A Closer Look at Dutch Municipalities’ Response to Security Vulnerabilities

Research Finds Many Dutch Municipalities Inadequately Respond to Security Vulnerabilities

Introduction

A recent study conducted by the University of Twente and the Dutch Institute for Vulnerability Disclosure (DIVD) reveals that numerous Dutch municipalities are not effectively addressing security vulnerabilities. The study highlights the importance of coordinated vulnerability disclosures (CVD reports), often made by ethical hackers, in making the internet safer. While some progress has been made in recent years, the research indicates that there is still a significant room for improvement in the response of local authorities.

Slow and Inadequate Response by Dutch Municipalities

Out of the 114 Dutch municipalities included in the study, it was found that only 89 responded to the reported security vulnerabilities. Of these, a concerning 44 did not respond within the specified 90-day period for research purposes. Furthermore, in 49 of the responding municipalities, the identified problems remained unresolved. Even when vulnerabilities were fixed in some municipalities, communication with the notifier was lacking in 10 cases.

Reasons for Optimism

Despite the concerning findings, the study also highlights some positive aspects. In 19 municipalities, the security reports were handled appropriately, and timely responses were provided. This indicates that some local authorities are demonstrating proactive responsiveness to security vulnerabilities.

The Research Process

The research was carried out by Koen van Hove, a Ph.D. candidate at the University of Twente and a researcher at the Dutch Institute of Vulnerability Disclosure. Van Hove reported a security vulnerability in commonly used software to the municipalities between August 30, 2022, and February 23, 2023. He used the municipalities’ websites and followed the CVD procedure where available. The security vulnerability in question revolved around the ability to send emails through municipal infrastructure that appeared indistinguishable from legitimate correspondence.

Challenges Faced in Reporting

Throughout the reporting process, several challenges were encountered. Malfunctioning forms, inaccessible email addresses, and confusing reporting methods hindered efficient reporting. It was also noted that many reporting forms required logging in via DigiD, preventing anonymous reporting. Additionally, in 11 out of 114 cases, an automated process triggered a request for personal information from the Personal Records Database (BRP), without notifying the responsible parties at the municipalities.

Government Initiatives and Room for Improvement

Since January 1, 2019, the government has mandated the implementation and disclosure of a clear CVD procedure through the Baseline Information Security Government (BIO). However, the research reveals that over half of the contacted municipalities (60 out of 114) have not yet published or enforced a clear CVD procedure. This indicates a need for improvement in ensuring that municipalities have robust security reporting mechanisms in place.

The Importance of Reporting and Low Thresholds

The significance of reporting vulnerabilities through the CVD system for municipalities was demonstrated in 2020 during a ransomware attack on the municipality of Hof van Twente. Although volunteers making these reports are not legally obligated to do so, they contribute due to their awareness of the importance of addressing security vulnerabilities. Therefore, it is crucial to keep the threshold for making such reports as low as possible. This can be achieved by publishing a clear and accessible reporting procedure on municipal websites, allowing for anonymous reporting and minimizing the unnecessary request for personal data.

Editorial and Advice

The Urgency of Addressing Security Vulnerabilities

The findings of this study emphasize the urgent need for Dutch municipalities to effectively respond to security vulnerabilities. In an increasingly digital world, where cyber threats are constantly evolving, government entities must prioritize the security of their technology infrastructure. Failing to address vulnerabilities can have severe consequences, leading to data breaches, ransomware attacks, and compromised citizen trust.

Enhancing Coordinated Vulnerability Disclosures

To improve the response to security vulnerabilities, Dutch municipalities should take several steps. Firstly, they must implement and enforce a clear CVD procedure, as mandated by the government’s BIO initiative. This procedure should be easily accessible on municipal websites, ensuring that ethical hackers and concerned citizens can report vulnerabilities promptly and anonymously.

Streamlining Reporting Mechanisms

Municipalities should also address the challenges faced in the reporting process. This includes resolving malfunctioning forms and email addresses, ensuring a user-friendly reporting process, and eliminating unnecessary requests for personal information. By streamlining the reporting mechanisms, municipalities can encourage more individuals to contribute to the security of their digital infrastructure.

Promoting Timely and Informative Communication

Furthermore, municipal authorities must prioritize timely and informative communication with those reporting vulnerabilities. This includes acknowledging receipt of reports, providing updates on the progress of the resolution, and notifying the notifier when the vulnerability has been fixed. Proactive communication builds trust and encourages more individuals to engage in responsible disclosure practices.

Investing in Cybersecurity Education and Resources

Beyond improving the response to vulnerabilities, municipalities should also invest in cybersecurity education and resources. This includes training staff members on cybersecurity best practices, fostering collaborations with ethical hacking communities, and staying updated on emerging cyber threats. By building a culture of cybersecurity awareness, municipalities can better protect their systems from potential attacks.

A Collaborative Approach

Lastly, it is crucial for both municipal authorities and ethical hackers to recognize the importance of collaboration in addressing security vulnerabilities. Municipalities should view ethical hackers as partners in safeguarding their digital infrastructure rather than adversaries. By working together, the collective effort can create a safer internet environment for all stakeholders.

Conclusion

The study conducted by the University of Twente and DIVD serves as a wake-up call for Dutch municipalities to enhance their response to security vulnerabilities. While some positive practices were identified, significant improvements are needed to ensure a swift and effective resolution of reported vulnerabilities. By implementing clear CVD procedures, streamlining reporting mechanisms, promoting timely communication, and investing in cybersecurity education, municipalities can significantly enhance their cybersecurity posture and protect both their digital infrastructure and the citizens they serve.