Attack on the domain name system: the priority is to protect your access

Cyberattack - DNS Hijacking - cyber espionage
Image source : Geralt via Pixabay

Last weekend, the media has widely communicated on the consequences of an unprecedented attack that targeted the domain names.

Indeed, during the night of 22-23 February ICANN reported the large-scale attacks on the domain names: it is DNS hijacking. These attacks consist in “replacing the authorized servers addresses” with “addresses of machines controlled by the attackers”, as explained by the organization, allowing the attackers to examine the data in order to find passwords, email addresses etc., even to completely capture the traffic towards their servers.

A wave of attacks that began in November 2018

Actually, this is not an attack but a wave of attacks that the domain names system has endured for several weeks now.

Since the end of November 2018, an attack has targeted Lebanon and the United Arab Emirates and affected .GOV domain names. In this attack, the cybercriminals have proceeded with DNS hijacking.

At the beginning of January 2019, the company FireEye reported in an article, a wave of DNS hijacking that has affected domain names belonging to government, telecommunications and internet infrastructure entities across the Middle East and North Africa, Europe and North America.

If the attackers were then not identified, the initial research suggested the attacks could be conducted by persons based in Iran.

Important fact regarding the attack of February 22: this time, it struck, sometimes successfully, important actors of the Internet.

What are these attacks?

The method used is the DNS hijacking deployed on a large scale. This is a malicious attack, also called DNS redirection. Its aim: overwrite the TCP/IP parameters of a computer in order to redirect it towards a fraudulent DNS server instead of the configured official DNS server. To do this, the attacker takes control of the targeted machine through different techniques to alter the DNS configurations.

The American government, among others, recently warned about these series of highly sophisticated attacks of which the aim would be to siphon a large volume of passwords. These attacks would target more specifically governments and private companies.

Between DNS hijacking and cyber espionage

According to Talos’ article of November 2018, the attackers behind these attacks would have collected emails and connection information (login credentials – passwords) by hijacking the DNS, so that the traffic of the emails and the VPN (Virtual Private Networking) of the targeted institutions would be redirected to a server controlled by the cybercriminals.

Once the connectors collected, other attacks can be launched for espionage purposes, like the Man-In-The-Middle.

Then how to effectively protect yourself?

You must be aware that if these attacks essentially aim the domain names system, we can never say it enough, the first entry point of your domain names portfolio for an attacker is your access to the management platform.

The first and utmost recommendation is to protect your access

For many years, Nameshield has developed securing measures for the access to the domain names management platform (IP filter, ACL, HTTPS) and in addition proposes the 2 factors authentication and the SSO.

If these complementary solutions are still not implemented, Nameshield strongly recommends to implement them, in particular the 2 factors authentication in order to fight against passwords thefts.

To implement the DNSSEC protocol

The implementation of DNSSEC, if it was more widely deployed, would prevent or at least lessen the impact of these attacks by limiting their consequences.

It’s becoming increasingly urgent that DNSSEC is adopted on a massive scale, for both resolvers and authoritative servers.

To protect your domain names

The implementation of a registry lock on your strategic names will prevent their fraudulent modifications.

Although no perfect solution exists today to fully protect the infrastructures from cyberattacks, it is the implementation of several preventive measures combined that will allow to reduce the vulnerabilities (so) easily exploited by the pirates.

Can Russia disconnect from the global Internet?

Can Russia disconnect from the global Internet?
Image source : bernswaelz via Pixabay

On February 13, 2019, the Duma (lower Chamber of the Russian Parliament) has begun to study a draft legislation with the aim to create a “sovereign Internet” in Russia, meaning an ability to function in total independence if Russia was cut from the major global servers. To achieve this, it will be necessary to create an “infrastructure allowing to ensure the functioning of the Russian Internet resources in case of the impossibility for the Russian operators to connect to the foreign sources Internet servers”.

The Internet providers will have to implement systems allowing a “centralized control of the traffic” on their networks.

The measures proposed would allow the Russian Internet (RuNet) to ensure that the Russian part of the Internet functions efficiently. In other words, the test will allow Russia to ensure that its domestic networks can operate in full autonomy.

A response to the penalty threats? 

If Russia talks about an assurance for a maintained local availability, particularly in case of a large-scale cyberattack, this draft legislation is also and clearly presented as a response to the “aggressive nature of the new American cybersecurity strategy adopted in September 2018” [mentioning Russia as a threat]. Indeed, Russia is the object of many accusations regarding cyberattacks and cyber espionage (disruptions of the American presidential elections in 2016 -exhortation of Stuart Peach, Chief of the UK Defence staff in NATO, to take measures against Russia in December 2017, after the Russian submarines were detected near the Atlantic submarine cables, which carry the communications between Europe and the USA – in January 2018, the Minister of UK Defence, Gavin Williamson, also accuses Russia of spying the critical infrastructure of his country with the aim to create a “total chaos” which could “result in thousands and thousands of deaths”, etc). NATO and its allies have then threatened to punish Russia for these cyberattacks.

It’s in this context that Russia is planning a full-scale test of disconnection of the global Internet network.

A full-scale test

For several years, this test has been prepared by Russian authorities, who planned a DNS local backup (tested in 2014 and in 2018).

Indeed, the law plans the creation of Russia’s internal DNS system, which would ensure the link between web address and IP address of the corresponding web servers, without resting on the root servers of the global Internet.

Validated by president Poutine, the draft legislation has all its chances to be quickly adopted despite the reluctance of some branches of the government because of the potential expenses entailed. On the Russian Internet providers’ side, they seem to agree with the draft legislation, as mentioned in the Russian press, but to this date, they do not validate its technical implementation, which could create important disturbances and other traffic disruptions in Russia.

Of course, it is easy to see that this experience will simultaneously test the Internet providers‘ ability to direct data towards routing points controlled by the Russian government, since a filter would be implemented to stop the flow of data towards foreign servers.

Would Russia move towards a system of traffic filtering, beyond ensuring a national intranet that maintains an operational connection inside the borders even in case of a massive cyberattack? It is reminiscent of the significant Chinese firewall (Internet monitoring and censorship project managed by the Ministry of Public Security of the People’s Republic of China, initiated in 1998 and of which activities began in November 2003).

The Russian test could happen on the 1st of April 2019. To be continued.

Brexit’s consequences on .eu domain names : EURid’s action plan

Brexit’s consequences on .eu domain names : EURid’s action plan
Image source : Tumisu via Pixabay

In a previous article, we discussed the Brexit’s consequences on .EU domain names, the European Commission announced on 28 March 2018 that companies and individuals, holders of a .EU will no longer be able to renew or register names in .EU if they are not residing in the European Union.

With the Brexit’s date approaching, EURid, .EU registry, has recently published its action plan that has two scenarios depending on the case there is no deal or the case there is a withdrawal agreement between the United Kingdom and the European Union. In the second case, it will be the same actions but they will be implemented on different dates (from December 2020).

Scenario 1: The United Kingdom leaves the European Union with no deal on 30 March 2019 

New registrations

  • From 30 March 2019: EURid will not allow the registration of any new domain name from registrant declaring an address in Great Britain (country code GB) or in Gibraltar (country code GI).

.EU domain names that have GB/GI as the registrant country code within WHOIS, at the time of UK withdrawal

  • On 23 March 2019: EURid will notify by email both GB/GI registrants and their registrars about the forthcoming non-compliance of the data associated to their domain name within the .EU regulatory framework.
  • On 30 March 2019: EURid will again notify by email both GB/GI registrants and their registrars that their domain name is not in compliance with the .EU regulatory framework.
  • Before 30 May 2019: Registrants will be given the possibility to demonstrate their compliance with the .EU regulatory framework by updating their contact data.

During this two months period, the domain names in question will remain active and the following actions are possible:

-Contact data changes including updates to existing contact details pertaining to phone number, email address, postal address and country code;

-Updating a contact or linking a new contact;

-Name server and DNSSEC changes;

-Transfer the domain name to a non GB/GI registrant.

During this two months period, the following actions are not possible:

-Transfer the domain name to a GB/GI registrant;

-Term extension, unless accompanied by a transfer request to an eligible registrant;

-Automatic renewal for domain names that expire in the period between 30 March 2019 and 30 May 2019.

  • As of 30 May 2019: All registrants who did not demonstrate their eligibility will be deemed ineligible and their domain names will be withdrawn.
  • On 30 March 2020, i.e. twelve months after the UK withdrawal: All the affected domain names will become available for general registration.
  • For. EU domain names that are in the ON-HOLD status at the time of UK withdrawal: They will remain registered until there is an outcome of the court case. However, they will be suspended and will cease to function as of 30 May 2019.

-If a court ruling establishes a transfer to an eligible party, that decision will be implemented in the usual way.

-If the domain name stays with the GB/GI registrant, the domain name will be withdrawn.

  • For .EU domain names that are in the SUSPENDED status at the time of UK withdrawal: Evaluation by the registry on a case-by-case basis, moving forward if appropriate, with the withdrawal of the domain name.
  • For .EU domain names that are in the QUARANTINE status at the time of UK withdrawal:

-No transfer to GB/GI registrants from quarantine will be possible during the two months period.

-Transfer to a non-GB/GI registrant will be possible.

Scenario 2: The United Kingdom leaves the European Union with a planned transitional period on 31 December 2020

It will be the same actions but they will be implemented on different dates.

New registrations

  • From 1 January 2021: EURid will not allow the registration of any new domain name from registrant whose country code is either GB/GI.

 .EU domain names that have GB/GI as the registrant country code within WHOIS, at the time of UK withdrawal

  • 23 December 2020: First email sent about the non-compliance of the data associated to the domain name.
  • 1 January 2021: Second email sent about the non-compliance.
  • Before 2 March 2021: Possibility for the registrants to demonstrate their compliance with the .EU regulatory framework by updating their contact data.
  • As of 2 March 2021: All registrants who did not demonstrate their eligibility will be deemed ineligible and their domain names will be withdrawn.
  • On 1 January 2022: All the affected domain names will become available for general registration.

The actions planned in the first scenario regarding the different status « ON HOLD », « SUSPENDED » and « QUARANTINE », will also be applied in the second scenario.

The Brexit’s consequences thus force the British to rethink their domain names strategy. Indeed, the loss of their .EU domain names will be an opportunity for cybersquatters who reside in the E.U. and meet the eligibility criteria, they would then have the rights to register these .EU domain names. Nameshield’s team is at your disposal to reply to all your questions and to propose you the best recommendations regarding your domain names’ portfolio management.

Can the DNS have an impact on the SEO?

Can the DNS have an impact on the SEO?
Image source : geralt via Pixabay

This is a recurrent question from our customers: does the use of the DNS, whether it is good or bad, have an impact on the websites’ SEO? We have already discussed about the impact of a HTTPS website on the SEO, this is now the occasion to focus on the side of the DNS.

The DNS is an invisible process, implemented in the background, it’s difficult to comprehend why it can help or affect a website’s performance and the ranking in search engines, more particularly on Google.

This article will approach the possible impact of the DNS in response to the following questions:

  • Does the modification of a DNS record affect the SEO?
  • Does the change of the DNS provider affect the SEO?
  • Which part of the DNS plays in a website’s migration?
  • Does the change of a website’s IP address affect the website’s SEO?
  • Quid of the DNSSEC implementation?
  • Can a DNS breakdown affect the SEO?
  • Can a faster DNS increase the SEO?

Does the change at the DNS level affect the SEO?

1. Modification of a DNS record, be careful of the TTL

The domain name’s redirection towards the corresponding web server often passes through the creation of a A type record (IPv4 address). The A record will then direct the traffic towards the IP address of the destination web server. The modification of this record can lead to performance problems.

Indeed, to optimize the response time, the DNS system allows the  information caching with the DNS resolver servers for a given time, the duration of the TTL (Time to live) defined by the technical manager of the domain name, during its configuration. The usual TTL, like the one recommended by ANSSI, is several hours for the usual uses of domain names (websites). In the case of a A record modification, this one could be taken into account only at the end of the TTL. Then web users could still access to the former record configurations for a few minutes or even several hours after the modifications.

Thus it’s important to reduce the TTL, even temporarily during these modifications.

But does that affect the SEO? Yes, it does and no, it doesn’t. In the case of users being sent towards a destination that no longer exists, Google will consider this as a 404 error. Beyond the negative user experience, this is not directly a SEO factor. However be careful of the possible existence of backlinks and the too high numbers of 404 errors. A low TTL allows to limit the impact during these modifications.

2. Modification of the DNS declared for a domain name

A domain name is associated to the name servers (NS/Name Servers) which allow the right DNS resolution. The DNS service searches the information on these NS. These NS can be modified during the change of the provider managing the domain name, or simply to pass from a DNS infrastructure to another. Will the change of the name server affect the SEO?

Depending on the provider and the chosen infrastructure, the resolution time could be more or less short with a possible impact of improvement or decrease regarding the SERP (Search Engine Result Page). Indeed, the resolution time is taken into account by Google (see after).

And like for a record change, it is recommended to reduce the lifespan of the records before modifying the name servers, so the DNS resolvers don’t keep in cache the former information.

3. Risk associated to the DNS during the website’s migration

This is the same principle discussed previously. The modifications of the DNS configurations don’t directly affect the SEO, but can lead to a bad user’s experience. The TTL should also be seen as a useful mean to take into consideration.

Which specific cases to consider?

  • Change of web hosting provider
  • Change of DNS hosting provider?
  • Move the traffic of www. towards a “nude domain” (without www.)
  • Move your domain towards a CDN (content diffusion network)

4. Change of the destination IP address

No. During the modification of a record pointing from a termination point to another, the SEO is not affected. The only (very rare) exception to this rule would be to point a domain towards a termination point that would have been already identified as a spam server (for example, the IP address of a shared server).

However, be careful of the IP address in question, one of the (many) rules of Google’s SEO is that an IP address used for a website should be located near the final user.

5. DNSSEC implementation

DNSSEC allows to authenticate the DNS resolution through a chain of trust between the different DNS servers of this resolution. Just like for the HTTPS, this is an additional security layer to implement. And like for the HTTPS, the pages’ loading time is affected, and therefore potentially the associated SEO. To put this into perspective, DNSSEC is essential to web users’ surfing and it is recommended to implement it.  Most companies that propose security audit regarding domain names consider DNSSEC as necessary and then as a notation criteria.

Do faster DNS increase the SEO?

Google admitted that the loading time of a web page has an impact on the SERP results. The times of the DNS research are in general less than a second, they can nevertheless affect the loading of a webpage in the following cases:

1. Recurring breakdowns on the DNS infrastructure

When a DNS cannot resolve or takes more time than usual, it can add many seconds to the time of a page loading. In case of lack of reliability and recurring unavailability, the impact on SEO is proved… Not mentioning the user experience in front of these repetitive failures (increase of the bounce rate, decrease of customers’ retention and impact on the trust in the brand, if not revenue loss). It is important to rely on a reliable and trustworthy infrastructure.

2. Quality of the network and points of presence

This is purely and simply physics, the nearest a names server is to the final user, the less time is needed to respond to its request. The DNS networks called “anycast” (optimized addressing and routing towards “the nearest” or the “more efficient” server) with many points of presence in the world, allow to optimize the response time depending on the geographical location.

Another important point is to have at least three names servers that are authority (SOA) for a domain name, ideally based on different domain names and TLDs, in order to reduce the risk of SPOF (Single Point of Failure) of an infrastructure. Indeed, if an infrastructure relies on the same domain name, an unavailability of this domain name, for whatever the reason, leads to the unavailability of the DNS infrastructure. Likewise, at the TLDs’ level and even if it is less likely, a problem of registry availability would affect all the DNS infrastructure.

3. Be careful of “extended” DNS configurations

It’s not unusual to have DNS configurations which send towards a final destination through several steps like in the example below.  As a consequence, the resolution time is affected and potentially, the performance in terms of SEO.

fr.wikipedia.org. IN CNAME text.wikimedia.org.

text.wikimedia.org. IN CNAME text.esams.wikimedia.org.

text.esams.wikimedia.org. IN A 91.198.174.232

Conclusion

The SEO is a science to consider as a whole. Thus, as we have seen through the impact of the HTTPS adoption of a website, this is a referencing factor among others and all things being equal, then this is particularly important in order to achieve a competitive edge on the first page of results.

The same applies to the impact of DNS on the SEO. Can the DNS have an impact? Yes, it clearly can in the case of incorrect configurations, or in the case that the DNS infrastructures do not allow response times fast enough. A DNS infrastructure called anycast is essential for any domain name carrying an important web traffic, even more at an international level. This is a data to integrate in a whole, and this thinking should be in a global approach of the SEO with the web marketing team.

DNS Flag Day: Are you ready?

DNS Flag Day - Blog Nameshield

Lately, the DNS keeps being talked about! After the first KSK rollover of October 2018, then the deactivation of the former KSK key on last January 11, here comes the time of the DNS Flag Day!

DNS Flag Day: What is it all about?

The Flag day is an expression used in IT to indicate the deadline and/or radical change.

Let us remember that when it was created, the weight of cybercrime threats affecting the DNS infrastructure didn’t exist. If the security was relegated to the background, the evolution of attacks have made it absolutely necessary: The DNS must be strengthened!

It’s in this context that the EDNS standard has been created in 1999 (updated in 2013 in the RFC6891). EDNS has particularly allowed the implementation of DNSSEC, the DNS’ geolocation and other measures aiming to strengthen the security.

This transition was not without difficulties. Abusive EDNS standard adoptions, lack of updates, bypasses have led to the creation of many patches and accommodations of the recursive servers’ code (particularly, in order to be able to differentiate DNS servers which cannot properly support EDNS from the ones unreachable for other reasons).

Two decades later, the maintenance of all these patched software has become more than difficult and leads to bugs that can compromise the DNS security. Obviously, the weight of these patches affects the speed of the response times.

It’s time for this standard to be implemented by all, or they will no longer be able to efficiently deal with new DNS attacks, like amplification or layer 7 attacks.

That’s why, major IT actors (Google, Cloudfare, Facebook, Cisco..), of which the developers of recursive servers decided as one to no longer support DNS servers that do not respect the EDNS standard as of February 1, 2019. The Flag Day arrives!

And concretely?

From the DNS Flag Day, on February 1, all the DNS servers not in compliance with the EDNS standard (or not functioning because of a firewall incompatible with EDNS), thus not responding to EDNS requests will be considered as unreachable; accommodations and other patches being removed from the new versions of the DNS software.

To simplify, not placed on compatible DNS, your domain name may no longer respond.

How to anticipate?

That is why it is important to ensure that DNS servers hosting your names‘ zones are compatible EDNS, in particular if they are not placed on Nameshield’s DNS infrastructure or if your company maintains its own infrastructure.

The DNS Flag Day website also allows to test the compliance of your name: https://dnsflagday.net/

Of course, our team is at your disposal for any question.

Cybersecurity overview – CESIN’s barometer

Cybersecurity overview
Image source: TheDigitalArtist via Pixabay

The CESIN (Club of Information and digital security experts) just published the fourth edition of its annual barometer realized with OpinionWay within its 174 members, 84% are CISO (Chief information security officer) of big French companies. This annual study allows to better define the perception and reality of cybersecurity and its issues within the companies which are members of CESIN.

The most common cyberattacks and their impacts

During these twelve last months, although the attacks number tends to stabilize, 80% of the interviewed companies have been the victims of at least one cyberattack, and the consequences on the business (stopping of the production, unavailable website, revenue loss…) are more important than in 2017.

Each year, companies face five kinds of cyberattack on average.

Among the attacks suffered, phishing is the most frequent with 73% of companies affected, followed by the “Fake President” fraud with 50% of the respondents affected, then in third position is the ransomware and the malware infection.

Regarding cyber risks, Shadow IT is the most frequently encountered risk, 64% of the interviewed CISO estimate that this is a threat to deal with. Indeed, the implementation and use of non-approved and often free applications can escape the control of the Information systems department.

Cloud and IoT: the impact of the digital transformation on the security of Information systems

For 98% of the companies, digital transformation has a real impact on the security of Information and data systems and increases the cyberattacks’ perimeter. Particularly through the important use of Cloud, used by 87% of the companies, of which 52% store their data in public Clouds.

This use of Cloud represents an important risk because of the lack of control from the hosting provider regarding the company’s data (through administrators or others), or regarding the subcontracting chain used by the hosting provider, or even regarding the data not deleted. For 89% of the CISO, these issues imply the use of complementary securing tools to the ones proposed by the service provider in order to secure the data stored in the Cloud.

Concerning IoT (Internet of Things), the race for innovation and the increasingly common use of connected things lead to the apparition of new cybersecurity threats, notably due to security flaws in these devices.

A cyber resilience to develop

To face these cyber risks, the CISO develop many technical solutions.

However, despite all these solutions, the CISO are less confident comparing to last year regarding the company’s capacity to face these cyber risks, and less than one out of two estimates that their company is prepared to manage a large scale cyberattack. And yet, only 12% have implemented a real cyber resilience program, it is in process for 33% and 34% are planning to implement one.

Three essentially human issues for the future of the cybersecurity

  • Awareness of the user

According to 61% of the interviewed CISO, the main issue for the future of the cybersecurity is the training and the awareness of the users to the cybersecurity issue. According to the respondents, “even if the employees are aware, they are still not involved enough and do not necessarily follow the recommendations. An important education work remains.”

  • Governance of the cybersecurity

For 60% of the respondents, the governance of the cybersecurity needs to be placed at the right level. Although the compliance to the GDPR allowed the companies to be aware of the data protection issues, the confidence in the ability of the executive committee to take into account the cybersecurity issues stays uneven depending on the activity sectors.

  • Human resources

The lack of Information system security profiles observed by 91% of the CISO, is a real challenge for the companies while 50% of these companies plan to increase the workforce allocated to cybersecurity.

GDPR and consequences: DomainTools appeals injunction decision in .NZ whois case

GDPR and consequences: DomainTools appeals injunction decision in .NZ whois case
Image source: mohamed_hassan via Pixabay

DomainTools sued by DNCL

In June 2018, .NZ registry, DNCL (Domain Name Commission Limited) sued the American company specialized in tools of monitoring and investigation, on the ground that it violated the registry’s terms of use.

The DNCL was successful and the Federal Court in the State of Washington granted a preliminary injunction that banned DomainTools to collect the whois data of .NZ and ordered the suppression of the data used in the existing publications, while the lawsuit proceeded.

Indeed, since June 2016, .NZ registry has indicated in its terms that it was now forbidden to copy the domain names holders’ data.

DomainTools appeals the injunction decision

Without surprise, DomainTools, that first indicated that the use of these data was also of general interest, these data being used by its customers in the context of the fight for cybersecurity, appealed the preliminary injunction.

Of course, this trial reflects the terms of the debate which took place at ICANN regarding the General data protection regulation (GDPR).

DomainTools is mentioned in the American draft legislation unveiled by the Internet Governance Project, which indicates as such, that this attempt would be led by different lobbies. The Transparent, Open and Secure Internet Act of 2018, dated from August 16, 2018 mentions these two possibilities of evolution: 

  • The first called “large” proposes keeping a whois with a wide enough spectrum of information (more or less the same as our old fashioned whois)
  • The second, more limited, would keep this obligation to publish the data to the American residents or to the actors targeting a business activity on the US market.

An intense debate about the GDPR

This trial reminds us how the debates regarding the GDPR implementation are intense within ICANN, opposing actors using the now so precious data and the privacy advocates, supported by the WP29 (Article 29 Data Protection Working Party) that mentions in particular the applicable sanctions.

Finally, it should be reminded that the GAC attempts to minimize the consequences of the European regulation. After being dismissed by the German Court from their attack in May 2018, which aimed a registrar that stopped to provide customers data under the GDPR, the GAC aims to obtain from the EU’s Court of Justice a favorable decision on this subject. The debate about the DomainTools case deserves to be followed closely!

Global risks 2019: Climate and cyber risks at the heart of concerns

Global risks 2019
Image source: PIRO4D via Pixabay

Upstream to the Annual Meeting in Davos that took place on January 22 to 25 in Switzerland, the World Economic Forum presented its Global Risks Report, a report which highlights the main global risks and issues, based on a survey of 1000 international decision-makers from the public sector, private sector, academia and civil society. So what are the main risks that the World is facing?

Cyber risks in the top 5

For the third year in a row, environment-related risks are at the top of the decision-makers’ concerns. They hold the top three of the risks likely to occur in 2019, followed by technology risks which are Data fraud or theft in 4th place, and cyberattacks in 5th.

Thus in 2019, 82% of the interviewed experts expect data and money theft, and 80% expect services and infrastructures disruptions resulting from cyberattacks.

The 5 risks most likely to occur according to experts

  1. Extreme weather events
  2. Failure of climate-change mitigation and adaptation
  3. Natural disasters
  4. Data fraud or theft
  5. Cyberattacks

The top 10 risks in terms of impact

  1. Weapons of mass destruction
  2. Failure of climate-change mitigation and adaptation
  3. Extreme weather events
  4. Water crisis
  5. Natural disasters
  6. Biodiversity loss and ecosystem collapse
  7. Cyberattacks
  8. Critical information infrastructure breakdown
  9. Man-made environmental disasters
  10. Spread of infectious diseases

Cyberattacks take the 7th place, and the critical information infrastructure breakdown the 8th place of the ranking, hence making it into the top 10.

Regarding technology, Børge Brende, the World Economic Forum’s President highlights that “Technology continues to play a profound role in shaping the global risks landscape. Concerns about data fraud and cyber-attacks were prominent again in the GRPS, which also highlighted a number of other technological vulnerabilities: around two-thirds of respondents expect the risks associated with fake news and identity theft to increase in 2019”. These concerns result from 2018 being traumatized by the increase of massive cyberattacks, breaches in IT security systems of States, massive data theft and the increase of artificial intelligence’s use for carrying out cyberattacks always more powerful.

Cyberattacks, the companies more and more efficient

Cyber resilience- Cyberattacks, the companies more and more efficient
Image source : VISHNU_KV via pixabay

Last September, Accenture published the research “Gaining Ground On the Cyber Attacker 2018 State of Cyber Resilience” and highlighted the doubling of the cyberattacks number suffered by the companies (232 on average in 2018 versus 106 in 2017 at international level), but also the improvement of the companies’ ability to identify and counter these attacks.

The attacks number has more than doubled between 2017 and 2018…

This research deserves attention as it differentiates from many very alarmist reports. If everything is not perfect, in particular due to the ingenuity and increasing complexity of the attacks, the companies continue to improve their defense capacity, were able to strengthen their cyber resilience and stood efficient despite the threats. The companies are able to defend themselves better, particularly by detecting the attacks much earlier.

… But where a third of the attacks were successful in 2017, the part of successful attacks decreased to 1 on 8 (12,5%) in 2018.

A report that blows hot and cold

Security teams have made great progress but there is still more work to be done. Companies now prevent 87% of all targeted attacks, but are still facing two to three security breaches per month on average.

Companies might be cyber resilient in two to three years, but the pressure and the threats’ complexity increase every day. If 90% of the respondents expect the investment in cybersecurity to increase in the next 3 years, only 31% think that it will be sufficient.

The new technologies are essential, but the investments are lagging behind. If 83% of the respondents agreed that new technologies are essential, only two out of five are investing in AI, machine learning and automation technologies.

Confidence around cybersecurity measures remains high, but a more proactive approach of the cybersecurity is needed. If more than 80% of the respondents are confident in their capacity to monitor breaches, on the other hand 71% said that cyberattacks are still a bit of a black box, they do not know how or when they will affect their organization.

The board of directors and management are more engaged with cybersecurity. 27% of cybersecurity budgets are authorized by the board of directors and 32% by the CEO. The role and responsibilities of the CISO must improve towards more transversality in the company.

5 steps to cyber resilience

Accenture highlights five steps to optimize the companies’ defense and move towards the ultimate aim of cyber resilience in a world that continues to change towards new threats territories (artificial intelligence, omnipresence of the cloud, social networks, smartphones, internet of things) for more and more complex threats difficult to counter and a need becoming strategic: the data protection.

  • Build a strong foundation by identifying high value assets, in order to better protect them including from internal risks. It is necessary to ensure that controls are implemented throughout the value chain of the company.
  • Test the IT security by training cybersecurity teams to the best hackers’ techniques. The role plays staging an attack and defense team with training coaches can allow to bring out the improvement points.
  • Employ new technologies. For a company, it is recommended to invest in technologies able to automate cyber defense and in particular to use the new generation of identity management which relies on multi-factor authentication and the user behavior monitoring.
  • Be proactive and anticipate threats by developing a strategic team (“threat intelligence”) in charge of evolving an intelligent security operation center (SOC) relying on a collect and mass analysis of the data (“data-driven approach”).
  • Evolve the role of the CISO (Chief information security officer). The CISO is closer to professions, they find the right balance between security and risk taking and they communicate more and more with the executive management, which now holds 59% of the security budget versus 33% a year ago.

Conclusion

The Accenture study highlights a real growing awareness on cyber threats by companies, and the implementation of investment to better protect themselves. The race is now launched to tend to cyber resilience, between more and more organized attackers and more and more sophisticated defense system. See you at the end of the year to make an assessment of the forces involved.

Communication, governance and opening: what we can wish for 2019

Communication, governance and opening: what we can wish for 2019

As 2019 begins, we make three wishes corresponding to an eventful year.

1.A better awareness of the Internet governance.

The main project at the time of international relations, fake news and voluntary disconnection from the Internet: the Internet governance should be at the table of the diplomats, political decision makers and strategic decision makers. France, which shines in the embassies’ world, should be able to take part in the digital decisions. The appointment of Henri Verdier as Digital Ambassador is a good thing, hoping that his knowledge in the private sector will be an absolute strength in his projects for France. France should be interested in the functioning of ICANN, the authority of world regulation of the IP addresses and the domain names. ICANN is recently the subject of strong criticisms regarding potential insider trading. The American desire to entirely privatize ICANN by suppressing its links with NTIA needs everyone’s attention.

2. ICANN decided it: a new opening of the root will soon be done. What temporality? That is a mystery. In the meantime, and so as to prevent that the list of the abandoned extensions does not cease to develop, new uses of the new extensions, whether they are opened (.PARIS, .FOOTBALL, .ICU…) or closed (.MMA, .LECLERC, .BCG…) should be found. Today (and tomorrow) the brand protection through a TLD’s possession is a definite advantage in front of the large number of opened extensions.  A TLD’s possession can also allow the opening of the scope of possibilities, like .BEST will announce at Namescon at the end of the month (surprise!).

3. The third and last wish, to anticipate the new uses of domain names. While the progress curve of the domain names’ volume increases less than previously, the focus should be on the issue of communication on the Internet. It appears as necessary to propose the registration of all possible domain names one can imagine. This is the consortium Unicode, an American entity which decides which character can be integrated in the IT standards. Let’s follow the evolution of the integration of the characters integrated in the Unicode to identify the future domain names trends. The internationalized domain names were a real positive evolution for web users around the world, myself the first concerned, having an accented first name.

Thus it’s very likely that emojis and other special characters will become the stars of the upcoming extensions. Soon the .♥.

These three wishes are part of our work at this time.

For example, our participation in the updating of the methods regarding intangible assets’ financial and extra-financial valuation of the Thesaurus Capital Immatériel by the “Institut de comptabilité de l’immatériel” (Intangible accounting Institute), aims to answer to the need to acknowledge the domain names’ value by financial managers.

Domain names are the first assets held by web users. We are fully aware of the responsibility associated to their management, and our recent developments in terms of operational excellence (ISO 27100) are the new guarantors.