Home » Data Protection » Application Security

Q&A

What CSOs Can Learn From Estonia

Security researcher Gadi Evron reviews lessons of the Estonian cyber attacks he helped to investigate last year.

By Bill Brenner, Senior Editor

May 20, 2008 —

It's been a year since the Baltic nation of Estonia wilted under the assault of coordinated cyber attacks and the country seems to have bounced back. In fact, NATO recently announced it will set up a cyber defense center there to research and help fight cyber warfare. In this Q&A, security researcher Gadi Evron reflects on his experiences after being called to Estonia to help investigate the attacks, and what other nations and private entities could learn from it all.

CSO: When you reflect on what happened in Estonia, what do you see as the big lesson for other nations?

Gadi Evron

Gadi Evron: Say, by some miracle, you have not yet experienced an attack via the Internet even though you have an Internet-based critical infrastructure. You can no longer say that it won't happen simply because it hasn't happened yet. The biggest lesson is that in today's ball game, the player can be the kid next door as much as it can be the big bad neighboring country. Work on your incident response capability with the private sector, because when you get hit you won't have time to address it at that point.

CSO: Since those attacks, have there been any similar incidents to your knowledge?

Evron: Several countries have publicly admitted to being attacked online. Most of these attacks are of the quiet,spying type. As to large incapacitating DDoS attacks, they happen daily on the Internet and impact the whole net unlike these spying incidents. I am not aware of a major country-debilitating DDoS attack since Estonia, though.

CSO: You've described the Estonian incident as a cyber riot rather than a case of nation-sponsored cyber terrorism. Do you think all the speculation about nation-sponsored attacks was overblown?

Evron: It was a riot because the online populace was energized to be the foot soldier. It was an organized attack, but whether by some ad-hoc group of individuals or not, I cannot say based on the technical data alone. Whether it was Russia or not, [the country] knew how to play the political game afterwards and achieved a high level of deterrence against the former Eastern-block countries at virtually no cost.

CSO: You mentioned in your Black Hat presentation last year that you headed to Estonia with images of the fictional nation of Elbonia from the "Dilbert" comic strips, where, as you noted, mud is the main export and babies are born with beards. But you said you were pleasantly surprised by what you found instead.