‘The Hollywood image of hackers is misleading’

Is critical infrastructure in Germany currently more at risk than before the war in Ukraine?

We might have expected increasing, and increasingly sophisticated, cyberattacks on critical infrastructure after Germany supplied Ukraine with weapons. In fact, we are not seeing it. At the beginning of the war, known groups did increase attacks worldwide. However, this subsided. The Killnet group, which has ties to Russia, has been active in the USA — paralysing airport websites — but this does not affect critical US infrastructure.

Which components of critical infrastructure are attacked most frequently?

All of them are attacked, most of the time (the question is: which attacks succeed, and what damage they do). Probably digital communications and the industries that depend on them are most at risk. Much of our infrastructure—from energy supply to the health system—depends nowadays on digital systems, and thus becomes a target for cyberattacks. There is some infrastructure that avoids it: for example, a high-frequency transmission tower on the Hautes Fagnes in Belgium connects the stock exchanges in London and Frankfurt. Its primary purpose is to enable particularly fast financial transactions, but it is not susceptible to cyberthreats except at the endpoints. The health sector is constantly exposed to a flood of ransomware. Such malware programmes deny access to data and systems, and are used to extort ransom for access. But to completely cripple an infrastructure component requires significant resources: sufficiently many competent, trained computer scientists and a lot of time. It ends up being quite a bureaucratic process. I think it unlikely that any state has already trained enough hackers on the required scale to wage effective cyberwar. The future, however, could be different.

So, physical attacks are much more dangerous?

Yes, because such attacks are much easier to carry out. The German railway company Deutsche Bahn (DB) depends on digital systems for its entire communication infrastructure. DB is working flat out to make it cybersecure. But, as we saw at the beginning of October, sabotage of the physical infrastructure, of cables, led to massive problems. There is also concern about nuclear power plants, currently the one in Zaporizhzhia, Ukraine, which has recently been bombed/shelled several times. And think of the physical attacks on the Nord Stream 1 and 2 gas pipelines. Physical attacks are simpler and do not require complex organization. The idea of cyberwar is nothing new. But the Hollywood image of hackers is misleading, because cyberwar needs more, and more ingenious, human resources than physical attacks, and it will likely have less impact.

How well can attacks be traced?

After a cyberattack, specialists secure the data and try to find out exactly what happened. The search begins for patterns and so-called “digital signatures” that we have already seen in other cyberattacks. It can take several months before we are relatively sure whence an attack came. It’s a complex process. Two decades ago, there was an attack on my research group’s servers at Bielefeld University. Someone gained entry into our system in order to propagate malware. We traced it to a Romanian hacker who had intercepted passwords. He was known for such activity. But such events are history; it is not so simple nowadays. If attackers want to remain anonymous, cyberattacks can be advantageous. If attackers don’t need to hide, bombs and rockets are more destructive.

How can critical infrastructure be better protected against cyberattacks?

The very best defence is to disconnect systems completely from the Internet and any external sources of data. However, not being connected to a network has operational disadvantages, because a quick technical response in a crisis is an advantage, and this is often easier with network connections. Managers have to juggle these conflicting needs. This is best performed in a standardized way—using national and international standards. There is a need for training and education in the operation and use of digital systems in companies, and not just in cybersecurity. More attention does need to be paid to the possibility of cyberattack. Many private companies address this need: the market is growing. But software developers also need to make improvements. Software has to become more reliable—it has to do exactly what we want it to do and not what we don’t want it to do. Some of us have worked on methods to increase software reliability over the decades, and these methods need to be applied more effectively. Since the war in Ukraine started, the cybersecurity meetings I attend have been working on the same things we have always been dealing with. Things have not changed that much. No one is panicking and asking, ‘what do we do now?’