Addressing Attacks on Vietnamese Computer Systems

Aug 4, 2016News

Addressing Attacks on Vietnamese Computer Systems

By

Allan Cytryn, Risk Masters International, LLC; Member of Board of Thinkers, The Boston Global Forum

and Prof. John E. Savage, Brown University; Member of Board of Thinkers, The Boston Global Forum

images

We recommend a series of actions, both short and long-term. The ultimate goals of these actions are to 1) ensure the appropriate international agencies are fully engaged in addressing this issue and its longer term implications, 2) operationally address the issue immediately and restore reliable, safe operations for air travel, and 3) more broadly enhance the cyber-resilience of Vietnam so that it is less vulnerable to such incidents.

I. Ensure the appropriate international agencies are engaged:

  1. . This is an airline security issue. We recommend reporting it to the International Civil Aviation Organization (ICAO) and requesting their assistance. While they may not have cyber security expertise, they are very concerned about security and may be able to help address the problem.
  2. We recommend reporting this incident to FIRST, the global Forum for Incident Response and Security Teams. FIRST describes itself as the “premier organization and recognized global leader in (computer security) incident response.” As you can see from their website, they can provide a great deal of assistance with long and short term solutions.
  3. This serious incident should also be reported to international bodies including ASEAN, G7, G20, and UNGA.

II. Address the issue immediately and restore reliable, safe operations:

  1. Consultants should be hired to do a forensic analysis of the affected systems. Friendly governments, such as the US, can advise on companies that are highly qualified to do this analysis and that can be trusted as well.
  2. Companies that we would recommend include Crowdstrike and Fidelis.

 

III. Longer-term, more broadly enhance the cyber-resilience of Vietnam:

a. Implement broad-based cyber-education at multiple levels

i. Train local specialists in computer security.

  1. The Vietnam Education Foundation (VEF) can help to develop university-level cybersecurity educational programs.
  2. The Boston Global Forum can also help with this effort.
  3. Vietnam could also emulate the US Computer Science for All program that encourages young Americans to acquire computer science skills.

 

ii. Educate policymakers and academics about Internet governance issues.

  1. DiPLO Foundation has cybersecurity programs to help diplomats to acquire the knowledge necessary to participate in international policy development.
  2. The Boston Global Forum can also help with this matter.

iii. Develop programs in cyber-hygiene for the general population and develop policies and practices to ensure the general population is appropriately educated in this area

  1. Begin classroom training in early education and continue through all level of schooling
  2. Provide online courses to allow all persons, including those not in school, to be properly educated
  3. Consider policies and incentives to encourage people to take the cyber-hygiene courses

b. Develop a cyber-resilient infrastructure

i. Broadly adopt the principle of cyber-resilience across all IT and Communications infrastructure in Vietnam.

ii. Jumpstart the process by targeting key industries, businesses and organizations that have the highest level of exposure and risk.

  1. Consider “pooling” or sharing resources and teams across multiple organizations where appropriate and practical to maximize the speed and effectiveness of the initial programs.
  2. Identify and address reasonable impediments to success, including funding, product availability, staff availability and training.

iii. Align these efforts with training goals, using these implementation activities to further the nation’s goals to train individuals who can then apply their learnings to other enterprises.