Call us now:
Ted Dziekanowski
A case of buyer and seller beware. In this case the Municipality Hof van Twente in the Netherland wants to recover damages from IT company Switch IT Solutions from Enschede following a cyber incident in 2020.
Hackers were attempting to Hack the Municipalities tech, managed by Switch IT from 2019, with a successful hack in 2020, that the Municipality is still dealing with. The municipality wants compensation from Switch IT ‘for breach of contract’. According to the Municipals lawyers, the company has not fulfilled the contractual agreements. But according to the IT company, the municipality itself ‘laid out the red carpet’ for the hackers.
But in a demonstration of how complex these issues invariable are, the password of the administrator account of the servers was ‘Welcome2020’. and Switch claims that council staff modified firewall rules that facilitated the attack. With the council contending that Switch did not monitor and report infrastructure changes to them as they should have done.
Lessons learnt:
1. Make sure your vendor contracts are very clear and articulate roles and responsibilities of all parties.
2. Test your contracts on a ‘table top’ with appropriate scenarios.
3. Agree who is responsible for making changes to critical infrastructure, preferable put in place a ‘break glass’ process.
4. When was the last time policies and procedures were independently audited?
Now would be a good time to read EU NIS 2.0, as the scope includes public administration and evaluate contracts and compliance.
#cybersecurity #cyberriskmanagement #incidentresponse
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7005108096519839744