NATO & EU Form Cybersecurity Partnership

Orange:NATO  Blue:EU  Purple:Both

NATO and the European Union are improving information sharing on the cyber threat and bolstering collaboration on potential solutions. The two organisations seek to increase the relevance of shared data and are discussing the potential for sharing classified information.

Although they have very different missions, NATO and the European Union (EU) face a similar threat in cyberspace, officials say. NATO engages in peacekeeping, humanitarian and military missions, while the EU focuses on economics across the continent.

But both were forced to defend their critical networks when the WannaCry ransomware and the NotPetya malware began infecting systems across the globe. EU officials estimate that businesses faced more than 4,000 ransomware attacks per day last year, and 80 percent of European companies experienced at least one cyber-security incident.

The economic impact of cyber-crime has risen fivefold over the past four years alone, according to EU documentation.

Gregory Edwards, director of infrastructure services for the NATO Communications and Information Agency (NCI Agency), notes that the threat has evolved to the point that it is now difficult to determine whether an attack is being carried out by so-called hacktivists, criminal organisations or nation-states.

“It’s hard to tell which is which. What you think is ransomware designed to extort money can have a completely different purpose, so you end up defending against everyone at the same level,” he asserts.

In February 2016, the two organisations signed a technical arrangement on cyber defense that allows information sharing between the NATO Computer Incident Response Capability and the Computer Emergency Response Team of the European Union (CERT-EU). The technical arrangement provides a framework for exchanging information and sharing best practices between emergency response teams.

For instance, the EU cyber response team can now share and access unclassified cyber threat data provided through NATO’s Malware Information Sharing Platform (MISP), a portal put in place several years ago to improve cyber situational awareness among partner nations.

“The Malware Information Sharing Platform is a method by which users can provide information on threat activities. We adopted it for NATO and now allow them [the EU response team] to use it,” Edwards explains. “Some partner nations are allowed to use it, and industry as well.” He adds that the portal receives about 50 entries each month.

The portal allows sharing of technical characteristics of malware without having to offer up more sensitive information about the context of an incident. It combines a searchable repository with a multidirectional information-sharing mechanism.

The portal’s aim is to speed up the detection of incidents and the production of defense countermeasures, especially for malware that is not blocked by antivirus protection, or that is part of sophisticated targeted intrusion attempts.

Malware experts can use the system to discover the indicators of compromise they need to correlate with their findings and to update detection systems. The portal also includes malware samples and a wide variety of technical information on malicious software.

MISP is an interactive platform that sends a notification each time something new is shared, provides automation for easy import and export of data, and integrates with cyber defense tools. MISP is secure but accessible via the Internet. The MISP portal is malware-based right now, but it could one day provide a broader array of information, including lessons learned.

Although MISP currently includes only unclassified data, NATO officials built it with the intent of one day sharing classified information as well. “We would love to do that. The system has the ability to go there. It is just up to the community to agree,” Edwards offers.

“We have to continue communicating and see if there is a noticeable will to do more to up the level of information sharing to more protected or more inclusive information. It would let us strengthen the defense of both enterprises.”

The MISP system provides some automation mechanisms enabling the import and export of data and interfacing with other systems, but Edwards reports that some users are advocating for additional automation tools to improve data sharing and analysis.

 “The community wants a tool that will be able to automatically ingest information and speed up the analysis of that information for improved situational awareness. We’re chasing that quite heavily,” Edwards says.

He also stresses the need for NATO and the EU to provide only relevant information. “We don’t want to just share information, but to share pertinent information. We need to start providing more meaningful data that is actionable, and we are discussing how to do that,” Edwards states.

The NATO-EU collaboration has proved beneficial during high-profile cyber-attacks, including WannaCry and NotPetya, he reports. Although he cannot provide details, Edwards says the partnership improved situational awareness for both organizations and allowed for a faster, more effective response.

“Anytime we have information sharing, it means we have greater situational awareness. The 29 nations may see different things. They may react differently. If we can put all of that information together and collaborate, it allows everyone to be more effective,” Edwards asserts.

The partnership also allows the EU to participate in cyber-related NATO exercises such as Cyber Coalition and Locked Shields. Cyber Coalition is NATO’s flagship cyber exercise.

The most recent event took place last November and included more than 700 participants from 25 allied nations as well as NATO partner countries, the EU, industry and academia. The exercise tests and trains cyber defenders from across the alliance in their ability to defend NATO and national networks.

From defending against malware to tackling hybrid challenges involving social media to handling attacks on mobile devices, the exercise uses realistic scenarios to help prepare cyber warriors for real-life challenges.

Locked Shields is an advanced technical live-fire network defense exercise. This annual scenario-based, real-time international event, which has been organized by the NATO Cooperative Cyber Defence Centre of Excellence since 2010, focuses on training for security experts who protect national information technology systems.

The exercises are often used to evaluate cybersecurity tools, and NATO and EU officials share information about which tools they find useful. The two organizations do not partner in the development or acquisition of cybersecurity technologies, but Edwards says this might make sense in some cases.

It might be possible, for example, to save money on enterprise-level software licensing agreements. He cautions, however, that while NATO and EU officials are discussing the possibility, no policy has been established to pursue a joint procurement effort.

The NATO-EU partnership offers lessons learned that benefit both parties. Edwards cites some innovative uses of open source information that NATO picked up from EU cyber experts. And the collaboration will only improve, he predicts, as participants grow more comfortable releasing cyber-related information. “Trust develops over time,” he says.

AFCEA

You Might Also Read:

Which Countries Are Ready For Cyberwar?:

NATO Could Go To War In Response To A Cyber Attack:

 

« Increase In State-Sponsored Cyber Attacks
Swedes Turn Against Cashlessness »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

Directory of Cyber Security Suppliers

Directory of Cyber Security Suppliers

Our Supplier Directory lists 7,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

RiskLens

RiskLens

RiskLens is a software company that specializes in the quantification of cybersecurity risk.

Illumio

Illumio

Illumio delivers adaptive security for every computing environment, protecting the 80% of data center and cloud traffic missed by the perimeter.

National Association of State Chief Information Officers (NASCIO)

National Association of State Chief Information Officers (NASCIO)

NASCIO's Cybersecurity Committee focuses helps state CIOs to formulate high-level security and data protection policies and technical controls.

Samsung Knox

Samsung Knox

Samsung Knox brings multi-layered defence-grade security to your business’s smartphones and tablets.

TEISS

TEISS

Teiss.co.uk is a website dedicated to providing information about cyber security. TEISS also provide a series of conferences and events focused on cyber security.

Untangle

Untangle

Untangle provides network security products designed specifically for the below-enterprise market, safeguarding businesses, home offices, nonprofits, schools and governmental organizations.

International Association of Security Awareness Professionals (IASAP)

International Association of Security Awareness Professionals (IASAP)

IASAP provides a members-only virtual sharing platform where security awareness professionals engage in a lively, year-round exchange of information and ideas.

AML Global Solutions (AMLGS)

AML Global Solutions (AMLGS)

AMLGS delivers Financial Crime prevention training programmes and consultancy services encompassing Anti-Money Laundering (AML), Counter Terrorism Financing (CTF), Bribery & Corruption and Fraud.

Realsec

Realsec

RealSec is an international company and is a developer of encryption and digital signature systems and Blockchain for the Banking and Methods of Payment sectors, Government and Defense and Multisector

Seccuri

Seccuri

Seccuri is a unique global cybersecurity talent tech platform. Use our specialized AI algorithm to grow and improve the cybersecurity workforce.

Clearvision

Clearvision

As an Atlassian Platinum Solution Partner, Clearvision works with teams in the UK and US, providing solutions for the Atlassian stack, Git and open source tooling.

Bright Data

Bright Data

Bright Data Inc is the world’s #1 web data platform, enabling organizations to research, monitor, analyze data, and make better decisions.

Computacenter

Computacenter

Computacenter is a leading independent technology partner, trusted by large corporate and public sector organisations. We help our customers to source, transform and manage their IT infrastructure.

Badge

Badge

Badge authenticates you on-demand for every application, on any device, without storing any secrets.

DeltaSpike

DeltaSpike

DeltaSpike empowers individuals and organizations worldwide through its comprehensive cybersecurity solutions.

Harmonic Security

Harmonic Security

Harmonic Security helps companies to adopt Generative AI without risking the security and privacy of their data.