Q4/2020 - Cybersecurity Tech Accord

Studien zu Cyberhygiene und Hack Back, 12. November 2020

Zum 2. Jahrestag des „Paris Call for Trust and Security in Cyberspace“ veröffentlichte der „Tech Accord“ zwei Studien, die sich mit Prinzip 7 (Support Effort to Strengthen an Advanced Cyberhygiene for all Actors) und Prinzip 8 (Take Steps to prevent non-State actors, including the private sector, from hacking back for their own purposes or those of other non-state actors) befassen.

  • Das „Cyber Hygiene Compendium“ ist als ein Handbuch konzipiert, das in leicht verständlicher Form Individuen und Organisationen erklärt, wie sie eine bessere Cyberhygiene praktizieren und sich gegen Cyberangriffe schützen können. In der heutigen Welt, wo jedermann permanent Online ist, könne die Verantwortung für Cybersicherheit nicht mehr an Spezialisten delegiert werden. Jeder einzelne Nutzer – ob Individuum oder Unternehmen – müsse Risiken verstehen, Vorkehrungen treffen und sich entsprechend verhalten. Das Kompendium enthält Empfehlungen zu einer Vielzahl von Themen wie „multifactor authentication, domain name security, email authentication, routing security, virtual private networks, and how to defend against common attack methods like password spray or those which target consumer IoT products[1].  
  • Die Studie „No Hacking Back: Vigilant Justice vs. Good Security Online“ wendet sich gegen jedwede „Selbstjustiz“ von Unternehmen oder Individuen im Internet als Reaktion auf Cyberangriffe. Die Verfolgung von Straftaten im Cyberspace ist eine Aufgabe von staatlichen Strafverfolgungsbehörden. Die Studie unterscheidet nuancenreich zwischen legalen Abwehrmaßnahmen von Unternehmen gegen Cyberangriffe und illegalen Hack-Back-Aktivitäten und erklärt das Prozedere für eine gesetzeskonforme Reaktion auf Cyberangriffe[2].  

Dem Tech Accord gehören mittlerweile 150 Unternehmen an.

Mehr zum Thema
Q4/2020
  1. [1] The Cyber Hygiene Compendium, 12. November 2020: In today’s always-on, always-connected world, these challenges can no longer be a concern for cybersecurity professionals alone. Protecting our online environment is in everyone’s interest, and must be a shared responsibility. This means that everyone must hold themselves accountable for adhering to cybersecurity best practices; no individual, business, or government entity can be solely responsible nor fully exempt from helping to keep the internet safe and secure. And the technology industry has a responsibility siehe: https://cybertechaccord.org/advancing-cyber-hygiene-and-speaking-out-on-hack-backs-recognizing-the-2nd-anniversary-of-the-paris-call-for-trust-and-security-in-cyberspace-with-action/
  2. [2] No Hacking Back: Vigilante Justice vs. Good Security Online, 12. November 2020: „Hack back is not as simple to define as the above might led you to believe. In order to respond to an ever-changing threat environment, the private sector, especially the technology industry, needs to continuously innovate to create more effective security measures, some of which are more intrusive than others. Such measures are increasingly important for keeping users and customers everywhere safe and also require companies to pay close attention to the legal obligations that exist in this space, as those duties persist even amid a changing threat landscape. As the majority of cyberspace is owned, operated and maintained by private industry, many of the actions taken by government agencies and law enforcement groups against malicious actors online inevitably require private sector to comply with legal demands and process. In a limited number of cases, there may be also be coordination to disrupt malicious activity. As a result, policymakers considering how best to approach the subject of hack back should be careful to do so with a scalpel, as opposed to a hammer – to avoid encouraging dangerous hack back activities, while at the same time not inadvertently prohibiting measures that have become important in maintaining good security, and leaving space for continued innovation in security practices by the private sector. If any government is considering a revision of its criminal or civil laws to further enable private sector organizations to take action against attackers, it is essential to engage private sector groups in a dialogue before doing so. Such policies should be based on where the private sector may need to have more latitude to respond to an incident while not creating loopholes that allow for bad actors to flourish, or enable other unintended consequences to occur. siehe: https://cybertechaccord.org/advancing-cyber-hygiene-and-speaking-out-on-hack-backs-recognizing-the-2nd-anniversary-of-the-paris-call-for-trust-and-security-in-cyberspace-with-action/