Speech minister Grapperhaus sluiting ONE conference
Toespraak van minister Grapperhaus (JenV) bij het slot van de ONE Conference over cybersecurity. Deze vond plaats op 29 september 2021, gedeeltelijk in Den Haag en gedeeltelijk online. De tekst is alleen in ht Engels beschikbaar.
Ladies and gentlemen,
‘He exists in a world beyond your world. What we only fantasize, he does. He lives a life where nothing is beyond him. But you know what? It's all a facade. For all his charm and charisma, his wealth, his expensive toys... he's a driven, unflinching, calculating machine. He takes what he wants, when he wants... and disappears.’
Perhaps you’ll recognise these lines from the film Swordfish. A famous, but rather weak film from 2001, if you ask me. What I really find disappointing about this film is the way it glorifies hacking and hackers.
To be clear: I’m not taking about ethical hacking here. I’m talking about cybercrime, which takes many forms. Including ransomware attacks.
It’s not just an exciting plot device in films. It’s a growing problem. And the ransoms are growing too. Recent attacks show just how much social impact ransomware can have.
I’m sure everyone here is aware of the Kaseya hack that took place in July or the Colonial Pipeline hack. But also closer to home, successful ransomware attacks have recently been carried out.
And that certainly won't have been the last cybercriminal attacks. As Jerry Bessette mentioned in his keynote speech yesterday: the threat remains, because criminals keep improving their knowledge and finding new ways of targeting victims. Victims who then find themselves in a difficult situation and feel forced to pay the ransoms demanded.
Criminal investigations have shown that part of the profits from 1 attack are invested in infrastructure for new ones. We need to break this chain. And government and businesses need to do this together.
Earlier this month I discussed cyber resilience with representatives of small and medium-sized enterprises. They are the most vulnerable group by far. For them, a single ransomware attack can prove fatal. And that is why ransomware is a threat to the prosperity of the Netherlands as a whole.
I’d like to thank those business owners for their openness during our discussions. Small and medium-sized enterprises often don’t see themselves as potential targets. Or they think their existing security measures are adequate.
I want to stress that falling victim to an attack is not something any business owner should be ashamed of. In fact, if it does happen, they should be open about it.
These are important discussions to have. To increase nationwide cyber resilience, we need to share information on threats with all the parties who need to know. By sharing knowledge, we’re arming ourselves against cybercriminals. But it’s vital that we also recognise the big differences in resilience between companies.
Large companies can afford to invest in cybersecurity knowledge and expertise. But smaller companies often lack the resources to improve their cyber resilience. We need to help each other shrink that gap.
During its term in office, the current government has invested in improving opportunities to strengthen resilience and investigate cybercrime.
First, we have established the Digital Trust Center.
DTC informs and advises small and medium-sized enterprises and large enterprises in non-critical sectors. With tools like the basic cyber resilience scan, it’s helping to raise awareness among these businesses.
Second, we’ve strengthened the competences of the National Cyber Security Centre. Soon, the law will be changed to allow threat and incident information be shared more widely. This will help businesses and other organisations take measures to counteract threats and incidents.
And third, early this year, the police launched a Ransomware Task Force to help combat ransomware at international level, in cooperation with public and private parties. You’ve already heard about it during this conference.
The task force’s success depends to a large extent on the willingness of public and private parties to work together and share information. By collecting information on attacks, such as IP addresses and Bitcoin data, we can uncover the modus operandi behind them and set the right priorities.
This will help us track down those responsible and disrupt criminal practices. Structural information-sharing is key in this regard. It really makes all the difference.
Ladies and gentlemen,
Tackling cybercrime will be an issue that always requires our attention. Digital processes now make up the nervous system of our society. Almost all of our activities – work, education and leisure – have a digital component.
Cyber attacks are attacks on this nervous system and, as such, can cause massive disruption.
Looking ahead, tackling this issue will fall to businesses and the next government. Investigation and prosecution are essential parts of any approach. But companies should also observe the basic measures like patch management and network segmentation as advised by the NCSC in a ransomware guide, for example.
In the meantime, the advice remains: never pay ransom. However hard this decision is, crime must never pay.
The tagline of Swordfish is: Log On. Hack In. Go Anywhere. Steal Everything.
But that’s a simplistic Hollywood film. In real life, criminals don’t get a starring role.
Our tagline should be: Log on. Share info. Stay alert. Be safe.
Thank you.