Graeme Cooper, ENISA: “what would happen if sensitive security data was stolen” – Cyber Atlantic 2011 Shows Cyber Security Has No Borders

Cyber Atlantic 2011 exercise is part of an EU-US commitment to cyber security which was made at the EU-US summit in Lisbon on 20 November 2010. –

The event, Cyber Atlantic 2011, was the first joint cybersecurity exercise between the EU and the U.S. Two scenarios were acted out. The first was a targeted, stealth APT (advanced persistent threat) attack aimed at extracting and publishing online secret information from EU member states’ cybersecurity agencies.
The exercise was held the 3rd Nov. in Brussels. The EU’s Network and Information Security Agency and the U.S. Department of Homeland Security worked together to prepare for potential threats that could shut down government operations and put national and world security at risk.
The day-long table-top exercise, “Cyber Atlantic 2011″, is using simulated cyber-crisis scenarios to explore how the EU and US would engage each other and cooperate in the event of cyber-attacks on their critical information infrastructures.
Security experts at Europe’s network and information security agency, ENISA, said that this type of attack was possible in a real-world situation. “It is typical of the type of threat that is out there, although it is not based on any one specific situation. We’ve chosen threats that we think are real, and we haven’t made life easy for ourselves by choosing attacks that are easy to repel,” explained ENISA spokesman Graeme Cooper.
The idea was to battle a simulated cyber attack on security agencies and the energy infrastructure.
Two scenarios were acted out.
In the first scenario, a targeted stealthy cyber-attack (Advanced Persistent Threat – APT) attempts to exfiltrate and publish online, secret information from EU Member States’ cyber security agencies.
The second simulation focused on the disruption of supervisory control and data acquisition (SCADA) systems in power generation infrastructures. This threat is being taken very seriously by EU authorities, particularly in light of allegations that the Anonymous hacker group has attempted to infiltrate French power plants and the widespread Stuxnet attack on Iran’s nuclear facilities.
The aims are to “tackle new threats to the global networks upon which the security and prosperity of our free societies increasingly depend.” The exercise draws on lessons learned in the first pan-European cyber security “stress test” exercise, Cyber Europe 2010, which was facilitated last year by ENISA. ENISA’s role involves supporting EU Member States in organising cyber security exercises and formulating national contingency plans, with good practice guides and seminars.
The aim of the event is to explore how the EU and U.S. would engage each other and cooperate in the event of cyberattacks on their critical information infrastructures, and follows the first pan-European cybersecurity stress test, Cyber Europe 2010, last year.
More than 25 EU countries were involved in the simulation drill. Along with the drill, world leaders met to discuss the threat of cyber attacks and how to best approach them.
The event came a day after the UK’s electronics intelligence agency warned that cyber-attacks against the UK were at “disturbing levels”. Meanwhile, the U.S. has accused both China and Russia of using cyber espionage to steal its trade and technology secrets, in a bid to strengthen its own economic situations, stated in an intelligence report put before Congress.
Lessons learned from Cyber Atlantic 2011 will be used to plan potential future joint EU-U.S. cyberexercises.
“We need to do more to understand the way things operate. We have focused on the IT side obviously, but there would also be wider questions about what would happen if sensitive security data was stolen. That goes alongside securing the IT systems and fighting off attackers and malware,” said Cooper.