Former Estonian Foreign Minister Urges Cooperation in Cyberattack Attribution, Policy

Nations must band together to face nation-state cyberattack threats, said Marina Kaljurand.

BLACK HAT EUROPE 2018 – London – As nation-state cyberattacks continue to evolve into more complex and disruptive campaigns, the pressure is on for countries to set specific cybernorms and support one another in the attribution of nation-state hacks, according to Marina Kaljurand, chair of the Global Commission on the Stability of Cyberspace (GCSC) and Member of the UN Secretary Generals High Level Panel on Digital Cooperation.
The former Estonian Foreign Minister, who was serving as the ambassador to Russia in 2007 when her country was hit with historic distributed denial-of-service (DDoS) attacks by Russia, said in an interview with Dark Reading that without a clear understanding of attack attribution, bad actors continue to operate in the gray zone.
Russia attacked Estonia, and nothing really happened. The next year it was the war and cyberattacks on Georgia, and nothing really happened. Then the attack on the Ukraine power grid, and nothing happened, Kaljurand said of Russias increasingly aggressive cyberattack campaigns. It wasnt until the US, under President Barack Obama, called out Russian actors in the hack of the Democratic National Committee (DNC) that nations began to name the culprits behind state-sponsored hacking, she said.
Kaljurand, who delivered the keynote address here today, was serving as the Estonian ambassador to Russia when Russian hackers took down her countrys government and bank websites with a weeks-long DDoS attack wave. We were the first country to fall victim to politically motivated attacks. Those DDoS attacks were primitive by todays standards. ... They didnt [destroy] anything; they were humiliating and disturbing, she said.
As the ambassador to Russia, she then had to learn in 15 minutes what does DDoS mean and explain it to others, she said. My second task was to find cooperation with Russia. I failed: It takes two to tango.
Kaljurand said one of the main lessons from the Estonia attacks was that international cooperation is the key to thwarting malicious nation-state attacks. This new normal of nation-state cyberattacks requires educating nations that are not as up to speed on the issues, as well as fostering cooperation among like-minded nations to set and support cybernorms. States alone cant be efficient, she said. We need responsible laws, regulations, authority, and thinking out of the box.
The multination naming of Russia as the actor behind the NotPetya data-destruction attacks in 2013 was the first time multiple countries issued attribution statements at the same time, as well as sanctions in some cases. To get a state to make [such a] statement wasnt easy, Kaljurand told Dark Reading.
Offensive cyber operations are another area that must be addressed, she said. Whatever measures that are taken must be in correspondence with international law, Kaljurand stated in the keynote. Its important to consider the necessity, specificity, proportionality, and harm in case offensive capabilities are used. To have an open discussion on this is better than not having it or having it behind closed doors.
While some 60 to 70 countries today are talking about cybersecurity, hundreds in the developing world are not and need to be reached out to, she said.
The GCSC so far has issued its set of recommended cybernorms for the protection of the public core of the Internet, but is still working on other security issues.
How can cyberspace norms be enforced if not all nations comply? Start with a political statement supporting it and then introduce it as practice, with clear rules of what is allowed and what is not, Kaljurand said in the interview. Ultimately, that will require some sort of international watchdog organization, she added.
Meanwhile, Estonia, like other nations, continues to be targeted by nation-state hackers. I cant be specific about the threats, Kaljurand told Dark Reading, but Russia remains active as well as other nations.
Related Content:
London Blue BEC Cybercrime Gang Unmasked
6 Ways to Strengthen Your GDPR Compliance Efforts
74 Arrested in International Email Scam Schemes
20 Cybersecurity Firms to Watch

Last News
▸ 7 arrested, 3 more charged in StubHub cyber fraud ring. ◂ Discovered: 23/12/2024 Category: security	▸ Nigerian scammers now turning into mediocre malware pushers. ◂ Discovered: 23/12/2024 Category: security	▸ Beware EMV may not fully protect against skilled thieves. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Former Estonian Foreign Minister Urges Cooperation in Cyberattack Attribution, Policy