Companies and objects that are of state importance for Lithuania are being prepared to withstand potential cyber-attacks. Representatives from Vilnius Airport, Klaipėda Seaport, electricity production company Lietuvos Energija and oil terminal operator Klaipėdos Nafta told Delfi about the measures taken.
Ministry of National Defence officials have already stated that cyber security receives too little attention twice this year, also describing various performed exercises.
Delfi announced that the national defence system’s staff participated in the exercise Siunta [Delivery] where a fake company website was created and a letter sent, telling individuals they can go receive a package. Nevertheless, the majority of those who received the fake email, around 70%, recognised the threat, another 2% reported it, however almost 10% presented their personal data to the potential criminals.
A slightly different test was performed this June. A social engineering experiment was performed where national defence system staff were sent a letter with information that there are changes in the Labour Code which will raise wages for certain employees, thus they should open a special file which contained an infected attachment. This time 83% of staff did not open the attachment and warned others of it. The staff could notice that the sender’s address and contact details were suspicious.
How do companies and objects of national importance prepare for potential cyber-attacks?
The head of the Vilnius Airport Department of Communications and Marketing Indrė Baltrušaitienė explained that there are constant system checks, but also plans for exercises.
“Currently we are reviewing the vulnerabilities of both internal and external systems, various scans and discovered breaches are constantly fixed. Further security measures are being implemented. Next year, when the planned extra security measures are in place, there are plans for a cyber-security exercise, imitating a breach into internal systems. Based on the results, the configuration of the implemented security measures will be reviewed,” she said.
The Lithuanian airport network is comprised of three airports in Vilnius, Kaunas and Palanga. Over 2016 they serviced 4.8 million passengers and 52 thousand flights. Vilnius Airport is the largest in Lithuania, for example of 0.5 million passengers in May, almost 400 thousand used its services.
Another important infrastructure object is the Klaipėda State Seaport and it is also bracing for potential cyber-attacks. The seaport is the most northern ice-free seaport on the East coast of the Baltic Sea, it is also the most important and largest Lithuanian transport hub, combining sea, land and railways from East and West.
“The authority of the Klaipėda State Seaport participated in the Ministry of National Defence organised cyber security exercise Cyber Shield 2016 last year. We have been invited to participate in such exercise again this year,” Klaipėda State Seaport authority Port Regime and Technology Department director Egidijus Kuzmarskis told Delfi.
He explained that the port authority contains a number of modern automatic cyber security solutions, however the maintenance of cyber security is a constant process and not the implementation of one-off measures.
“This is why a part of the Port Regime and Technology Department staff are constantly reviewing cyber security solutions, evaluation newly appeared cyber threats and improve on currently employed cyber security measures,” E. Kuzmarskis said.
Furthermore, considering that one of the weakest links remains the human factor, port staff are trained how social engineering threats impact not only the organisation, but even their personal environments.
The head of information security for the state energy group Lietuvos Energija Liudas Ališauskas also outlined that cyber security exercises are being performed in companies of state importance. The group manages and makes use of the most important Lithuanian energy production capacities, which ensure the continuity of energy supplies, with the countrywide distribution network serving more than 1.6 million citizens.
“Other than these exercises, we also actively participate in the exercises organised by the Lithuanian National Cyber Security Centre, which we use to further strengthen the cyber security capacities of energy companies. It is worth noting that we have not faced any incidents which would have hampered the work of strategic importance companies. Of course cyber threats are rapidly developing, which is why we continue to develop our defensive capacities,” he commented.
The company representative explained that Lietuvos Energija has automated the scanning of vulnerabilities and their removal in critical systems, uses anti-virus programmes of several levels, has separated technical networks from the internet and is continuing to implement and make use of other measures.
“We also proceed with educational activities such as mandatory staff training, cyber security messages are communicated to staff at the company level. Furthermore we dedicate much attention to increasing the competences of our cyber security staff. We also actively monitor trends in cyber threats and implement proposed measures to counteract these threats,” L. Ališauskas said, adding that there are plans for a cyber-incident monitoring and management system to be established at the level of the entire business group.
Another state company, Klaipėdos Nafta, which is responsible for the strategic importance Independence gas terminal and oil terminals, stated that it participates in “various national and international cyber security trainings and exercises.”
“One of the core goals is increasing cyber-resilience. The entirety of organisational and technical cyber security measures are a key tool to accomplish this. Detailed information on what measures or tools are used to ensure cyber security cannot be revealed,” Klaipėdos Nafta Communications Department head Indrė Milinienė commented.
In August the Vice Minister of National Defence Edvinas Kerza announced that throughout the first half of this year, the country’s national defence systems were being attacked. While secret information was not leaked, he says that this is yet another reason to improve the cyber security of Lithuanian institutions and companies.
Be the first to comment