CYBERWAR (2): "We see many targeted cyber attacks"

Is Germany adequately protected against cyber attacks? How quickly can we react to a hybrid scenario and what legal and international legal principles apply in cyberspace? Initiative Gesichter des Friedens spoke with Elmar Padilla, head of the "Cyber Analysis & Defense" department at the Fraunhofer Institute.

Your department is dedicated to protecting critical systems and infrastructure. What exactly are "critical systems and infrastructure" and are they adequately protected against cyber attacks in Germany?

Elmar Padilla: Critical systems and infrastructure are all systems and infrastructures whose failure or malfunction pose existential risks. I explicitly include risks to financial existence here. An example of such critical infrastructure with many critical systems is the energy supply.

In international comparison, I see the protection of critical systems and infrastructure in Germany at a good level. However, that doesn't mean there is no room for improvement. We are operating in an environment with attackers and defenders, so there is a high dynamic and a continuous need to adapt and further develop protective measures.

According to the draft of the IT Security Act 2.0, the Federal Office for Information Security (BSI) should receive more powers. Do we need an "active cyber defense" and what legal framework would need to be established for this?

Elmar Padilla: If by "active cyber defense" you mean active measures for hazard prevention, then we need those measures. For example, redirecting infected systems to so-called sinkholes has proven to be very effective in combating botnets. With the proposed expanded powers for the BSI to operate its own sinkholes and the obligation of providers to redirect C&C domains to sinkholes operated by the BSI, we are taking a big step towards a safer and more peaceful internet.

As I am not a lawyer, I do not want to comment on the necessary legal framework.

"Hybrid warfare is unfortunately no longer a vague threat, but is already a reality."

On the topic of hybrid threats: Cyberspace is also a preferred operating space for hybrid actors. What are "hybrid threats" and how great is the risk potential in Germany?

Elmar Padilla: The Federal Ministry of Defense provides a good explanation of the first part of the question. It is characterized by a combination of different means: classical military operations, economic pressure, computer attacks, and propaganda. For some time, we have seen a variety of targeted cyber attacks for espionage and sabotage purposes. Additionally, we see disinformation campaigns and attempts to influence public opinion. These are unfortunately no longer vague threats, but are already a reality. Therefore, I see the risk potential from hybrid threats, particularly given Germany's economic strength and the trust in our liberal democratic order, as very high.

Therefore, it is all the more important to conduct research on effective protective measures and to provide the necessary support and empowerment to our agencies responsible for protecting against such threats.

The "Cyber Analysis & Defense" department at the Fraunhofer Institute on the internet

CYBERWAR on SPARTANAT:

- "The digital defense case is only partially successful", Lieutenant General Ludwig Leinhos, Inspector of the Cyber and Information Space Command of the German Armed Forces in an interview.

- "We see many targeted cyber attacks", says Elmar Padilla, head of the "Cyber Analysis & Defense" department at the Fraunhofer Institute.

- "Cyber attacks cost around 20 dollars", says Harald Summa, CEO of the DE-CIX Group AG. He talks about critical infrastructure, the ubiquity of DDoS attacks, and the Federal Constitutional Court's ruling on surveillance by intelligence services.

Book on the topic: "Myth of Cyberwar"

More on the topic: HERE you can download the Defense IT Report for free.

Source: Initiative Gesichter des Friedens. With kind permission.