What CSOs Can Learn From Estonia

It’s been a year since the Baltic nation of Estonia wilted under the assault of coordinated cyber attacks and the country seems to have bounced back. In fact, NATO recently announced it will set up a cyber defense center there to research and help fight cyber warfare. In this Q&A, security researcher Gadi Evron reflects on his experiences after being called to Estonia to help investigate the attacks, and what other nations and private entities could learn from it all.

CSO: When you reflect on what happened in Estonia, what do you see as the big lesson for other nations?

Gadi Evron: Say, by some miracle, you have not yet experienced an attack via the Internet even though you have an Internet-based critical infrastructure. You can no longer say that it won’t happen simply becauseit hasn’t happened yet. The biggest lesson is that in today’s ball game, the player can be the kid next door as much as it can be the big bad neighboring country. Work on your incident response capability with the private sector, because when you get hit you won’t have time to address it at that point.

CSO: Since those attacks, have there been any similar incidents to your knowledge?

Evron: Several countries have publicly admitted to being attacked online. Most of these attacks are of the quiet,spying type. As to large incapacitating DDoS attacks, they happen daily on the Internet and impact the whole net unlike these spying incidents. I am not aware of a major country-debilitating DDoS attack since Estonia, though.

CSO: You’ve described the Estonian incident as a cyber riot rather than a case of nation-sponsored cyber terrorism. Do you think all the speculation about nation-sponsored attacks was overblown?

Evron: It was a riot because the online populace was energized to be the foot soldier. It was an organized attack, but whether by some ad-hocgroup of individuals or not, I cannot say based on the technical data alone. Whether it was Russia or not, [the country] knew how to play the political game afterwards and achieved a high level of deterrence against the former Eastern-block countries at virtually no cost.

CSO: You mentioned in your Black Hat presentation last year that you headed to Estonia with images of the fictional nation of Elbonia from the “Dilbert” comic strips, where, as you noted, mud is the main export and babies are born with beards. But you said you were pleasantly surprised by what you found instead.

Evron: That stuff [from the presentation] was a joke. I was mainly concerned about visiting because of the cyber fraud activity happening there and the damage the criminals can suffer at the hands of people like me. I found a beautiful country with a very relaxed and fun culture. Their attitude was that if there were problems they wanted to talk about them and fix them.

CSO: If you could offer three pieces of advice to government or private entities hoping to avoid such attacks, what would it be?

Evron: Don’t panic. Accept that the threat is there. Don’t jump to solutions such as just better funding or adopting a cold-war strategy. On a practical note, though, establishing a country-wide incident response capability is important. Open channels to the private sector. Treat the Internet as insecure in your design when you build new infrastructure around it.

CSO: You live in the West Bank, and when you mentioned your initial mental picture of Estonia in that talk last year, it was easy to see how the TV news can give a distorted picture of cetain places that don’tneccesarily reflect the reality of the situation. Do you think your corner of the world gets a bad rap when it comes to the overall security situation?

Evron: The reputation is understandable [but] the reporting is mostly biased and even plain-out wrong on both sides. This is true not just for the local situation but for computer security and anything else I’ve had the chance to be privy to and then later see reported in the news.