Inside NATO’s cyber defence centre

Institute For Ethical Hacking Course and Ethical Hacking Training in Pune – India

Extreme Hacking | Sadik Shaikh | Cyber Suraksha Abhiyan

Credits: Sky News

A few days before visiting NATO’s cyber defence centre, journalists were asked to submit their passport details and the serial numbers of every electronic device they planned to bring with them.

The cyber defence centre is officially known as the NATO Communications and Information Agency, or NCIA. Militaries love acronyms. It is co-located at a military base in Casteau just north of the Belgian city of Mons SHAPE, or the Supreme Headquarters Allied Powers Europe.

Security procedures at SHAPE are military standard. Photography is prohibited everywhere on site. The journalists were forbidden from travelling anywhere without a chaperone, and roads with entrances to the base have even been scrubbed from Google Street View presumably to prevent would-be attackers from performing low-cost reconnaissance of the site.

Cyber security is still relatively new for NATO, or the North Atlantic Treaty Organisation, which will celebrate its 70th anniversary this year.

The treaty itself was signed on 4 April 1949 by 12 countries following the Second World War in the face of an expansionist USSR, and the alliance now has 30 member states including the newly joined North Macedonia.

Its key purpose is the principle of collective defence, underlined by Article 5 of the treaty which establishes that an attack against one ally is considered an attack against all.

Jens Stoltenberg, NATO’s secretary general, has warned that cyberattacks are capable of triggering Article 5, although there are specific concerns about the standard of attribution needed to declare war over such an attack.

Speaking to Sky News at NATO’s headquarters in Brussels, the organisation’s assistant secretary general for emerging security challenges Dr Antonio Missoroli said that the threshold for when a cyber attack would be considered an act of war has been kept deliberately vague by the alliance, to allow for greater political flexibility in dealing with such an attack.

Of course, simply declaring war isn’t the purpose of the alliance. NATO is committed to defence and securing NATO networks is the core job of the NCIA.

The organisation covers more than 60 different locations, from its political headquarters in Brussels through to military commands and the sites of NATO operations in Afghanistan.

The team there deals with 500 incidents on a monthly basis, with an incident defined as a computer network event which requires human intervention.

The kinds of intervention vary as Christophe Vandeplas, a cyber security analyst at the NCIA’s rapid response room, flagged to Sky News.

The room itself lies past hallways, the longest one named after former US president Dwight Eisenhower, the first supreme commander of NATO – a position which has always been held by US military generals.

There were no iris scanners or armed guards past this corridor, however, just an old-fashioned sign-in sheet with a pen sellotaped to a piece of string.

Journalists were walked past the cryptographic vault, or at least the first of four combination-lock protected doors which led to a Faraday cage of a room holding every cryptographic key used by NATO.

Surreal health and safety posters hung beside security awareness posters warning staff to keep an eye out for anything which seemed as if it shouldn’t be there.

Inside, a commercial threat intelligence feed showed reports on a wall-mounted monitor from an American cyber security company of new malware threats which the organisation needed to be aware of.

Were the journalists not in the room other dashboards would be displaying military intelligence from NATO allies. At the time, they showed alerts from a UK telecommunications firm and a so-called “real time” attack map of the sort popularly mocked up by a number of cyber security companies.

In this case the map belonged to Fortinet. The staff claimed it wasn’t completely useless, although it was confessed to be “eye candy” for the journalists present.

“It tells us what Fortinet is detecting,” explained Ian West, the chief of cyber security at NCIA.

“What we’re interested in is the unseen material,” said Mr Vandeplas, a civilian who had previously worked for the Belgian ministry of defence.

Mr Vandeplas wore business casual clothes, as did Mr West and Dr Missoroli. Many of the staff present however were from NATO member state militaries, including Germany, Turkey, the UK, and Italy within the NCIA.

The dominant cyber threat actors that NATO needs to worry about tend to be the dominant actors in other domains as well.

Russia and China have both exercised well-resourced cyber capabilities in recent years, while Iranian hackers have also been identified targeting the computers of national security interests.

After recognising cyber space as a domain equal to land, sea, and air, NATO established what it called the Cyber Operations Centre, or CyOC, in Mons.

Although it won’t be fully operational until 2023, the CyOC will have 70-staff analysing hacking threats and attacks on NATO’s networks, which are key logistically to all operations in the field.