Monthly Archives: October 2024

Regulatory frameworks are being tightened across Europe to ensure organisations are equipped to withstand the risks of cyber attacks. There will be two key pieces of legislation coming into place in the EU: the Network and Information Systems 2 (NIS2) Directive and the Digital Operational Resilience Act (DORA).

NIS2

This comes into effect in October 2024 and replaces the original Network and Information System (NIS) Directive created in 2018. The goal of NIS2 is to standardise and enhance cybersecurity measures across EU member states, ensuring that organisations meet a baseline of security practices.

Requirements include:

• Conducting risk assessments to identify vulnerabilities
• Implementing policies and procedures for cryptography and security
• Enforcing multifactor authentication (MFA) for sensitive systems
• Providing cybersecurity training for employees handling critical data
• Developing incident handling and reporting plans to maintain operational continuity during security breaches

Impact on the finance sector

The Digital Operational Resilience Act (DORA), which will be effective from January 2025, seeks to improve the security of banks, insurance companies, and investment firms. DORA covers:

• Risk management processes for identifying and mitigating potential cyber threats
• Third-party risk management, ensuring vendors and partners meet security standards
• Digital operational resilience testing to validate system defences
• Reporting of relevant incidents to the appropriate authorities

Implications for organisations in the UK

Although the UK is no longer part of the EU, and therefore will not directly be subject to NIS2 or DORA, the regulations could still have implications here. UK organisations remain subject to the NIS Regulations (2018), and may face pressure to align with the new higher standards introduced by the 2024 EU directives in order to do business globally.

Higher standards in one territory can make it more efficient to adopt them universally, rather than managing different standards across various regions. As a result, NIS2 could drive a broader update of cybersecurity standards beyond its immediate EU scope.

Similarly, whilst DORA is aimed at financial institutions, its focus on operational resilience could influence organisations in other sectors, particularly those reliant on critical digital infrastructure or third-party service providers. Recent high profile cyber attacks, such as the data breach at the Internet Archive and the polyfill.io supply chain attack, underscore the importance of implementing preventative measures and reacting efficiently to threats.

The Internet Archive has suffered a major data breach impacting millions of users. The non-profit online library is known for its Wayback Machine, which preserves snapshots of websites and digital content – including more than 916 billion web pages saved over time – and lawsuits regarding copyright.

The stolen data contains 31 million unique email addresses, and also exposes usernames and bcrypt-hashed passwords from their user authentication database. It was stolen in late September 2024, although news of the breach first surfaced on October 9, when an alert appeared on the Internet Archive’s website.

Security expert Troy Hunt, who runs the widely-used Have I Been Pwned (HIBP) free compromise checker service, has confirmed the stolen data’s authenticity. He plans to add the compromised data to HIBP so users can check if their information was exposed in this breach.

In addition, the Internet Archive has been dealing with ongoing distributed denial-of-service (DDoS) attacks, which have been claimed by the hacktivist group BlackMeta. These attacks have intermittently disrupted services on the archive’s websites and tools, although they are not believed to be linked to the data breach.

In response, the Internet Archive has disabled the compromised part of its platform used in the attack and scrubbed its systems to remove malicious traffic. It is currently unavailable to users, although a read-only version of its Wayback Machine is accessible again.

The reasons behind this attack on a nonprofit organisation dedicated to providing free access to information and preserving digital content are still unclear. While the Internet Archive is widely respected for its mission, it has faced criticism and lawsuits from content creators, particularly over copyright concerns. However, it’s possible that this attack was politically motivated or even state-sponsored. Given the broad access the Internet Archive (and its Wayback Machine) provides to a vast range of resources, the responsible group may have been protesting against certain content — perhaps for religious or ideological reasons — or attempting to block access to information for tactical or control purposes.

The Internet Archive has been posting updates on X, and seems quietly confident that a return to full operations will be possible and happen relatively soon.