NATO is increasing pressure on its member states to beef up their cyber defenses and to take more aggressive action against Internet cyber attackers, according to an internal memo from NATO Secretary General Anders Fogh Rasmussen obtained by SPIEGEL.
The document, entitled "Concept on NATO's Cyber Defence," warns that the "scale and sophistication of cyber attacks against NATO's own networks and against Allies' critical infrastructure are steadily increasing" and notes that the threat has evolved from one of "mainly espionage and exploitation … to wide-scale disruption."
The document stresses that it is not only "vital to ensure that access to cyberspace is both reliable and secure," but also that NATO must "be prepared to anticipate, prevent and defend" against any external cyber threat -- and confront them "head-on."
"The exponentially increasing volume and sophistication of malicious cyber activity, as well as the speed at which events occur in cyberspace, underscore the need for greater emphasis on prevention rather than reaction," Rasmussen wrote. To meet this need, he added that NATO and its allies must "mount and, as necessary, develop a robust array of in-depth cyber defense capabilities to delay an attacker's advance, provide early detection through surveillance and advance warning tools, (and) contain potential damage."
The document reveals much about the alliance's view of the current threat and how it would respond. Although it admits that terrorists, criminals or "rogue hackers" could launch the attacks, it says that "states remain the most capable source for cyber attacks." Were one of the alliance's member countries to sustain a cyber attack, the document says that it the North Atlantic Council (NAC) would have to make a collective decision about how to respond.
A Long-Term Commitment
The memo goes on to list a number of planned moves for improving NATO's "capabilities to detect, assess, prevent, defend and recover in case of a cyber attack." These include developing "more sophisticated defenses" and centralizing "cyber defense governance for all NATO commands and agencies under a single authority, the Cyber Defense Management Authority." Rasmussen is scheduled to present the details of this "action plan" in June.
The memo also acknowledges that a broad-based cyber defense system that several allied member states have access to is only as strong as its weakest link. For that reason, it encourages alliance members to "achieve a minimum level of cyber defense in order to reduce vulnerabilities to national critical infrastructure, thereby enhancing resilience and reducing risks to the Alliance." Doing so, he adds, will require a "long-term commitment."
The paper indicates that the alliance intends to have "full operational capability" to respond to cyber threats by 2012.
In Germany, the National Cyber Security Council recently held its first meeting to coordinate the work of the newly established National Cyber Response Center.
