Germany's national security strategy

Attacks on public institutions, authorities and government offices are on the rise. The German government sees cyberattacks as a serious danger because they have "unlimited geographical reach" and harbour "high damage potential", as stated in the "National Security Strategy" presented a few days ago.

Last week, the German government presented its "National Security Strategy". Current events prove it right when it states: "Cyber attacks are increasingly aimed at destabilising our government and society or those of our partners".

Most recently, the US Department of Energy joined the ranks of compromised government organisations. The MOVEit vulnerability is spreading worldwide. As reported, the financial sector, companies such as Shell and the German health insurance company AOK have already been affected.

The alleged Russian group Cl0p is behind the attacks. In the meantime, it has published a list of the victims, which it boasts about. The gangsters use vulnerabilities in the file transfer software MOVEit, through which they gain access to internal company networks via detours. The MOVEit software is supposed to provide secure file transfers for businesses and government agencies, but it has been hit by three dangerous vulnerabilities in a very short time. The US IT security authority Cybersecurity and Infrastructure Security Agency (CISA) has confirmed, according to media reports such as CNN, that several hundred companies and institutions in the USA alone have fallen victim to the attacks. A reward of one million US dollars has now been offered for the capture of the Cl0p gang. It is feared that about a dozen US government institutions could be among the victims. Important institutions in the public interest are a popular target of cyber attacks for harming a country or its citizens.

Lots of security gaps at companies and authorities

Meanwhile, it is reported that a German firm uncovered an average of 11,000 internal vulnerabilities and security holes in German companies and public authorities. For this, 213 relevant public and private sector organisations were examined. So it is not without reason that IT security is increasingly in the focus of politics.

This is also reflected in the national security strategy presented by the German government last week. Although it does not only address cyber security, but especially military security policy issues, cyber security is a cross-cutting issue and is therefore incorporated in many places.

The national security strategy, which is "the first in the history of our country", as Chancellor Olaf Scholz emphasises in the foreword, is based on "a broad concept of security". Accordingly, it includes topics such as climate and ecosystem crises, strengthening food security, pandemic prevention or space security, as well as supply chain, energy and food security. However, in view of the importance of the digital space, cyber security is an essential part of integrated security, it says.

The German government describes the potential danger as follows: In cyberspace, crime, terrorism, espionage and sabotage "have an unlimited geographical reach, harbour high damage potential and are often difficult to attribute to specific actors". It singles out ransomware in particular: "Extortion software ("ransomware") in particular has developed into a significant threat for companies, public institutions and critical infrastructures".

Joint action against cybercrime

But unlike many other fields of activity, cybersecurity is seen as a cooperative challenge: "The Federal Government sees cybersecurity as a joint task of the state, business, science and society". Accordingly, measures are to be approached as joint projects with private actors or organisations: "We will further develop our cybersecurity architecture, promote targeted technologies and intensify cooperation with the private sector". This is based on the idea that "Germany's resilience and competitiveness is based on its high innovative strength and on technological and digital sovereignty". That is why science and research as well as the innovative strength of companies are to be specifically promoted.

For critical infrastructures and companies in the special public interest, "the highest level of protection" is to be ensured. "That is why we will place a special focus on improved cooperation between authorities when implementing the EU's NIS2 directive on cyber security," the document states. The government clearly mentions: "We reject hackbacks as a means of cyber defence in principle". This measure is controversial because it requires a clear and doubtless identification of the perpetrators, which is rarely possible.

The paper also calls for a right to encryption and the protection of privacy. The role of citizens and stakeholders is also interesting: "Companies and civil society must develop a higher awareness of risk, take responsibility for their cyber security and build up the necessary skills, including for self-help and self-provision". In other words, an appeal for more personal responsibility. However, how far this should go, remains open.

All in all, the national security strategy remains rather general and non-binding. This is criticised in particular by industry associations and representatives. For example, the digital industry association Bitkom complains: "Germany will continue to be only partially prepared to defend itself in the digital space. The National Security Strategy falls well short of the expectations and requirements of the digital economy."

Author: Uwe Sievers