SIDN takes part in biggest national cyber-emergency exercise ever
NCTV and NCSC organise ISIDOOR 2021
NCTV and NCSC organise ISIDOOR 2021
At the start of this month, more than fifteen hundred people from ninety-six public and private sector organisations took part in the ISIDOOR 2021 cyber-exercise. Vital sectors including the water industry, the nuclear and non-nuclear energy industries, infrastructure management and banking were all represented. As a designated 'essential service operator', SIDN was also involved, along with various governmental bodies and law enforcement agencies. The number and diversity of the participating organisations made ISIDOOR 2021 unique: the biggest national cyber-emergency exercise ever held in the Netherlands. The three-day event was organised by the National Coordinator for Security and Counterterrorism (NCTV) and the National Cyber Security Centre (NCSC), supported by the COT and FOX-IT, with the aim of practising information exchange, collaboration and coordination in preparation for a cyber-emergency.
During the exercise, various types of cyber-incident were simulated. They included a hostile state-organised phishing mail campaign, ransomware attacks and system penetration based on exploitation of a software vulnerability. Simulated consequences ranged from the loss of imaginary sensitive operational information to the virtual disruption of vital processes, resulting in poor water pressure, the non-availability of websites and services, and delayed payment traffic, for example.
To make the exercise as realistic as possible, a media response cell was set up for ISIDOOR 2021 that distributed (fake) news items and responded to news and social media messages from participants. (Photo: Bas Kijzers)
"A cyber-attack can impact people's lives directly. Who can forget the gridlocked roads we had when Citrix went down and people couldn't work at home? But we also need to prepare for more serious situations where there's more social disruption. First and foremost, that means all organisations having their cybersecurity in order. And everyone being ready to pull together if an incident nevertheless occurs. That's why exercises like this are so important They promote information exchange, strengthen collaboration and demonstrate the need for coordination. In three quarters of participating organisations, the subject of cybersecurity was escalated to the executive level. In other words, we've succeeded in getting the subject on the senior management agenda. Where it belongs," said Hester Somsen, Deputy NCTV and Director of Cybersecurity.
Cyber-incidents are increasing year-on-year, driving an ongoing need to build up national resilience to attacks. Against that background, the Dutch government is committed to a national test and exercise programme, which ISIDOOR 2021 was part of. Incidents that made the news in the last year include the detection of vulnerabilities in SolarWinds Orion and Microsoft Exchange, which left numerous organisations exposed.
According to NCSC Director Hans the Vries, "Such incidents underscore the importance of improving our cyber-resilience, creating awareness and preparing for attacks. Joint exercises support those goals. Participants learn to speak the same language and to understand each other's needs and problems. The exercises also mean that, in the event of a real attack, people coordinate their responses more quickly and more effectively. Real-world cyber-incidents develop rapidly and have huge potential impact, so we need to practise dealing with them in order to prevent serious disruption, damage and cost."
Lessons learnt from the exercise will be reflected in participating organisations' cyber-incident preparations and incorporated into plans and procedures such as the National Cyber-emergency Plan. That will help organisations to continue developing and improving their flexibility, resilience and agility. And that's vital, because there's one thing we can be sure of: a future cyber-emergency is bound to differ from those already experienced and practised for.
Some 1,500-2,000 people took part in the crisis exercise. The Minister of Justice & Security was also involved. (Photo: Bas Kijzers)
ISIDOOR 2021 was the third edition of the NCTV/NCSC-organised exercise. But SIDN was participating for the first time since being designated an 'operator of essential services' in 2018. Technical Security Officer Melvin Elderman acted as our internal exercise evaluator. "We often do emergency drills here at SIDN," he says. "But they are purely internal. So it was a very worthwhile experience taking part in a large-scale exercise like this and seeing first-hand what impact a national-level attack can have and how other organisations respond. We learnt a lot from it. As well as reassuring us that we're well-prepared for many situations, the exercise also flagged up areas where we can do even better. We're going to get to work on the relevant points right away."