The cyberthreat landscape has changed significantly over the past year. Launching a cyberattack no longer requires advanced hacking skills, as artificial intelligence is increasingly being used to identify security vulnerabilities and write malicious software. As a result, attacks can be planned faster and with less expertise than before.

"Cyberattackers have to do quite complex thinking. They experiment and try different things, but can only accomplish so much. Now, with AI helping them at every step, it can do everything 10 times faster and much more effectively than a human. Almost anyone who wants to launch an attack can do so. You don't need formal training. As a result, the number of people capable of carrying out successful and highly effective attacks has increased dramatically. Those who want to attack now have an extremely powerful tool at their disposal and that has left cybersecurity defenders with their hands full. Everyone is trying to identify vulnerabilities, patch them and figure out how to redesign their systems to make them more secure. We are currently at a fairly critical point in terms of cybersecurity," said Tanel Tammet, professor of computer science at Tallinn University of Technology (TalTech).

Cybercriminals exploit both software vulnerabilities and human error. Phishing emails and weak passwords are among the most common ways of gaining access to systems.

Kristjan Hinn, head of information security at North Estonia Medical Center (PERH), said the hospital also faces constant cyberattacks.

"We see hundreds of thousands of attempted attacks every month. But we don't even pay attention to most of them because our automated systems block them. We focus more on the incidents that make it past those automated defenses. Each month, our analysts investigate 200 to 300 incidents, about 10 percent of which require some action on the hospital's part," Hinn said.

Hospitals' day-to-day operations depend heavily on the digital exchange of information.

"A great many information systems are interconnected, including laboratory systems, radiology systems, medical images and examinations. It's a vast ecosystem. Medical care can still be provided with pen and paper, but our efficiency would certainly take a major hit. As a hospital, we simply couldn't treat as many patients as we can with the support of information systems," Hinn said.

Estonian hospitals have prepared for potential cyber incidents, including running exercises simulating scenarios in which all information systems are down for several days.

Mai Kraft, head of the cybersecurity center at the Estonian Information System Authority (RIA), said complete protection against cyber incidents is generally impossible.

"On the one hand, we have to accept that incidents with a certain level of impact may occur. On the other, we need to prepare to recover from them quickly. Cybersecurity is a shared responsibility between the state and private businesses. The state can provide guidelines and requirements, conduct oversight and advise companies, but businesses themselves must also invest in cybersecurity and improve their systems," Kraft said.

In France this week, hackers gained access to a cold storage facility containing blood samples and bags of plasma intended for transfusions and pharmaceutical production. The temperature inside the facility rose from minus 30 degrees Celsius to 110 degrees Celsius. Following similar incidents, North Estonia Medical Center reviewed its own systems. However, such an incident is considered highly unlikely at Estonian hospitals.

"I was surprised that the controllers at the French blood bank were so easily accessible, at least based on the initial information. We've designed our systems so that, since refrigerator temperatures don't need to be adjusted every day, there's no need for the cable to remain plugged in all the time," Hinn said.

However, organizations' ability to maintain operations depends on more than technical safeguards. Employees must also be able to recognize threats, as people themselves are the weakest link in cybersecurity. For example, a single employee opening a phishing email can give an attacker access to a system.

Estonia has improved its preparedness for various crises in recent years, drawing lessons from both the pandemic and the restructuring of its energy system. The guiding principle is that preparing for a crisis cannot begin only after something has already gone wrong.

The government recommends that everyone be prepared to manage on their own for at least a week during a crisis. This includes keeping an adequate supply of food at home.

"We have defined the crisis-related responsibilities of various government agencies, businesses, constitutional institutions and other public bodies, such as ERR and local governments — in other words, the essential tasks each organization must be able to carry out under any circumstances. We've made it clear that they must be prepared to fulfill those responsibilities regardless of the situation. They shouldn't wait for instructions during a crisis but should prepare to carry out those tasks in peacetime, before a crisis occurs," said Erkki Tori, coordination director at the Government Office.

Every organization therefore has its own role during a crisis. For example, Estonia's public broadcaster is responsible for keeping people informed, while stores are expected to continue selling goods whenever possible.

"The state certainly has an obligation to help people who find themselves in difficulty, but we have to recognize that government resources are limited. The larger the crisis, the more of those resources will be devoted to resolving it — figuratively speaking, putting out the fire or helping those in the greatest need," Tori said.

The better prepared citizens are, the easier it is for the state to direct assistance where it is needed most.

--

Follow ERR News on Facebook and X and never miss an update!