Dutch Forge a New Cybersecurity Strategy Amid Attacks

In the coming year, the Dutch government will be advancing new legislation, regulations, and collaborations to strengthen the Netherlands’ cybersecurity posture, under its recently issued National Cybersecurity Strategy 2022-2028. The strategy and its action plan have come out at a time of rising cyber risk in the country.

Earlier this year, the Cyber Security Assessment Netherlands 2022 (CSAN 2022) found that the country’s digital defenses have not kept pace with the evolution of attacks by both nation-states and cybercriminal gangs. “The threat of offensive cyber programs against the Netherlands and Dutch interests continues to be high and will only increase in the future,” concluded the review, compiled by the National Coordinator for Counterterrorism and Security. “The required growth — and scalability — of Dutch resilience appears to be lagging behind.”[1]

Recent attacks attributed to tensions between Europe and Russia have heightened these concerns. For example, Russian hackers were said in November to be probing a liquid national gas terminal in Rotterdam as a prospective cyber target.[2] The CSAN 2022 assessment also cited attacks on oil storage and shipment sites in January and the abuse of Dutch digital infrastructure for DDoS attacks on Ukrainian websites in February.

At the same time, “ransomware has proved to be a gamechanger,” the report said. “Serious, organized cybercrime has become very scalable and has therefore taken on industrial proportions in recent years in terms of victims, damage, and criminal proceeds.”

Dutch security professionals surveyed for Mimecast’s State of Email Security 2022 (SOES 2022) report gave a similarly grim appraisal of the situation. Nearly eight in 10 were preparing at the start of 2022 for a negative business impact from an email-borne attack. As it turned out, their fears were warranted. In our preliminary findings for the forthcoming SOES 2023, about the same number of respondents reported that a ransomware attack had indeed harmed their business operations to some degree in 2022.

Cybersecurity Strategy Urges Collaboration

The Dutch National Cybersecurity Strategy and Action Plan sets up four pillars to bolster the country’s security:

• Improve the resilience of government, businesses, and nonprofits.
• Ensure that digital innovation includes security by design.
• Combat digital threats from criminals and nation-states.
• Increase the cybersecurity talent pool and improve citizen security awareness.

To achieve these goals will require public-private collaboration and coordination, government officials said. The government is streamlining its own efforts by merging its National Cybersecurity Center, Digital Trust Center, and Cyber Security Incident Response Team into a single national cybersecurity authority.

Joint efforts have also included input from the Dutch Cyber Security Council of business and government representatives, which will continue to advise the government and publish independent recommendations on how to implement the national strategy.[3] Some observers say the government will need to go further, to become more aware of and responsive to business interests.[4]

Under the national strategy, “clear, verifiable legislation and regulations will also be brought in, putting a stop to the reliance on voluntary guidelines,” the government announced.[5] Standards for hardware and software, however, are left in the purview of the European Commission.

In Mimecast’s SOES 2022 survey, Dutch security professionals expressed some ambivalence about the potential impact of government-mandated legislation requiring minimum levels of cybersecurity. Just 20% expected such measures would make a big difference in the overall security of their businesses. Meanwhile 93% expected such regulations to increase costs, and about the same number foresaw that they’d have less freedom to determine their own best course of action in responding to cyberthreats.

Dutch Security Pros Build Defenses

Despite the challenges, Mimecast’s SOES 2022 survey showed Dutch security professionals making some strides in implementing best practices including:

• Integration: Ninety percent expressed a preference for integrating their security tools, which improves efficacy.
• Artificial intelligence (AI): Forty-two percent said they had implemented AI in their company’s cybersecurity program in 2022, up from 34% the previous year. Another 35% said they had plans to implement AI in 2022. Many of those using AI reported increased accuracy of threat detection, better prevention, faster remediation, and reduced workload. 
• Investment in cybersecurity: On average, Dutch cybersecurity companies devoted nearly 15% of their overall IT budget to cybersecurity, slightly higher than the global average of just under 14%.

Ransomware Response Guidance Issued

Given the rise of ransomware, the Dutch National Cyber Security Center also recently published a detailed incident response plan that companies can implement. It covers six areas of action:

• Preparation
• Identification
• Containment
• Eradication
• Recovery
• Lessons learned

The guidance places its greatest emphasis on preparation, for higher confidence in decision-making under the pressure of an actual breach. Another example of its advice: “A good backup, tested and verified for integrity and without malware or unwanted encryption, is obviously essential.”[6]

The Bottom Line

The Dutch government is rolling out a new national cybersecurity strategy amid rising attacks from nation-state actors and cybercriminals. Mimecast’s research illustrates companies’ deliberate attempts to lower the risk, but the government sees cyberattackers outpacing the defenders. Read about global trends in Mimecast’s State of Email Security 2022 and sign up to receive our forthcoming 2023 report. 

[1] “Cybersecurity Assessment Netherlands 2022,” Dutch National Coordinator for Security and Counterterrorism 

[2] “Russian Hackers Target Dutch LNG Terminal,” Oilprice.com

[3] “CSR Multiannual Strategy 2022-2025,” Dutch Cyber Security Council

[4] “Cooperation Essential for the Dutch Cyber Security Strategy,” Fox-IT

[5] “Cabinet Presents New Cybersecurity Strategy,” Government of the Netherlands

[6] “Ransomware Incident Response Plan,” National Cyber Security Center