Cybersecurity at Dutch organisations could be even better
Hackers target tyre manufacturer Apollo Vredestein
Our mission is to make the internet even safer and more accessible than it already is in the Netherlands. Although there are few countries where using the net involves less trouble or risk, there's still room for improvement. While a growing proportion of the business community takes cybersecurity very seriously, things sometimes go wrong, even at respected companies.
For example, we learnt this week that tyre manufacturer Apollo Vredestein had been hacked by people exploiting well publicised software vulnerabilities. The hackers took the company's systems down for several days. And, according to the experts, the incident is far from unusual: cybersecurity at many Dutch organisations leaves something to be desired. So, why is that?
Security issues often down to misunderstandings
No business chooses to operate insecurely, but many overlook important precautions that could be taken. For example, our recent survey of cybersecurity in the Dutch SME sector found that most IT vendors didn't think their business customers paid enough attention to cybersecurity. Too many businesses imagine that their IT vendors have everything covered. Often, it seems, no clear arrangements are made about who's responsible for what.
Greater insight helps businesses prevent hacking
The key to preventing such misunderstandings is insight. What risks does your business face, and whose job is it to do something about them? Fortunately, building a clearer picture of your security status is easier than you might think. After news of the Apollo Vredestein hack broke, various external experts pointed out that the organisation was using out-of-date systems. Simple scans performed from outside highlighted exploitable vulnerabilities, although Apollo Vredestein says that the issues in question weren't linked to the incident.
Big differences within sectors and industries
Situations such as that at Apollo Vredestein aren't uncommon. Organisations in all sectors of the Dutch economy are in a similar position. Fortunately, however, a growing proportion of firms do have cybersecurity under control. One important explanation for the diversity in the cybersecurity landscape is that incidents often go unreported. It's common practice to hush things up, and when news does leak out it tends to involve spectacular hacks on big organisations in critical sectors, such as banking. As a result, many SMEs wrongly assume that being relatively small and having no links to the financial services industry means that they won't get targeted.
Cybercrime is evolving all the time
Cyber-criminals are constantly changing their methods. Today's hackers take a different approach to finding victims, often using automated systems to trawl the internet for known vulnerabilities or human factors that lend themselves to exploitation. It doesn't matter much what sector a company trades in, and even relatively small firms can make attractive targets.
Incident response frequently lacking
Because we support organisations in all parts of the economy, the consequences of that trend are clear to us. Time and again, we've seen an incident in one sector create unease and a sense of urgency amongst closely related firms, while those in other sectors pay little or no attention. The ransomware attack on the University of Maastricht prompted a rush for protection by large educational institutions, for example. And we fully expect the Apollo Vredestein hack to serve as a wakeup call for that company's competitors, suppliers and other contacts.
Invest in insight!
However, the further away from the victim an organisation is, the less concern such incidents provoke. As a result, a false sense of security prevails amongst many SMEs. Our advice to those firms is simple: invest in insight. Make sure you know where you're vulnerable, then talk to your IT vendor about appropriate protection. One way of gaining the necessary insight is by using CyberSterk.