Finland, Israel and Sweden are the best prepared countries in terms of cyber defenses, while China and India are both struggling, according to a major new report backed by McAfee.
Conducted by think tank Security and Defense Agenda, the report offers an assessment of current cyber threats and provides recommendations based on the work of scores of leading cyber security analysts in government, academia and the private sector. And it makes for sobering reading.
“For the moment, the ‘bad guys’ have the upper hand – whether they are attacking systems for industrial or political espionage reasons, or simply to steal money – because the lack of international agreements allows them to operate swiftly and mostly with impunity,” the report warns. “Protecting data and systems against cyber-attack has so far been about dousing the flames, although recently the focus has been shifting towards more assertive self-protection.”
The study gave countries surveyed a mark out of 5, with Finland, Israel and Sweden all scoring 4.5. They were followed on 4 stars by countries including the U.S. and U.K., which finished just ahead of Australia, Austria, Canada and Japan on 3.5. China scored 3 stars and India a lowly 2.5.
According to Isaac Ben-Israel, senior security advisor to Israeli Prime Minister Benjamin Netanyahu, top ranked Israel sees 1,000 attacks every minute. “The hacktivist group Anonymous carries out lots of attacks but they don’t cause much damage,” he said in the report. “The real threat is from states and major crime organizations.”
So what makes Israel so good on cyber security? Ben-Israel said that in part, it’s down to effective collaboration between defense, academia and industry, including a legal framework that allows government to “tell private industry what measures to take to secure the power, water and banking systems.”
China, in contrast, still faces significant challenges in establishing a coherent legal and regulatory system, according to Peiran Wang, a visiting scholar at Brussels’ Free University. “The Ministry of Public Security, the Ministry of Industry, the Ministry of State Security and even the military are involved and they don't communicate well,” he said.
Adam Segal, a senior fellow in China studies at the Council on Foreign Relations, told me this view chimes with some of what he has heard. “It does match another report done by EUI and Booz, and Chinese reporting stresses many of the weaknesses listed in the report – too many organizations and incoherent policy,” he told me when I asked him about China’s score specifically. “So overall, I think the assessment that China gets a lot of attention for what it does offensively but has weak defenses is probably accurate.”
James Lewis, a cyber security expert at the Center for Strategic and International Studies, concurred. “China's cybersecurity measures are very weak,” he told me. “A country that uses pirated software will always be vulnerable.”
This is a point I’ve heard made a number of time from analysts, and it’s one that also complicates the usual media narrative that holds China responsible for so many cyber attacks. With so much pirated software among Chinese users, they’re simply more prone to bots and malware, so an attack can look like it has originated with a Chinese user even if it hasn’t.
I also wanted to hear the views of another analyst who has been quite scathing about Japan’s cyber preparedness in conversations I’ve had with her in the past. Pauline Reich, a professor at Waseda University’s School of Law in Tokyo, told me she was a little perplexed over what she sees as a key omission from the study – South Korea.
“I would rank Australia on par with the U.S. based on the quality of their CERT (Computer Readiness Emergency Team) people and scholars at places like the University of New South Wales and the University of Technology and some of their police with whom I am acquainted,” she told me.
“(But) I would have also included South Korea in the survey, and depending on the criteria applied, would rank them up there with the U.S. and Australia based on the quality of their knowledge. They have provided technical assistance to Japan for many years and have some superb people among police, tech and law professors, etc.”
“The survey overlooked a really first rate country,” she added.