Getting from an IP address to a cybersecurity officer
DTC's notification service formalised by new law
Last month, the Digital Resilience of the Business Community (Promotion) Act took effect in the Netherlands. Known by its Dutch abbreviation Wbdwb, the Act gives the Digital Trust Centre (DTC) the statutory authority to share information about digital vulnerabilities, threats and incidents with non-critical enterprises. Part of the Dutch government's economy ministry, the DTC has been sharing information for several years by means of a notification service. However, the new Act formalises that work by providing a statutory basis for it.
"The information we receive mainly takes the form of lists of IP addresses. We try to trace the IPs to businesses and, where possible, to appropriate contacts within those businesses, so that we can tell them about the issues that have come to our attention. For example, we might want to alert a business to the fact that one of their online systems has a known vulnerability. For us, the key element of the new Act is that it gives us the statutory authority to do things like processing personal data such as IP addresses and e-mail addresses."
Non-critical enterprises
In the Netherlands, critical infrastructure security is regulated by the Network and Information Systems Security Act (Wbni), which translates the EU's NIS Directive into Dutch law. The Wbdwb complements the Wbni by regulating the promotion of digital resilience in non-critical enterprises. The target audience consists of more than 2 million enterprises, but that number obviously includes a large number of small businesses and self-employed people that don't have their own internet presences.
Although an attack on non-critical enterprises would not bring the country to a standstill, it could cause significant inconvenience and economic damage, as illustrated by the many ransomware attacks seen in recent years [1, 2]. A study by Statistics Netherlands indicates that thousands of businesses a year are hit by cyber-attacks. The DTC, which will become part of the National Cyber Security Centre (NCSC) in 2026, is therefore paying particular attention to this target group.
Cyber alerts and notifications
It's widely recognised that SMEs tend to find it difficult to invest in security, to acquire or hire expertise, and to keep systems updated. Most choose service packages on the basis of functionality, and then rely on the service provider to take care of security. On behalf of the government, the DTC provides the Dutch business community with information, advice and targeted alerts.
The DTC issues warnings about serious general vulnerabilities in popular business software and ICT systems – known as cyber alerts – and about particular vulnerabilities, such as those associated with known security gaps, outdated software and configuration errors. Where possible, the notification service distributes targeted warnings about issues of the second type.
Lists of IP addresses
"The threat information we receive is usually in the form of lists of IP addresses," explains Erwin Hasenpflug, who is responsible for the DTC's notification service. "We don't scan the internet ourselves, but depend on organisations that do do that, or security investigators who share information about vulnerabilities that they've discovered and that we can address. If, for example, a problem with an Exchange server has been detected, the issue can usually be traced to the company that uses the server. However, things become challenging if, say, there's an issue with a system for which we have an IP address but no (usable) rDNS name or TLS certificate."
In such situations, establishing where to send notifications is a laborious task for the DTC. "For us, the ideal scenario would be a database of IP addresses and the associated e-mail addresses. Of course, we do have access to resources such as the Whois, but unfortunately none of them reliably identify the organisation or contact person we should approach. So we have to make our own enquiries to find out where our notifications should go."
Because threat information ages quickly and IP addresses often get re-assigned, the DTC has to act quickly after receiving a list of problematic IP addresses. "We process incoming lists on a daily basis so that the threat information we have is shared with the business community as soon as possible. Identifying the right people to contact is the most time-consuming element of that process."
Automation
In order to process large volumes of information quickly, the DTC automates its notification activities wherever possible. E-mail is the preferred contact method, but if a company can't be reached that way, or if a particularly serious problem is involved, the DTC often reaches out by phone. "There are so many businesses that 1-to-1 contact with all of them simply isn't possible," says Hasenpflug. "However, the ones that we speak to and get feedback from are generally positive about our services. And the interactions are often very rewarding for our people. After all, our work here is all about helping businesses become more digitally resilient."
At the same time, Hasenpflug recognises that it's impossible to please everyone all the time. "With a warning about a serious vulnerability in outdated software, things are usually straightforward," he says. "However, if a system is directly accessible over the internet using the RDP or SMB protocol, opinion may differ as to whether that represents a security issue. So sometimes we'll warn a business about a publicly accessible RDP portal, and they'll get back to us saying that the portal is meant to be that way. As well as warning about a vulnerability and giving advice on what to do (e.g. "update your software" or "tell your service provider"), our notifications therefore include problem explanations."
"Help yourself"
According to Hasenpflug, there's also a lot that SMEs can do to avoid digital risks as much as possible. "On our site, for example, we describe the 5 basic principles of doing business securely online. The easiest measures to implement are using a password manager and 2FA."
With the aim of giving small businesses a hand with their security, the DTC operates a grant scheme, which will cover up to half the cost of security investments, subject to a cap of €1,250. Under the banner "My Cyber-resilient Business", the scheme was piloted last year with a budget of €300,000 before being scaled up to a €1-million programme this year.
"Help us to help you"
"The main thing for our notification service is finding the right portal for sending our alerts," Hasenpflug continues. "The best way to help with that is to publish a security.txt file on your website, providing security-related contact information."
The format and location of a security.txt file (which can be likened to a robots.txt file) were standardised 2 years ago in RFC 9116. The DTC was one of the stakeholders that provided input during development of the protocol.
Support
A variety of initiatives is being taken to promote the use of security.txt. Data gathered by SIDN Labs indicates that nearly 3 per cent of .nl websites currently have security.txt files. In summer 2024, the Registrars' Association (RA) published a WordPress plugin that makes it very easy to provide a security.txt file on your website. In addition, native support for security.txt has now been added to the DirectAdmin and Plesk control panels. Work is also under way to include similar support in ISPConfig and cPanel.
"The developments surrounding security.txt are very important for us," says Hasenpflug. "When it comes to sending unsolicited notifications, the main challenge is identifying the right delivery portals. We can't create large call centres dedicated to contacting businesses about security issues; we have to automate our services wherever possible. Businesses can help us to help them by providing security.txt files. Now that it's so much easier to publish a security.txt file using a popular CMS like WordPress, we're hoping that adoption of the security.txt protocol will take off."
Financial incentive
At SIDN, we're currently working on a financial incentive to promote the use of security.txt. Our aim is to add the incentive to our Registrar Scorecard (RSC) scheme from 2025. In practical terms, the scheme will involve giving registrars rebates on .nl domain names whose websites have valid security.txt files.