in rapid succession. There is an increasing pressure on the government to fulfill its role within the digital domain. Experts warn that a solid approach to cybercrime can no longer be put off. Traditional forms of crimes are getting more digital, therefore a transformation is needed within the police force.

Bird strikes can have a significant impact on the aviation industry. From damage and downtime of operational aircrafts, to the complete loss of aircrafts and lives. In order to prevent bird strikes from occurring and to increase flight safety at national air bases, new bird radar systems have been developed. These bird radar systems enable flight controllers to gather objective and persistent knowledge of bird movements on and around an air base.

An organization must be able to respond to a successful cyber attack and security incident in an appropriate manner. That is why it is so important to undertake digital investigations and initiate corrective action.

To resist cyber attacks, it is necessary to take preventive measures. This way you block or delay cyber attacks and discourage the attackers.

AI is the new arms race, but unlike earlier arms races, anyone can get involved – there’s no need for the sort of resources that were previously only available to governments. This means that while AI is undoubtedly being researched and developed as a means of crippling an enemy state’s civil and defense infrastructure during war, it’s also easily deployable by criminal gangs and terrorist organizations. So rather than between nations, today’s race is between hackers, crackers, phishers and data thieves, and the experts in cybersecurity whose job it is to tackle those threats before they cause us harm. Just as AI can “learn” to spot patterns of coincidence or behavior that can signal an attempted attack, it can learn to adapt in order to disguise the same behavior and trick its way past our defenses. This parallel development of offensive and defensive capabilities will become an increasingly present theme as AI systems become more complex and, importantly, more available and simpler to deploy. Everything from spam email attempts to trick us into revealing our credit card details to denial-of-service attacks designed to disable critical infrastructure will grow in frequency and sophistication. On the other hand, the tech available to help us avoid falling victim, such as deep learning security algorithms, automation of systems that are vulnerable to human error, and biometric identity protection, are getting better too.