The cyberattacks on Albert Heijn: how do you view them as a professor of risk management?
‘We are seeing these kinds of attacks increasingly often at companies, universities, and hospitals. The cyberattack on Albert Heijn does not surprise me, although of course I could not have predicted it. Think also of the attacks on Odido, Canvas, Chipsoft, and Eindhoven University of Technology. We need to learn to deal with this, because the question is where the next hack will take place. What is happening at Albert Heijn shows what we can expect to see more often.
‘AI makes it easier for hackers to carry out cyberattacks on a large scale. That makes it even more worrying. With the help of AI, attackers can deploy thousands of agents to search for vulnerabilities in systems in a coordinated way, for example.’
What does an attack like this tell us about large companies that depend on digital systems?
‘Digital systems contain valuable information, which makes them attractive targets for hackers, for example to demand ransom, as we saw with Odido. A cyberattack can cost companies a great deal of money and disrupt their day-to-day operations. Albert Heijn is also feeling the effects. At the same time, we need to put the impact into perspective. No one has died, and people can go to other supermarkets to do their shopping.
‘The situation changes if attackers target several supermarket chains at the same time, or if the power goes out, for example. That is when single points of failure can bring an entire system to a standstill. If the internet, food supply, or electricity supply fails, there is no alternative to fall back on. The failure of essential services would be disastrous for society as a whole.’
Can companies still fully protect themselves against cyberattacks?
‘No system is 100 percent watertight. It is clear that we need to do better. At UT, we have two-factor authentication and security training. These measures take time and are not always enjoyable, but they are very important for limiting risks. People within a company are the weak link. Think of phishing. A single wrong click can sometimes give attackers access to systems.’
UT was hit by a Canvas hack last May. What can UT learn from an incident like that?
‘UT could give more thought to a plan B. For example, could we quickly put together a physical timetable if Canvas goes down again? It would also be good for UT to encourage and actively support the use of password managers. These store passwords securely and generate strong, unique passwords for each account. This reduces the risk of passwords being stolen and accounts being misused. UT could do more to promote their use.
‘Still, we should also appreciate what is going well. We often take it for granted that everything works smoothly. But systems do sometimes fail. At the same time, we need to pay more attention to this and accept that a system will not always work.’
On Tuesday evening, you will give a lecture at Studium Generale about crisis preparedness. What will you be talking about?
‘Together with Michel Dückers, Professor of Crisis, Safety and Health in Groningen, I will introduce the audience to risk-based thinking. We will discuss cyber threats and crisis management, among other things. How do we map out risks? Why do we need emergency kits? What should they contain? And do they really help us prepare, or is that going too far?
‘I will also explain what people can do themselves to reduce risks. Perhaps you have had an emergency kit at home for months, but have you actually tested your radio and tuned it to the right frequency?’
Will current issues, such as the cyberattack on Albert Heijn, also be discussed?
‘Absolutely. We will discuss current developments, including the cyberattacks on Albert Heijn, Canvas, and Odido. We have been preparing this lecture together with Studium Generale for months. The fact that these issues are so current makes the topic urgent and instructive. That is why we did not want to wait another year to give this lecture.’
Is society sufficiently prepared for a major digital crisis?
‘I think the Netherlands is not sufficiently prepared. We need to take more action and pay more attention to the subject. Everyone needs to realise how dependent we are on our infrastructure, the internet, and electricity. If any of these services fails, the consequences can be serious. We must not sit back and think, “That will never happen to me.” This is happening every day. Everyone needs to take action.’
The lecture ‘Ready for a crisis: preparedness or paranoia?’ starts at 7.30 pm on Tuesday evening in the Amphitheatre.
