Alarming level of cyber threat set for a decade, says Nato

Cyber crime profits

First, is the growing number of threat actors – particularly in the criminal fraternity, largely enabled by relatively low-cost exploit kits that are easy to use.

“Cyber crime and cyber-enabled crime is also relatively low-risk with huge financial rewards, and many cyber criminals are willing to freelance for anyone with money,” said Anil.

Increased opportunity

Second, the “attack surface” has increased significantly and continues to expand with the proliferation of web-based services and internet-connected mobile devices.

“We are now seeing things like IT networks being penetrated through internet-connected air-conditioning systems,” said Anil.

State-sponsored attack

Third, is the growth in “hostile intent” in various conflict regions such as Ukraine, where cyber attacks are becoming low-cost options for aggression and a standard component of military action.

“In addition to protecting Nato’s own IT networks, we are increasingly working with member states and partner countries to defend against offensive cyber capabilities of other nation states,” said Anil.

NCIP consultation with industry

This week, Nato is meeting industry representatives at its annual information assurance symposium to discuss the proposed Nato cyber industry partnership (NCIP) to gauge interest.

Also on the agenda will be what benefits industry partners expect from the NCIP, what things could be shared, ways of building trust, and at what level they can work with Nato.

Nato will seek to use the symposium to set short-term, medium-term and long-term goals for the NCIP and to set an agenda to get the initiative up and running.

The NCIP will attempt to replicate at a Nato national level the private-public partnerships in member countries such as the UK’s cyber security information sharing partnership (Cisp).

The NCIP is aimed at enabling Nato to work with industry on issues such as supply chain management, risk assessment, information assurance and early warning best practice.

Earlier this month, Nato leaders adopted a cyber defence policy that draws no distinction between cyber attack and physical attack as a trigger for collective defence at the Nato 2014 summit in Wales.