As cybersecurity professionals, staying abreast of new regulations and frameworks is crucial to our roles in protecting organizational and national infrastructure. The recent workshop on NIS2, organized in collaboration with Beltug and Howest, provided invaluable insights into the upcoming NIS2 directive and its implications for various sectors. Here are the key takeaways from the event, which featured a presentation by Koen Tamsyn, Business Unit Lead Cybersecurity at INETUM/Realdomen.
State of Cybersecurity 2024
Koen Tamsyn presented a comprehensive overview of the current state of cybersecurity. Despite significant efforts, accurate figures remain elusive due to misreporting or non-reporting. The public sector administration continues to be the most targeted, followed closely by individual attacks.
Key Attack Vectors:
- Ransomware and DDoS attacks are the most prevalent.
- The number of victims posted to ransomware leak sites has surged since 2021.
Entry Points for Attacks:
- Phishing
- Critical Vulnerabilities
- Misconfigurations
- Infected Software
- Weak Credentials
The emergence of Ransomware as a Service (RaaS) has further complicated the threat landscape, with developers distributing ransomware to hackers in exchange for a share of the profits. Lock it 3.0 was highlighted as a prominent ransomware group leveraging these tactics.
Recruitment Channels for Cybercriminals:
- Telegram
The session underscored the importance of tools like Shodan for identifying vulnerabilities and potential entry points.
NIS2 Directive: What, When, How
Effective from October 18th, the NIS2 directive represents a significant evolution in cybersecurity regulations, mandating stringent measures and reporting requirements for incidents.
Key Requirements of NIS2:
- Immediate Reporting: Organizations must report incidents to the Center for Cybersecurity Belgium (CCB) without delay.
- Proactive Measures: Immediate actions are required to mitigate and manage incidents.
Sectoral Coverage:
- Annex 1: Lists sectors of high criticality.
- Annex 2: Covers other critical sectors.
A crucial point emphasized was that compliance with ISO 27001 alone does not guarantee security. The ISO certification is frequently misused and does not ensure the absence of backdoors or other vulnerabilities. Therefore, adherence to NIS2 mandates a more comprehensive approach to cybersecurity.
Challenges and Solutions
Challenges:
- Complexity of CCB Reporting Sheet: The current reporting mechanism can be cumbersome and difficult to navigate.
- Supply Chain Security: NIS2 applies to all companies operating in Belgium and extends down the supply chain, including those using IT services.
Solutions:
- Cyfun Mapping Tool: To address supply chain concerns, the Cyfun mapping tool can help organizations map and manage entities within their supply chain.
Case Studies and Tools
Log4j Incident: The workshop also revisited the Log4j vulnerability, which highlighted the critical need for robust incident response mechanisms and continuous monitoring.
Bulletproof Hosting: The persistence of bulletproof hosting services that protect cybercriminals underscores the importance of international collaboration and stringent regulations.
Conclusion
The workshop provided a detailed roadmap for navigating the NIS2 directive, emphasizing the need for immediate action, comprehensive security measures, and proactive incident management. As cybersecurity professionals, it is imperative to stay informed about these regulations and ensure that our organizations and supply chains are compliant and secure.
For further details, organizations are encouraged to visit the CCB website and leverage tools like the Cyfun mapping tool to enhance their cybersecurity posture.