Week 10

 Security in Estonia

Will be assessing security in estonia through the "Mitnick formula"

Mitnick formula:

- Technology: networks, firewalls, antiviruses...

- Training: awareness of different attacks

- Policy: set procedures and requirements

Technology

Depends on how needed is the cyber defence for certain systems, mostly counted by residual risk and how small it needs to be. If there is a need then implementations of good technology will take place.

While most citizens don't take any extra measures that are already in place by default in their devices, the ones that do are either tech nerds or corporate employees. As a company owner you want to have methods to deal with cyber attacks so that the company wouldn't lose face or profits.

Training

Awareness of social engineering or cyber attacks is about the same as most other countries, if not a bit better, since Estonia is a quite tech oriented country, as an example online voting is a possibility in politics. Giving more courage or motive for everyone to use devices and thus become more accustomed to them.

But once again, it comes down to the need of the training. As people who don't realy browse the internet or do anything outside of calling friends or family every once in a while are a lot less receptive towards attacks compared to someone who has multiple accounts and services active. Similarly in companies where employees are working with e-mails, sensitive data and other important information that should remain confidential are given some awareness training.

Policy

Policy varies from company to company, be it in devices that are sold to the public or devices that are used privately. They are made and revised by IT experts as it is their job to assess the safety and danger. But these policies have to always be updated to stay relevant in terms of having defence againts always evolving attackers.

There still are many cases where policy isn't that well made as the IT expert themselves have to stay up to date with everything to maintain good policy protocols. And so it sometimes happen that policy stays behind of what is needed and thus leaving a weakness open to attackers, being only a matter of time if it gets updated or devices get attacked.