Dutch Security Report Portal promotes cyber-resilience

Dutch Security Report Portal

"Early in 2020, twenty individuals and organisations formed the Anti-Abuse Network (AAN), a coalition dedicated to promoting digital resilience and fighting internet abuse," says Octavia. "The AAN now has about thirty members, including entrepreneurs, researchers, non-profit organisations and government representatives. SIDN is one of them. First of all, the members mapped the online information flows between relevant actors in the Netherlands. The resulting map revealed just how complex the information flows are, although they are vital for increasing the nation's digital resilience. We therefore set up the Dutch Security Report Portal with a view to simplifying and promoting the exchange of information. The initiative is based on the clearing house concept, which is well known and widely used in the financial services industry. The Portal plays a similar role to a clearing house. It's an independent, trusted body that acts as an operational intermediary to facilitate the exchange of information, including confidential information." The Dutch Security Report Portal receives reports from DIVD, the National Cyber Security Centre and other 'notifiers'. The Portal then automatically forwards details of the reported vulnerabilities and internet abuses to trusted bodies, such as Connect2Trust, NBIP or SURFcert, for onward distribution to affiliated organisations. The Portal works with the bodies in question to ensure that individual organisations in the Netherlands are alerted to an issue only once and by a single trusted body. Information is additionally sent to internet service providers and hosting service providers, in order to get it to organisations that aren't affiliated to any of the trusted bodies and haven't asked to be alerted. The Portal makes use of two existing platforms: Connect2Trust's ThreatMatcher Intelligence Platform and NBIP's Clean Networks Platform. "We think it's important that all organisations in the Netherlands receive information about vulnerabilities and internet abuse," says Octavia. "Until recently, that wasn't possible, because the government didn't have the authority or the capability to follow up all reports. Providing information directly to the people who can act on it has been shown to be an effective way to cut internet abuse." Connect2Trust Chair Raymond Bierens adds, "Getting to grips with the growth of cybercrime depends on being able to share and receive clear information securely and automatically. The Dutch Security Report Portal makes that possible."

Support from SIDN Fund

"Over the last few years, a lot of time and energy has been invested in initiatives designed to increase the nation's digital resilience," continues Octavia. "By bringing all those projects, big and small, under the banner of the Dutch Security Report Portal, we're able to combine their strengths and increase their impact. One of the projects involves a benchmarking method developed by Delft University of Technology. We use the method to more effectively measure the detection and resolution of network abuse. The Portal will also facilitate the sustained use of DIVD, the Clean Networks Platform and ThreatMatcher. SIDN Fund is supporting the Portal's establishment. The Fund's support is helping us to take the initiative forward. We'll continue investing in the improvement and further development of the existing platforms and initiatives that we're combining to create the Portal. Another benefit is that we'll be able to take our understanding of digital resilience and targeted information sharing to the next level."

Mieke van Heesewijk, Programme Manager at SIDN Fund, explained what attracted the Fund to the initiative. "This scouted project unifies a number of other projects that have previously received support from SIDN Fund. Creation of the Dutch Security Report Portal will ensure the prolonged use of those constituent projects. Even more importantly, the initiative can play a major role in making the internet more secure, within the parameters of current legislation. The Portal can do that by serving as an operational distribution centre for gathering and passing on information. It'll be able to get information to all the organisations that don't receive alerts directly from the government, because they aren't within the legally defined scope."

Increasing digital resilience

"With the Dutch Security Report Portal up and running, vulnerability reports always reach the right organisations. One of the next ambitions is to enable us to see what the current situation is in the Netherlands, with regard to vulnerabilities and various forms of internet abuse," says Octavia. "We'd also like to know what effect the solicited and unsolicited alerts sent out by the Portal are having on the nation's digital resilience. It would be useful to have feedback from recipients about how useful the alerts are to them, and how the service could be improved. In the period ahead, we'll also be looking to get more organisations and initiatives involved. Cybersecure Netherlands is a good example. Getting input from them would be good. Having more trusted bodies onboard to distribute information would help as well. Including bodies that can get information out to particular target groups, in the way that SURFcert does. SURFcert is SURF's ICT emergency team – a partner organisation that's been involved with the Portal from the start. SURFcert sends out alerts to members of the SURF network of educational and research centres, accompanied by explanatory information where necessary. Having players like that involved is really useful, because it means that information can be fed to much more specific groups." "The Portal got off to a smooth start by propagating information about the Apache Log4j software vulnerability. We're currently preparing for the official launch early this year. It's nice that, with support from the government, the business community and the AAN members, we're able to move various existing initiatives forward, increasing their impact. I'm really excited about that. Everything we've discovered and learnt so far will be reused in the context of the Dutch Security Report Portal." Frank Breedijk of DIVD is happy with the Dutch Security Report Portal: "DIVD scans the entire internet for vulnerabilities with the aim of reporting them to the people who can do something about them. In the Portal, we've now got a single point of entry for the whole country. The Portal's arrival also means that Dutch organisations will be getting alerts from a body they know, making it much more likely that organisations will act on the information. It's made the landscape considerably easier to understand." Want to be kept up to date on developments involving the Dutch Security Report Portal? Keen to learn more about the initiative? Drop a line to info@securitymeldpunt.nl or visit securitymeldpunt.nl.