Kaip apsaugoti visuomenę ir privatų sektorių nuo kibernetinių grėsmių? VFR Informacijos saugumo tarnybos įgyvendinamų iniciatyvų su privačiu sektoriumi pavyzdžiai. Pranešimo autorius – Dr. Uwe Jendricke, Vokietijos Federacinės Respublikos Informacijos saugumo tarnybos kritinių infrastruktūrų kibernetinio saugumo ekspertas (Vokietija). Pranešimas skaitytas konferencijoje – INFORMACINIŲ SISTEMŲ SAUGUMAS, vykusioje 2013 m. balandžio 11d., skirtoje valstybės institucijų ir valstybinės reikšmės organizacijoms.

1. Cyber Security in the
Federal Republic of Germany:
Cooperation with the Private Sector
Dr. Uwe Jendricke
German Federal Office for Information Security
Bundesamt für Sicherheit in der Informationstechnik (BSI)
11.04.2013

2. Our Mission
Information Security for our Society
Prevention
Prevention
Prevention
Positioning to Customers
Operational: Public Sector
 Founded in 1991
 Staff ~ 570 employees
Cooperative: Industry, Science, Media
 Budget: 69 mio. € (2011)
Informative: Citizens
Cyber Security
Cyber Security
Crypto Innovation
Crypto Innovation
CI Security
CI Security
Secure eIdentities
Secure eIdentities
Certification
Certification
Awareness Raising
Awareness Raising
Consultancy & Support for Federal Gov.
Consultancy & Support for Federal Gov.
Reaction
Reaction Sustainability
Sustainability
2

3. Agenda
 Cyber security overview
 Activities of the German government
3

4. Increasing Cyber Attacks
 Spamhaus DDoS
 American Express
http://www.bankinfosecurity.com/american-express-a-5645
4

5. The Dark Side...
Nations
Script
Kiddies
Terrorism
Hacker/Cracker
Organised
Crime
Hacktivism
5

6. Timeline of Cyber Attacks
 Non-profit attacks (since 1999)
 Professional cyber attacks (since 2005)
 Cyber espionage and -sabotage (since 2007)
 Cyber attacks on security infrastructure of the Internet (since 2010)
 RSA token, SSL-CA (DigiNotar),Code-Signing CA
 Cyber attacks on critical infrastructures (since 2011)
 Energy (Saudi Aramco), Finance (US banks), Stuxnet
6

7. Evolution of Attacks
Pinpointing attack
 Manipulation and
Targeted attack sabotage with high
impact
 Complex and long
preparation
Untargeted attack  Espionage,
sabotage,
identity theft  Advanced
 Availability,
 Selected targets Persistent
sabotage, fraud
 Germany 2011: Threat (APT)
 Unspecific target
group Server of Bayer AG  Stuxnet
compromised  Duqu
 2009: Conficker in
hospitals
 2012: Dorifel in
hospitals
7

8. Agenda
 Cyber security overview
 Activities of the German government
8

9. The German Cyber Strategy
2005
The National Plan
for CIIP
2007: CIP
2007: CIP 2007: Fed. Admin.
2007: Fed. Admin.
implementation
implementation implementation
implementation
plan (UP KRITIS)
plan (UP KRITIS) plan (UP BUND)
plan (UP BUND)
2011
The Cyber Security Strategy
National
National National
National „Alliance”
„Alliance” UP KRITIS
UP KRITIS Other
Other
Cyber
Cyber Cyber
Cyber for
for updated
updated measures
measures
Response
Response Security
Security Cyber
Cyber being
being
Centre
Centre Council
Council Security
Security deployed
deployed
9

10. Governmental Activities
Providing Information
information about exchange and
prevention for crisis management
the industry Alliance for critical
UP KRITIS infrastructures
for Cyber (CIIP)
Security
BSI
National
Cyber
Information IPPP Cyber crime
exchange
Response Information
for governmental Centre exchange
agencies for finance sector
10

11. CIP Implementation Plan (UP KRITS)
 Target:
Protection of the German critical IT-Infrastructures
 Public Private Partnership
 Developed in cooperation with the private sector
 Operating since 2007
 Crisis Management
 Exercises
 Resilience
 Information Exchange
11

12. CIP Implementation Plan -
Working groups
Working group 1
Working group 2
Crisis- and emergency
Crisis reaction and mitigation
exercises
Working group 3 Working group 4
Continuity of critical National and international
Infrastructure services cooperation

13. National
Cyber Response Centre
Federal Armed
Forces
Federal
Police
Federal Intelligence
Service
Federal Office for the
Protection
of the Constitution
Federal Office of Civil
Protection
and Disaster Assistance
Federal Criminal Police
Office Customs
Authorities resp. Critical
Criminological Office
Infrastructure Operators
13

14. Alliance for Cyber Security
Situational
Awareness Solutions
Cyber
Security Exchange of
measures experiences
14

15. National
IT Crisis Reaction Centre
 Ensure rapid response to serious incidents
 Enable timely countermeasures
 Avoid more widespread damage
 Standard Operating Procedures (SOPs)
 24x7 availability
 Exercises (also internationally)
15

16. Information Exchange with Private Sector
Alerting in case of crisis, warning
Background information, IT situation reports
Single Points IT situation centre
Companies of Contact at BSI
Company 1
SPOC
of sector
Company 2
...
Company n
Reporting incidents
Open Sources
Governmental
CERT
16

17. Example: American Express DDoS
Alerting in case of crisis, warning
Background information, IT situation reports
Single Points IT situation centre
Companies of Contact at BSI
Company 14) Feedback SPOC 3) Feedback
with companies of sector with sector Generating
Company 2
Reports
...
Company n Analysis
Reporting incidents
1) First Information 2) Feedback with authorities
Open Sources
Governmental
CERT
17

18. Governmental Cyber Security Initiatives
 Non-profit attacks (since 1999)
 Professional cyber attacks (since 2005)
UP BUND UP KRITIS
 Cyber espionage and -sabotage (since 2007)
 Protecting Protecting
Cyber attacks on security infrastructure of the Internet (since 2010)
Governmental Critical
 RSA token, SSL-CA (DigiNotar),Code-Signing CA
Infrastructure Infrastructure
Alliance for
2013 Cyber Security
 Cyber attacks on critical infrastructures (since 2011)
Update:
 Energy (Saudi Aramco), Finance (US banks), Stuxnet
extending to Focussing cyber
smaller CI threats, Private
Sector
18

19. Contact
German Federal Office for Information
Security
Bundesamt für Sicherheit in der
Informationstechnik (BSI)
Dr. Uwe Jendricke
Godesberger Allee 185-189
D-53175 Bonn
Germany
+49-22899-9582-5507
uwe.jendricke@bsi.bund.de
http://www.bsi.bund.de
https://www.bsi.bund.de/EN/Topics/Criticalinfrastructures/criticalinfrastructures_node.html
19