In a world where digital threats are constantly evolving, security is no longer a luxury, it’s a necessity. And in addition to the rise in cybercrime, criminals are becoming increasingly inventive in bypassing barriers and stealing data. Recent research by the Global Anti-Scam Alliance shows that last year one in seven Dutch citizens fell victim to fraud. At a collective cost of €1.75 billion.

With the launch of CAMARA-based API security services, KPN, Odido, and Vodafone are taking an important step towards a standardized and trusted digital ecosystem, one built on collaboration and innovation to combat the growing challenge of digital fraud. 

Innovative solutions, such as ‘Number Verification’ and ‘KYC Match’, make it possible to securely, quickly and easily verify users' identities when logging in, or carrying out transactions via mobile devices. These services protect customers and help banks, e-commerce platforms and other digital service providers to combat fraud more efficiently and effectively. These services are delivered through an expanding network of partners, offering API developers and CPaaS specialists flexible options for seamless integration. 

According to Henry Calvert, Head of Networks at global mobile industry association, the GSMA: “Digital scams and fraudulent attacks are a growing problem that, if left unchecked, can cause further harm to mobile users and erode their trust in digital commerce. This is an important collaborative initiative by the Dutch telecoms industry, banks and online retailers, using the intelligence of mobile networks to help reduce cyber-crime.” 

CAMARA is an open-source, global initiative, powered by the Linux Foundation and GSMA, that standardizes telecom network APIs. Through the Open Gateway initiative, the GSMA offers a scalable and innovative platform for API developers and CPaaS providers worldwide. This enables companies to easily adopt a uniform approach to API security and functionality, both locally and internationally. 

The global GSMA Open Gateway initiative now unites more than 80 mobile operator groups, representing 292 mobile networks and over 80% of all mobile connections worldwide. Empowering digital products and services with seamless, secure access to digital services, across borders and providers. 

For more information or exploration please visit https://coin.nl/camara. 

 

Increasing complexity makes it increasingly difficult to remain resilient. Consider the impact of AI-generated threats, shifting responsibilities within organizations and the role of strategic collaboration. During NLSecure[ID], the central question is how we can make 'BV Nederland' more resilient against current and unknown, future cyber threats.

Waiting is not an option
“Although the future is uncertain, waiting is not an option,” says Chantal Vergouw, member of the Management Board at KPN Board and Chief Business Market.

“We should not only look at the latest security solutions, but also take responsibility and forge partnerships within the security community,” Vergouw adds. “Only then will we take steps to make the Netherlands safer.”

Inspirational keynotes
During NLSecure[ID] there are several inspiring keynote speeches, talks and in-depth sessions. Experts from various sectors share their knowledge and practical experiences. Practical solutions are central on the KPN Square of the event. Visitors can talk to experts and attend demonstrations on current topics such as compliance, monitoring, secure connectivity and IoT.

Click here for more information and to register

Cybercrime is one of the biggest threats to businesses, and in recent years, small and medium-sized enterprises (SMEs) have also increasingly been targeted . Despite this, many SMEs underestimate the chance of becoming a victim of cybercrime. That is why KPN is committed to further improving the cybersecurity resilience of SMEs with a number of low-threshold services. For example, by providing entrepreneurs with extra protection against unsafe websites that contain viruses, malware and ransomware.

Since the introduction of 'Extra Safe Internet', more than 70% of KPN's SME customers have activated this service, which provides them with better protection against cybercrime. The remaining 30% can also activate it free of charge. KPN is now expanding this security filter for mobile traffic with 'Extra Safe Mobile' and is also blocking websites based on a DNS and web filter in its mobile network. A fence is placed around malicious websites, as it were. Even when you use a mobile network abroad, for example. This year alone, KPN has blocked more than 200 million websites for SME customers. For example, unsafe websites that are offered via phishing, or newly registered domains and spam URLs.

More and more SME companies are taking advantage of the benefits of hybrid working, the cloud and the Internet of Things. “That is of course a very nice development, but it also requires extra protection,” says Thomas Tolsma, responsible for services to SMEs at KPN. “That is why we relieve SME entrepreneurs with easily accessible extra protection options against malware, phishing and cybercrime. With filtering of fixed and mobile data traffic and our security package with back-up facilities, end-point protection of devices and awareness training, SME entrepreneurs can easily do the maximum to protect themselves extra. In this way, we enable companies to concentrate on doing business while data and the digital environment are a lot safer.”

New package: KPN Cybersecurity for SMEs

The new cybersecurity package for SMEs offers a wide range of solutions to protect SME companies even better against both digital and physical threats. This package includes a password manager that goes further than most password managers, a backup option, workplace security that protects laptops or desktops against malware, ransomware, phishing and other cyber attacks. No matter how well protected, human behavior is one of the biggest risks, which is why awareness training is part of the package. This increases cyber awareness and SME entrepreneurs and employees learn, using phishing simulations, for example, to recognize suspicious e-mails, avoid fake websites and better protect personal data.

The 'Cybersecurity Headaches' research project provides an insight into what keeps IT managers in six different sectors awake at night. Research agency Motivaction surveyed a total of 456 IT managers from various sectors on KPN’s behalf. 

The following concerns were mentioned most often:

1. The theft of sensitive personal data 
2. The (partial) shutdown of the company 
3. Reputational damage 
4. Financial damage, e.g. due to loss of revenue 
5. The theft of sensitive company information

Overview of top 3 cybersecurity 'headaches' per sector: 

However, concerns vary from one sector to another. The main ‘headaches’ for six different sectors follow below.

Healthcare and welfare:

The healthcare and welfare sector is most concerned about digital security. Its main concerns include the theft of sensitive patient data, followed by the (partial) shutdown of the organization, reputational damage and social impact. Compared to other sectors, this sector is relatively most concerned about digital security (cybersecurity), and considers itself to be least prepared for a cyber threat. For example, the sector is less aware of the consequences of various cyber risks and of the status of digital security in the organization.

Financial services: 

The financial sector is very concerned about cybersecurity in general and about the reputational damage arising from a cyber attack in particular. However, financial organizations do seem to be well informed about cyber risks. According to almost all of this sector’s respondents, employees know what to do in the event of an attack. However, the sector relatively often feels that the investment required is too high compared to the risks. It is also of note that IT decision makers in the financial services sector are relatively well aware of the risks of cloud services and working partly or fully from home, among other things. The major challenges for this sector are the (rapid) emergence of new technologies and the presence of older systems (legacy software).

Government: 

This sector is the least concerned about cybersecurity and considers itself well prepared relatively often. The government is most concerned about the theft of sensitive personal data. Concerns about the social impact of a cyber attack and non-compliance with laws and regulations are also mentioned frequently. This sector is relatively less concerned about digital security (cybersecurity) and considers itself the most well prepared for a cyber threat compared to other sectors. In general, the sector has a good insight into cyber risks and their (potentially major) consequences for the organization. Major challenges for the sector are a lack of knowledge and qualified staff and also the presence of older systems (legacy software). 

Industry:

The main concern in this sector is the interruption to business processes, followed by the theft of business information and financial damage. Respondents' level of concern about digital security (cybersecurity) is relatively average, and how prepared they consider themselves to be is also about average compared to the other sectors. Although the industry sector believes it has a reasonably good insight into cybersecurity, it seems to be underestimating a number of risks. For example, the sector relatively often lacks an integral cybersecurity policy and respondents think that the sector is not of interest to cybercriminals, etc.

Retail:

The main concern in this sector is the financial damage from cyber attacks, followed by the interruption of business activities and the temporary unavailability of webshops and websites. The vast majority of respondents in this sector feel that they are reasonably well prepared or even well-prepared or fully prepared for a cyber threat. However, a majority did say that other things are often prioritized over cybersecurity. Respondents in this sector are also facing a number of challenges, e.g. the complexity of the IT landscape and the need to attract and retain cybersecurity knowledge.

Transport en logistiek: 

Like the retail sector, respondents in the transport and logistics sector are most concerned about financial damage, followed by a company shutdown and the theft of sensitive personal data. Compared to other sectors, respondents in this sector believe they are well prepared or even fully prepared for cyber threats. However, less than a quarter of organizations in this sector have a policy in place for reporting security incidents. Among other things, the sector is also struggling with a lack of knowledge, awareness and qualified cybersecurity employees.

Differences between medium and large organizations

The researchers also looked at the similarities and differences between medium and large organizations. Both groups are particularly concerned about the theft of sensitive personal data. After data theft, medium organizations are most concerned about reputational damage and financial damage. A particular, significant concern for large organizations is the risk of a company shutdown, followed by reputational damage.

Medium organizations say they are confronted with cyber risks less often and they underestimate them more often. They are less concerned about cyber threats and believe they are of less interest to criminals as well. By contrast, large organizations are more aware of the risks and encounter challenges - like a high workload in their IT and cybersecurity departments - more often.

Vulnerability concerning

KPN wants to use the insights obtained from this research to further strengthen its role as a security partner in the Netherlands. By gaining a better insight into the specific challenges in each sector, KPN will be able to work with the various organizations on solutions that will more effectively protect them against the increasing threat of cybercrime.

About the study

Motivaction carried out the study on behalf of KPN. A total of 456 IT managers from medium and large organizations were interviewed via an online questionnaire from August 16-26, 2024. Check kpn.com/security for more information.

Compared to a year ago, businesses are now far more likely (+34%) to encounter cybercrime in the form of malicious websites, phishing and websites that are infected with destructive or harmful software. There has been a significant increase in phishing attempts in particular, almost ten times as many per week compared to a year ago. Another salient development is the significant increase in so-called Newly Registered Domains: websites with malicious intentions. For example, fake online stores that are online for just one day. Every week, KPN prevents more than seven million attempted cybercrimes on SMEs. However, KPN is only able to protect businesses that use the KPN Extra Safe Internet function. Unfortunately, many of them have not opted for this security filter, giving millions of cybercrime attempts the potential to succeed. And that while the filter is available to customers free of charge. 

"This is very worrying," says Chantal Vergouw, member of the Board of Management of KPN and responsible for the Business Market. "It makes businesses unnecessarily vulnerable and exposes them to the risk of significant loss. It can even threaten their business continuity. We want to make the internet safer for businesses. We offer them the filter free of charge because we know just how crucial it is." The results of KPN's latest SME Cybersecurity Monitor (conducted by Motivaction) make it painfully clear why only a small group of businesses are opting for additional measures: 62% of SMEs – wrongly – believe they aren't interesting enough to be targeted by cybercrime.

Poorly prepared
Research shows that three-quarters (76%) of the SMEs surveyed have already experienced cyber threats or attacks. What is striking is that 43% of businesses admit that they are not, or just poorly, prepared for a cyber threat or attack that would make their networks, data and systems inaccessible for over 24 hours. 

One in five of poorly-prepared SMEs say they do not have the time (22%) or resources (22%) to prepare properly. They weigh up the investment necessary against the risks involved. Almost the same percentage of businesses (19%) fail to prepare sufficiently because they believe that attacks are impossible to prevent.

As an addition to this, Chantal Vergouw says: “SMEs should focus on what they are good at: doing business. Cybercrime is becoming more prevalent by the day. Fortunately, more and more simple and accessible resources are being made available to fight it. But nothing will change if businesses don’t start to take the problem seriously.”

The KPN 2023 SME Cybersecurity Monitor
KPN regularly carries out research on the resilience of the Dutch business community. Motivaction conducted the 2023 SME Cybersecurity Monitor on almost 350 SMEs (with 10-250 employees). The results obtained have been supplemented with the daily analyses that KPN generates on cybercrime that targets the business community. KPN shares these insights with customers so that they can take steps to strengthen their online security.

With ‘Extra Secure Internet’, a standard part of KPN EEN MKB, businesses are protected by the KPN network against unsafe websites that harbor viruses, malware and ransomware. KPN blocks these websites by means of a DNS and web filter in the network. A “virtual fence” is erected around malicious websites. Whereas in 2020 that happened for tens of thousands of malicious websites per day, the number had risen to more than 600,000 in 2022.

More and more companies are utilizing the benefits of hybrid working, the cloud and the Internet of Things. “A positive development,” in the view of Marieke Snoep, Chief Business Market and member of the Board of Management of KPN. “At the same time, dependence on digital technology is growing and we need to be aware that this makes us more vulnerable to cyberattacks. We help businesses by continuously detecting the quantities of malware directed at them. So I urge businesses to make security top priority and to activate ‘Extra Secure Internet’, which is available free of charge to our SME customers”.

Extra Secure Internet
KPN’s “Extra Secure Internet” ensures that businesses can use the internet more securely. In addition, KPN always advises supplementing this service with anti-virus software. This is because in addition to unsafe websites there are many ways in which cybercriminals can attack, such as via a USB stick or when the customer is connected to another network. Extra Secure Internet operates on all of our customers’ devices, and those of their employees and guests, that are connected to the fixed network (also via WiFi), such as laptops, smartphones, network equipment (printers) and smart devices such as thermostats and smart speakers. Customers can activate it simply in the MijnKPN Zakelijk environment. KPN is continuing to expand its security services in 2023 so as to give its customers the best possible protection against cyberattacks.

Several security experts and top speakers share their knowledge with the security community of the Netherlands during NLSecure[ID]. Why is this exchange of knowledge so crucial in terms of enhancing digital resilience in the Netherlands?
Lisette: "Only together can you tackle big challenges. Cybersecurity is a big challenge. We take on that challenge together, we shoulder it together, by sharing knowledge, by building communities, by making best practices available to each other and by sharing dilemmas. NLSecure[ID] certainly contributes to this. It makes me proud that so many experts are again willing to share their knowledge. Thanks to them, we work together every day to make the Netherlands more digitally secure and move forward together."

The keynote speaker at NLSecure[ID] was professor of clinical neuropsychology Margriet Sitskoorn. She talked about how the brain works and our susceptibility to cybercrime, adding, "We do things we shouldn't do, even though we know better." Is our brain actually capable of recognizing a phishing email and resisting the temptation of clicking on it?
Erno: "Looking at cybersecurity from a distance, we are really only at the start of things. In some ways, technology is far in advance of what humans can understand. So it’s logical that people sometimes make mistakes. The ultimate goal is security as a state of mind. Security that reaches the core of your organization. People-oriented, understandable and practical. You achieve this by always putting security first in everything you do in your organization. During this edition of NLSecure[ID], we spotlight four companies from different sectors. They have embraced security thinking and are sharing their knowledge with the rest of the Netherlands. Because only together can we make the Netherlands safer."

This edition focuses on four major organizations from different sectors. From the studio we switch live to the Netherlands Cancer Institute, ASML, ProRail and Rabobank. What can we as a security community learn from these organizations?
Lisette: "The Netherlands Cancer Institute is working to create an organization 'that is safer than it needs to be'. They do this because they want to do it together and they want to do it properly: it can cost lives if things go wrong. CISO Joost Boele of the Netherlands Cancer Institute talked about issues including the importance of trust for a good security program. And then Rabobank. CISO Mimoent Haddouti, named global CISO of the year in 2022, showed viewers how one of the Netherlands' largest banks operates in a dynamic environment where cyber threats are ever-increasing. The bank's mission is to instill security in the DNA of all its employees. After all, security is as strong as the weakest link in an ecosystem. Wonderful, inspiring but also practical stories that we can learn from together as a community." 

Looking at the security community, what do you think it benefits from?
Lisette: "It's time for the next step. More is needed, more is possible, so let's challenge ourselves. There are many good initiatives where knowledge is shared and action is taken, both from government and industry. How can we make this collaboration even better so that we become more effective and make more impact? Let's create a movement and join forces more closely. In my view, this goes beyond just being a community. It starts with leadership and membership, taking responsibility, setting the tone and taking action purposefully and decisively. We need to be bold, daring and creative. Let’s all get the Netherlands moving forward! From administrators to CISOs, from government to start-ups, from civil servants to hackers. If we bring everyone together and also get them to take targeted actions, we can meet the world's greatest challenges!"

Everyone has a role when it comes to security. What tips do you have for the security community?
Erno: "There are three things I want to impart. As a security community, we develop ourselves and share knowledge with each other. That's incredibly valuable. But so do cybercriminals. Look at malware, for example. We protect ourselves all the time and we continue to develop and optimize our protection capabilities as well. Those same protection options are used by cybercriminals to find somewhere they can gain access. It’s a cat and mouse game where the key is to always stay one step ahead of cybercriminals. Secondly, it’s important that we remain on the lookout for phishing, ensuring in particular that organizations continue to train their employees and keep them aware and alert. To that end, it is also essential that all technology works optimally so that the onus is not entirely on humans. So make sure you have a good backstop. And last but not least, multi-layer security: one solution won't get you there, make sure you address your security at different levels. So that hackers who want to get to your data have to breach multiple layers of security (physical, administrative and technical, for example), making it much more difficult to gain access."

Finally, what will be important in security in 2023?
Erno: "To govern is to look ahead. This applies to security professionals as well. To protect your organization from cyberattacks today and tomorrow, you must respond continually to changes in the threat landscape. What methods of attack are on the rise? And what are the reasons for this? It’s crucial for security professionals to look into the future from time to time. These predictions paint a picture of tomorrow's digital risks. You can factor them into your security strategy right now. Responding then becomes anticipating."

Because of issues such as COVID-19, the average Dutch resident is buying a lot more online, working from home and using social media more, resulting in a sharp increase in internet traffic. But cybercriminals are also benefiting from this trend and are operating in an increasingly refined and advanced manner. Online fraud in the Netherlands is growing, with a corresponding social impact.

The Dutch telecom providers KPN, Vodafone and T-Mobile believe it is important for consumers to be able to continue making secure use of the internet. As part of the Association COIN they have joined forces to combat online fraud and cybercrime. These new mobile security services, based on the international Mobile Connect standard, arose from this partnership.

The number verification service enables banks and online shops, as well as other digital service providers, to allow users to log in and verify their details simply. For instance, it is possible to check with the relevant telecom provider, on the basis of a mobile phone number, whether a user’s details are correct. Thanks to the extra protection against account theft, it can be seen clearly if a new SIM card has recently been issued. This creates extra security, making it possible to counter SIM swap fraud effectively. In this form of fraud criminals transfer the phone number to another SIM card, generally by falsifying the user’s identity, without the user being aware.

The Mobile Connect security services meet the AVG/GDPR laws and regulations and are available in other countries too. You can get more information on the available Mobile Connect services from KPN Wholesale and on the website of Coin: https://coin.nl/mobileconnect.

“With our investment fund, we invest in promising startups and scaleups and that works both ways,” says Wouter Stammeijer, Chief Strategy & Development Officer at KPN. “On the one hand, this allows us to accelerate the development of startup ideas, products and applications. As a result, these young companies can grow and mature even faster. But we’re also strengthening our own offering to our customers. Because through cooperation and smart partnerships, we can continue to improve our product offering with even more creativity and a relatively short time-to-market.”

For example, Cequence’s API Security solution can make a major contribution to protecting the applications of KPN’s business customers. Cequence’s comprehensive analytics platform offers a full palette of solutions for discovering, categorizing, and protecting applications. In this way, organizations and users are protected against a surge in API-targeted cyber-attacks on internet, mobile, and IoT applications.

Qollabi provides a platform that allows companies to collaborate easily with, for example, franchise offices and sales partners in an action-oriented way. This offers a solution for companies seeking to professionalize, scale up, automate and, for example, to successfully execute quarterly plans together with sales partners. Qollabi’s software gives KPN the opportunity to significantly strengthen and further digitalize its collaboration with sales partners in the SME segment.

About KPN Ventures
KPN Ventures has been active since 2015 and in that time has invested in 23 innovative technology companies and made 11 investments in funds oriented mainly toward European technology startups and scaleups. KPN Ventures succeeds in building long-lasting partnerships that benefit KPN and that have accelerated the innovation and growth of its portfolio companies.

SASE KPN (Secure Access Service Edge) responds to the current need of many organizations: tight, tailored security of all data and applications regardless of where the individual users, data, applications or devices are located. The security solutions are fully integrated in the core of the KPN network – the heart of the network infrastructure – and comprise several WAN Edge Services and Security Service Edge solutions. Unlike traditional security, with SASE KPN company information is fully end-to-end, from application to server, continuously monitored and protected. Not only is that more secure but the network traffic also follows the most efficient route. This results in lower latency and greater reliability.

Modern security
“With SASE KPN we enable companies and authorities to reduce their security risks, we facilitate secure working in a variety of cloud environments (multicloud) and we also simplify the administration”, says Jilles Limburg, EVP Enterprise Market at KPN. Applications and data are generally to be found in many different places in datacenters or in the cloud. Employees want to be able to work anywhere, anytime on devices of their own. And as hybrid working has become commonplace, the number of locations from which employees log in is increasing.

“This growth in mobility entails security risks too,” Limburg continues. “The traditional approach to security, focusing solely on protecting the company network, is no longer sufficient to protect all the company information. With SASE KPN we are a lot more capable of controlling and managing the access of individual users to applications and data. This reduces the risk of data loss for companies considerably, for the simple reason that we are in a unique position to use our core network to integrate these security services with our connectivity.”

Partnership between KPN and Netskope
KPN develops the security solutions within SASE KPN in partnership with Netskope, a specialist in security services that in 2022 was proclaimed by Gartner as the leader in SSE (Security Service Edge) services. Through a strategic partnership, KPN and Netskope are working to improve companies’ security.

“Hybrid working has become the new normal. More and more organizations are opting for a SASE architecture to protect their data, wherever it is located,” says Xavier Duyck, Vice President Northern and Eastern Europe and DACH at Netskope. “For businesses, SASE is the next step in the digital transformation, allowing them to achieve greater yields and efficiency. The market demand is growing and in partnership with KPN we are an even stronger network and security partner for organizations.”

Zero Trust
SASE KPN is based on the Zero Trust principle. The basic assumption behind this relatively new security principle is that no action or user can be trusted unquestioningly. So it makes no difference whether that user is already on the company network. Only if a user’s action meets a number of predefined conditions is it allowed to go ahead. This enables companies to set up their security policy very tightly, without compromising the user experience.

The SASE KPN architecture – a smart combination of security solutions and different forms of connectivity

For bigger companies, network management is crucial for continuity and security. They often have various separate networks, for production and office automation for example, or for each business unit. Changes to these types of networks often have long turnaround times. With KPN’s SD-WAN Premium, these separate networks can be managed by a single overarching department and turnaround times are speeded up considerably.

That is also what the corporate sector and local authorities want. "SD-WAN Premium is able to optimize the quality of the network traffic (the quality of the service) in a unique manner. Among other things, it enables companies to transmit data on several connections at the same time", says Jilles Limburg, EVP KPN Corporate Market. "Routing via the KPN central firewall and/or integration with other applications are possible too. That combination makes us unique in the Netherlands.”

Reliable and secure
As companies that use SD-WAN Premium have control over user groups, applications and locations and as settings can be defined in great detail, the network can be made even more secure. The use of the KPN central firewall and/or integration with SASE KPN are possible too. Additionally, SD-WAN Premium complies with all the European privacy directives, so companies can be fully compliant and secure.

Partnership KPN and VMware
KPN developed the service in conjunction with VMware, a specialist in the provision of cloud services. KPN and VMware have been working for years in a strategic partnership to support customers’ digital transformation and accelerate their transition to the cloud or multicloud. Previously, this partnership comprised mainly the provision of private cloud service and KPN’s secure Cloud NL. SD-WAN Premium adds connectivity as well.

Remote working and learning have increased in recent years. COVID-19 caused a further huge rise in the use of digital teaching tools. This growth in hybrid education is essential so as to enable students to realize their social potential.

Increasing digitalization is also causing educational institutions to become treasure troves of personally and socially relevant information. Students and educational institutions have therefore become lucrative targets for hackers. Educational institutions are constantly at risk of having data – including personal data of students and employees – stolen and misused. Last summer, Kantar investigated the enormous rise in the number of cyberattacks at Dutch educational institutions. Hacking enables criminals to completely shut down educational institutions, resulting in huge social and financial risks to schools and their administrators as well as having potentially damaging effects on their students. Security threats are becoming ever more complex and damaging, and cybercrime is occurring increasingly often.[1]

Specific cybersecurity solution for the education sector
To tackle this risk, KPN and Breens Network have joined forces to develop – in conjunction with the education sector – a cybersecurity that meets the needs of educational institutions. This is based on standard building blocks that are already in use in the education sector and at KPN. It will enable educational institutions to enhance their resilience, step by step and with the help of these specific building blocks. By offering an “Education ICT Security Assessment” in combination with an extensive “Detection and Solution software module” (XDR), KPN and Breens Network are helping educational institutions to understand the vulnerabilities of their IT systems. This cybersecurity solution also enables educational institutions to make proper reports to the Ministry of Education, Culture and Science and to other stakeholders.

Thanks to this solution of KPN and Breens Network, educational institutions will be able to take the measures required by the Lower House of Parliament and the Ministry of Education, Culture and Science in the domain of cybersecurity. It enables educational institutions to give online (hybrid) teaching in a way that is secure for students and employees.

About Breens Network
Breens Network is an innovator in Dutch education whose ambition is to make a substantial contribution to the digital transformation of learning. We do this by supporting educational institutions in the field of digitalization and making innovations in that area. Breens Network operates in secondary education and senior secondary and higher vocational education and training in the Netherlands, based on three themes: digital working and learning environment, Cloud & Cybersecurity and Business Intelligence data apps. In the domain of cybersecurity Breens Network has a strategic partnership with QS Solutions in areas such as carrying out cybersecurity assessments and interventions for, and in conjunction with, the education sector. 

 [1] See for example “Binnen zonder Kloppen”, Education Inspectorate September 2021, and the recent debate in the Lower House of Parliament about digitalization in education on December 1, 2021.

Elastic Interconnect has been developed by KPN together with NL-ix, one of the world’s largest internet exchanges and part of KPN. The new solution gives organizations direct control over their internet traffic through a direct, fast, and secure connection. This allows them to shield specific traffic from the public internet. In this way, this solution offers extra security. Organizations are also assured of good performance and receive very high reliability guarantees so that their data and applications are and remain accessible. In addition, the service offers real-time and historical insight into the traffic, so that any problems can be traced and resolved more quickly.

“The enormous acceleration that we are seeing in digitalization is making connections to applications that run on different locations and networks increasingly important for large corporate organizations. It is also crucial that these connections are optimally controlled and secure. By adding Elastic Interconnect to our Secure Networking portfolio, we are able to allow organizations to use data and applications in an extra-secure and controlled way,” said Jilles Limburg, KPN’s director of Large Corporate.

“With Elastic Interconnect we’re unlocking 2400 public networks for KPN’s corporate customers. The traditional internet has no ownership and offers no certainty in terms of performance or security. With Elastic Interconnect it does”, says Jan Hoogenboom, director of NL-ix. “This gives organizations insight and control over the traffic flows, even if they run outside their own datacenter or cloud environment.”

Secure Networking
Secure Networking is the integrated proposition of connectivity, network, and security services for KPN’s large corporate customers. It ensures optimal application performance, is flexible, and has a high degree of reliability and security.

Elastic Interconnect
Elastic Interconnect is an integral part of KPN’s Secure Networking service and was developed in cooperation with KPN subsidiary NL-ix. It offers grip and control over the traffic flows to and from public networks and the internet from an intuitive interface. This enables organizations to divide the internet into self-defined ‘slices’. A private slice to their own cloud environments (e.g. Azure or AWS), a trusted slice for traffic from and to trusted parties (e.g. SaaS suppliers) that is shielded from the public internet and a public slice for all other internet traffic.

This emerges from the Digital Transformation Monitor, an annual survey carried out by KPN among managers that are responsible for digital transformation at their company. In the run-up to the event The Digital Dutch on April 21, KPN is identifying the main drivers, barriers and challenges associated with digital transformation. Security is included this year for the first time.

Security is a headache
In the field of security, the safety of customer and business data is a cause for concern. Half of those questioned are kept up at night by the idea that unauthorized people could gain access to that data. Knowledge – in the broadest sense of the word – is the principal bottleneck in this. In particular, keeping the security up to date is a major challenge. Almost all companies have concerns relating to IT security. Only 7 percent say they have no concerns in that area.

It also emerges from the survey that smaller companies feel that they have little to offer a cybercriminal. 59 percent of companies with 5 to 50 employees consider that they are not an interesting target for hackers. For the upper end of the SMEs the percentage is 53. “A misconception,” in the view of Marieke Snoep, Chief Business Market and member of the Board of Management of KPN. “Cybercriminals certainly don’t skip SMEs.”

Don’t neglect security
However, in recent years it has dawned on SMEs that security should definitely not be neglected. Virtually all companies have taken measures to protect their computers, networks and data. Only 3 percent have taken absolutely no action.

The measures taken vary enormously from one company to another but they still need to be improved. The most common measure (41 percent) is that employees have to change their password regularly. 38 percent say they always keep their software up to date. The third important measure is training employees to recognize fake e-mails and phishing (only 37 percent).

Effect of pandemic
The respondents consider COVID-19 an important driver for digital transformation. Last year, 32 percent said that circumstances had forced them to start their digital transformation and the effect of the pandemic is still clearly visible this year too. 28 percent mentioned it as an important driver.

Snoep says that digitalization has speeded up since the beginning of the pandemic. She praises the resilience of the business world in the Netherlands. “People are now collaborating more. They have more digital contact and a huge number of changes are taking place. Companies that had their digital affairs in order have come through the COVID-19 crisis better than those that did not. Thanks to their digital capabilities they were able to be flexible, creative and resilient.”

High on the agenda
Digital transformation is high on the agenda, certainly among larger companies. Priority is being given to the use of new technology to set up the production process differently, to offer more service or even to revamp the entire business model. Many companies realize that their continuity benefits from giving a “digital first” experience to their customers, business partners and employees.

Unfortunately, such good intentions are not always put into practice quickly enough. Finding sufficient people with the required knowledge and skill is a challenge for a growing number of companies. Many companies say they find it increasingly difficult to keep up with the pace of developments. They want to but they are unable to. Only 4 in 10 companies say they have no trouble with this.

The Digital Dutch
The Digital Transformation Monitor was carried out by Blauw Research on behalf of KPN. Last February, roughly 650 people working at companies with more than five employees gave their opinions. All the participants were wholly or partially responsible for taking decisions or giving advice on digital transformation. The questions about IT security were answered only by those who had insight into “technology and process”.

On April 21, The Digital Dutch event will take place for the seventh time. Just like last year, it will be completely online. During the event, Marieke Snoep and Jim Stolze take entrepreneurs in the Netherlands behind the scenes of “the network of the Netherlands” and reflect, together with customers, partners and experts, on the opportunities that digitalization offers the country.

The importance of knowledge sharing
Cyber Security Perspectives is aimed at a broad management and IT audience. The interviews cover a wide range of security issues: from SME security and critical infrastructure to red teaming and forensic data analysis. The common thread is the collective improvement of the Netherlands’ digital resilience. All the experts have worked on the magazine at no cost. They have done so out of the conviction that knowledge sharing is a crucial tool for making the Netherlands more secure.

Around twenty security experts are interviewed in the magazine, including: 

• Irma Jepma – Director of Cybersecurity at Coöperatie VGZ
• Donny Maasland - ESET Nederland’s CTO
• Oscar Koeroo – Concern-CISO at the Ministry of Health, Welfare and Sport (VWS)
• Petra Oldengarm – Director of Cyberveilig Nederland
• Guus van Es – Cyber Risk Partner at Deloitte
• Sabyne van Mourik – Business Development Manager at Kiwa Nederland

All the experts also participated in the security event NLSecure[ID] in January. In the magazine Cyber Security Perspectives we will elaborate on the subjects that were discussed at the time. With both initiatives, KPN Security is stimulating information exchange and cooperation between Dutch security professionals.

Making the Netherlands more digitally resilient
“As a result of the geopolitical developments, the risk of digital disruptions is now greater than ever”, says Lisette Oosterbroek, Executive Vice President at KPN Security. “Cyber attacks are becoming increasingly lucrative and more sophisticated. The enemy is well-organized, and we must be too. Every company and every employee has a responsibility in this regard. We can only protect the prosperity and innovative power of the Netherlands if we work together. And that starts with knowledge sharing.”

“With this magazine, we’re promoting knowledge sharing and contributing to the Netherlands’ digital resilience,” adds Oosterbroek. “The interviewees shed light on their field from their own perspective. Often sounding a critical note, but always based on years of experience in the security world. You can apply these insights to sharpen your own security. In this way, we can build a digitally resilient Netherlands together.”

Free for everyone
KPN Security sees it as its social duty to inform organizations about the most important developments in the area of cyber security. That’s why Cyber Security Perspectives is available free of charge to everyone. You can download the magazine here.

The September edition of NLSecure[ID] will take place on 20 September this year. You can register for free via this page.

About KPN Security
KPN Security has played a crucial role in securing the critical infrastructure of Dutch organizations for decades. Every day, we help more than 1200 customers who rely on our knowledge and expertise, and on the most comprehensive security portfolio available on the market. We not only offer solid, turnkey security solutions for identity and privacy, but we also have a complete service package for managed security.

With more than 400 security professionals, we are the largest Managed Security Service Provider (MSSP) in the Netherlands and market leader in the Dutch IT security market. This also includes a state-of-the-art Security Operations Center. From our SOC, our security specialists protect and monitor the ICT infrastructure of KPN and its business customers. So that they can harness the opportunities of the digital world with confidence.

For more information, see https://www.kpn.com/zakelijk/security.html

Nowadays virtually every household has several ‘smart devices’. Wifi-connected refrigerators, smart TV’s and lighting and online health trackers have become common household products. Too often these IoT devices are not or insufficiently protected against digital threats such as cyberattacks and data leaks. This carries the risk of cybercriminals infecting these IoT devices with rogue software or intercepting network traffic.

Mandatory security measures
Manufacturers and suppliers now have the opportunity to have their IoT products tested against the ETSI EN 303 645 standard, which contains requirements and procedures for the cybersecurity of devices which can be connected to the Internet of Things. This promotes the application of built-in security measures. Thermostats, doorbells, security cameras and other IoT devices that do not meet minimum cybersecurity requirements are expected to be banned from the European market from 2024. This is the result of new EU legislation that was recently adopted. This should ensure that consumers are better protected against cybercrime via IoT consumer electronics.

Independent assessment
Suppliers and manufacturers can now rely on Kiwa and KPN Security for independent assessment and certification of IoT devices on aspects related to cybersecurity. The two parties signed a cooperation agreement for this on November 2, 2021. This allows suppliers and manufacturers to have their products independently certified at a one-stop-shop, enabling them to bring new products to market quickly.

High-quality testing facilities
Within the agreement, KPN Security checks in its high-quality test facilities whether IoT products comply with the ETSI EN 303 645 standard and are therefore sufficiently cybersafe for users. This includes looking at the encryption used, the update mechanisms, default passwords and other important protection against cyberattacks.

Independent test results
Both KPN Security's test facilities and quality system meet high quality requirements and are monitored by Kiwa as an independent testing institution. Quality, independence and impartiality are thus guaranteed. Kiwa can therefore accept the test results for issuing a product certificate. This certificate allows a manufacturer to sell the product on the European market and beyond.

Basic safety requirements
‘With a product certificate, manufacturers can demonstrate that the foundation for cybersecurity is present in their IoT consumer products,’ says Sabyne van Mourik, business development manager at Kiwa. ‘This offers good protection against cyberattacks that can for example cause data leaks. Consumers know that a product meets the basic safety requirements.’ Erno Doorenspleet, CTO at KPN Security adds: ‘IoT devices are becoming increasingly popular because they can add a lot of value to our lives by making things more sustainable, simpler or efficient. Security is an absolute precondition for this. It is crucial to build IoT products securely from scratch, so that they are safe by design. This provides a good basis for cybersafe use of these IoT devices.’

Over a 90-day period, KPN Security looked at 106 channels offering a disturbing amount of publicly accessible illegal content and activities. Content that was previously only available through the dark web was found in easily accessible groups. In addition, KPN Security also noted the rise of a new form of sextortion: dating sextortion. In this form of extortion, criminals make dates for sex with their victims, who are then filmed without their knowledge. The photos and video clips are subsequently shared on Telegram.

Accessible
According to KPN Security, one of the causes of the strong growth of such activities on Telegram is its accessible character. In addition to having one-on-one conversations, users can easily organize themselves into groups and share content there. Many of these groups have no access control. What’s more, Telegram users can easily hide their identity. Simply downloading the app and entering a telephone number is enough to set up an account, making it difficult to trace cyber criminals.

Criminal offense
In addition to concern about the app’s accessible nature, which makes it easy for cyber criminals to use the chat service, KPN Security also wants to warn against users’ prying eyes. Being exposed to the easily accessible sexual content can not only cause trauma, but it is also punishable. Telegram automatically downloads any group content onto a user’s device. As a result, the user has punishable content on their device, which can have consequences such as fines and imprisonment.

Action required
According to KPN Security, action is urgently required and it has handed over the research results to the responsible authorities at home and abroad. It also advises victims to always report any incidents. This is a serious criminal offense and the more information the police have, the more effectively they can conduct their investigations. Every report contains potentially crucial information that can ultimately lead them to the perpetrators.

About KPN Security
KPN Security has played a crucial role in securing the critical infrastructure of Dutch organizations for decades. Every day, we help more than 1200 customers who rely on our knowledge and expertise, and on the most comprehensive security portfolio available on the market. We not only offer solid, turnkey security solutions for identity and privacy, but we also have a complete service package for managed security.

With over 400 security professionals, we are the largest Managed Security Service Provider (MSSP) in the Netherlands and market leader in the Dutch IT security market. This also includes a state-of-the-art Security Operations Center. From our SOC, our security specialists protect and monitor the ICT infrastructure of KPN Security and its business customers. So that they can harness the opportunities of the digital world with confidence.

KPN Security uses ethical hackers, who are authorized to investigate security systems and networks in order to detect security leaks in systems and networks. These security vulnerabilities are reported to companies and the agencies that they work with.

Image caption: Alice & Bob can use quantum keys to communicate and send files securely using an MDI-QKD key. Credit: QuTech (Vincent de Mees, Slim Plot). This image is an outtake of an animation on this MDI-QKD project.

Presently secure communication is based on the fact that breaking cryptography is slow using conventional computers. This includes communication between datacentres, inter-governmental communication, or critical infrastructure like banking, energy and airports. Some communication lines require secrecy by law or by the user. Any attacker could be recording these messages and then decrypting them later. Unfortunately, computers are becoming faster, even more so with the impending introduction of quantum computers.

Ultimate defence against eavesdropping
Joshua Slater, team lead of the MDI-QKD project: “Important conventional cryptographic methods rely on, for example, a public and a private key. These two keys are essentially two large numbers that belong together. Their security is based on the fact that the private key is difficult and slow to calculate with knowledge of only the public key. Unfortunately, with the introduction of very powerful computers (such as quantum computers), calculating the private key becomes trivially easy and then encryption can become insecure”

Image caption: Because of the quantum key distribution (QKD) used by Alice & her bank, a hacker cannot eavesdrop on them. Also, the central node doesn't have to be trusted for Alice & her bank to communicate securely. Credit: QuTech (Vincent de Mees, Slim Plot). This image is an outtake of an animation on this MDI-QKD project.

A solution to eavesdropping—now and in the future—is the use of quantum key distribution (QKD). In quantum communication, eavesdropping on a message disturbs transmission of the quantum key. Slater: “If the quantum signals are disturbed, the users know not to use the generated key for their secure communication line. Once the quantum key is successfully shared with the intended recipient, the rest of the secure communication benefits from ‘forward secrecy’: the assurance that the key distribution cannot be cracked now or in the future.”

“Unfortunately, current commercially available QKD systems are difficult to scale in a network,” Slater explained. “To solve all these problems, we’ve built a measurement-device independent (MDI) QKD system, in which multiple users can be connected via a central node that operates like a typical telephone switch board operator. Importantly, the central node does not need to be trusted. The entire system is designed such that hacking attacks against the central node cannot break the security of the protocol.”

Scalable quantum networks
Slater: “A major advantage of our system over other QKD systems is its scaling to many users. Our MDI-QKD can be used in a star-type physical network. Researchers at QuTech have already previously performed the first proof-of-principle demonstration of MDI-QKD, the first demonstration over deployed fibres, and the first demonstration using cost-effective, off-the-shelf hardware.”

Image caption: Because of the measurement-device independent (MDI) system the whole network is rather easy to scale up to many users. Credit: QuTech (Vincent de Mees, Slim Plot). This image is an outtake of an animation on this MDI-QKD project.

“A significant achievement that we’re demonstrating here for the first time, is that our quantum signals are transmitted over the same fibre as conventional internet traffic,” said Slater. “Using standard equipment that Cisco supplied and configured with us, we established two multiplexed internet networks between the locations over the same optical fibres. The existence of these two networks do not impact the performance of our quantum system. Essentially, we’ve shown how our systems can coexist, in parallel”

“This is an important development in guaranteeing the security of internet traffic in the future,” said Babak Fouladi, Chief Digital and Technology Officer and member of the Executive Board at KPN. “I am pleased that we can contribute towards making this insight practical using the network of the Netherlands. Solutions like MDI-QKD should not only protect users today, but also make communication as future-proof as possible.”

English version, click here

Demonstration in Delft–Rijswijk–The Hague
The current system consists of three standard telco racks, each in a different city in the Netherlands. The first 'user' connected to the demo setup is code-named Alice and resides in Delft. The second user, called Bob, sits in a KPN building in The Hague. The central node, Charlie, is located in between. Every user is connected to the centre node by a standard optical fibre. Furthermore, the users and the central node are able to communicate over the normal internet, either directly via the (same) optical fibre, or indirectly via any internet connection.

Image caption: Alice is a standard telco rack located at the Delft University of Technology (the Netherlands),
the central node in a neighbouring city Rijswijk, and Bob is at KPN in The Hague. Credit: QuTech (Vincent de Mees, Slim Plot). This image is an outtake of an animation on this MDI-QKD project.

Finally, the MDI-QKD deployment represents an important step towards a future quantum internet. The network is designed to be upgradable in the future: users like Alice and Bob can upgrade their functionality (with e.g. quantum processors, quantum repeaters, quantum entanglement, quantum memory, quantum computers, whatever), while the central node and the rest of the network remains the same. The network is future-proof and ready to be upgraded for the quantum future.

“This is a great milestone, and an important foundation for the deployment of a national quantum network infrastructure in the Netherlands. That is one of the main goals of the Netherlands’ National Agenda Quantum Technology, which is being executed by Quantum Delta NL,” said Jesse Robbers, director of Quantum Delta NL—which received €615 million from the Dutch government in April of this year.

The form that this “key” takes depends on the assurance level at which the service is accessed. Until recently, EH1 was the lowest level. At this level entrepreneurs could log in with just a username and password. At the highest level (EH4) a certificate is also required that is issued after the user’s identity has been checked physically. The higher the assurance level, the more certainty the service provider gets about the user’s online identity.

EH2 is no longer sufficient
The recognized suppliers of eHerkenning – including KPN – and the Ministry of Internal Affairs are among those that decided earlier to stop using EH1. The application procedure and logging in with just a username and password offered inadequate certainty about the user’s identity. The risk of identity fraud was therefore ever-present.

Because of the security risks, KPN will also stop selling EH2 with effect from August 1, 2021. At this level too, the user’s identity is not checked physically, and the entrepreneur logs in with just a username and a (strong) password.

MFA will be the norm
By offering login means for only EH2+, EH3 and EH4 KPN is making MFA the norm. From level EH2+ onwards, entrepreneurs have to log in with something they know (a password) and something they have, such as an SMS verification code or a digital certificate. That makes it significantly harder to commit fraud. A criminal would have to get hold of the SMS verification code, for example.

Furthermore, from level EH3 onwards, the user’s identity is checked on the basis of an original identity document. This gives greater certainty about the identity of a person who logs in online.

EH2 login means still available
Customers who purchase new eHerkenning login means from KPN after August 1 are automatically enabled to log in using MFA. Nothing changes for KPN customers who already have EH2 login means. They can continue using EH2. However, we recommend that they switch to a higher level, preferably EH3.

After August 1 it will also still be possible to use 2+ login means or higher to log into an online service with EH2 as assurance level. This is not the case for EH1, which is being discontinued entirely. EH1 login means will no longer be usable.

The fact that unauthorized persons can watch schools, companies, and living rooms via an unsecured IP camera is nothing new. However, researchers at KPN Security also managed to eavesdrop on users via a poorly configured camera. That is a painful observation, especially now that we are working from home en masse and are conducting business conversations from the study or living room.

The researchers used the ‘IoT search engine’ Shodan to detect unsecured IP cameras. It has an extensive database of devices connected to the internet. Using a very specific search, the researchers quickly traced hundreds of Dutch IP, web, and network cameras that have an unsecure internet connection.

Extensive use of unsecured cameras
The Security Research Team found, among other things, images showing how children walk through their school entrance and are received by the teachers. “The images provided us with sufficient leads to find out which school it concerned, so that we could warn the educational institution,” says Siep van der Waal, researcher at KPN Security. “The school in question took extra security measures the same day.”

The researchers were also able to observe different living rooms, and in some cases even eavesdrop on homeworkers. Van der Waal: “The fact that we could also pick up audio shows what the consequences can be if you don’t know exactly what is connected to your home network. Certainly now that many more people are working from home due to corona and are meeting and consulting at home, business secrets are there for the taking.”

But even in business environments things do not always go well, and unsecured cameras can be connected to the internet. “Some streams we encountered had audio, said Van der Waal. “Based on the streams, we were able to track down a number of organizations and inform them, so that they could take measures.”

A strong password is crucial
“We hope that this research will contribute to awareness in the field of security,” concludes Van der Waal. “It is not bad to use an IP camera per se, but you have to do it in a secure and responsible manner. Ask yourself, for example, whether it is really necessary to switch on the audio, and whether this connection to the internet adds anything. And, has a good and secure password been set? You can easily prevent major problems with a strong password.”

16 perspectives
The magazine is a reflection of the Dutch security community, with well-known security experts from the business sector and government. In addition to Ronald Prins, Inge Wetzer, and Erno Doorenspleet, among others NSCS director Hans de Vries, Floor Jansen of the Netherlands Police, and security expert Brenno de Winter give their views on various aspects of cyber security. For KPN Security, Cyber Security Perspectives fits within a broader strategy to facilitate knowledge sharing between IT and security professionals. In this context, KPN’s security branch also organizes NLSecure[ID], the annual event for the Dutch security community.

Working together against cyber crime
“We can only stand up against cyber criminality if we act together,” says Marcel van Oirschot, Executive Vice President at KPN Security. “For example, by exchanging information about incidents and the threat landscape with each other, and, of course, the best practices for robust security.” “In this magazine, the experts provide solutions to this complex problem,” continues Van Oirschot. “We hope that security professionals can apply the insights within their own organization. This is how we make the Netherlands safer together.”

Cyber Security Perspectives appears in print and online and is free to download here.

“SOC X is a serious international competition,” says Paul Slootmaker, Chief Information Security Officer (CISO) at KPN. “Our second-place finish shows that we are among the very best in the security world. I’m extremely proud of our team and it’s good news for KPN and its customers as well, of course.”

The competition started on Thursday, March 4 at 16.00 and went on till midnight. During that period, the teams had access to a compromised network of SOC X and had digital forensic and incident tools at their disposal to get the job done.

After eight hours hard work the KPN team, comprising Rob Kuiters (captain), Arnim Eijkhoudt, Laurens van Dijk, Sebastiaan Groot and Cristian Mikehazi, earned 7360 points. The top team was that of Blackberry with 7710 points, with the Airbus team in third place with 7190 points.

The remaining top ten teams were Bell Canada, Bechtel, Yandex LLC, Hacknowledge, Nexthink, USAF 92nd CyberOperations Squadron and Texas Instruments SOC.

Through the partnership with Buckaroo, consumers can use PiM to register with suppliers such as online stores and online services and then to identify themselves. This makes it possible to log into a variety of websites by using the app. So users do not have to remember several passwords and can store their data securely. Moreover, thanks to PiM the consumer has total control over what data is shared with what service.

PiM can be used online as a method of physical identification (e.g. for access & log-in and for savings programs) as well as in the online payment process for digitally signing documents. The identification app also ensures that web services always have the right customer data and reduces the risk of fraud by preventing the use of unsafe or frequently used passwords for logging in. PiM has been developed for Android and iOS.

A secure strongbox
“You can regard PiM as a secure digital strongbox”, says Kim Stolk of PiM. “On first use, the user creates a personal account with basic data. Initially, the standard details required are username, e-mail address and telephone number. Extra data such as bank account number and address can be easily added later.”

Partnering with Buckaroo
“We have confidence in the functionalities of PiM and can see the benefits of the identification app for online stores that combine identification with payments,” says Jeroen Jungerius of Buckaroo. “For instance, age verification when buying wine online or personal verification when taking out a subscription. In short, PiM is an excellent solution for identification during the payment process.”

“Thanks to the partnership with Buckaroo, we can enable our users to register for their favorite online platforms in a tried and trusted manner,” says Kim Stolk of PiM. “Over the last 15 years, Buckaroo has demonstrated its credentials as a reliable payment service provider in Benelux. We at PiM share the same mission as Buckaroo: to make secure internet solutions available in the Netherlands. So I am more than proud of the fact that we are partnering with them.”

How does PiM work?
The PiM app works with a telephone number or a QR code. The consumer downloads the app, enters his details and can then get started. The design of the app ensures that the personal data is validated and encrypted before being stored. That way, the company knows that the consumer is who he says he is. The app works with tamper-proof QR codes, so the consumer knows that the transaction is being done with the right company. In these times when fake internet companies are becoming increasingly common, PiM offers a solution for private and business markets alike.

About PiM:
PiM is an identification platform that is powered by KPN, with the aim of contributing to a secure network environment. PiM makes it possible for the Netherlands to become password-free, the keywords being security and user friendliness. This makes it easy for consumers to log in, fill in forms, register and identify themselves with a single simple QR code scan. The technology behind the identification software enables PiM to be used in a variety of ways. More info on: https://pim.app/zakelijk/

About Buckaroo:
In a turbulent world, shopping behavior is changing ever more rapidly. Businesses that embrace change are flourishing. We believe that every business is unique. That requires a personal payment solution. In this changing world we are developing – in partnership – payment strategies that accelerate growth. A distinguishing feature of Buckaroo is the complete payment service it offers, from smart checkout for e-commerce payments to comprehensive custom solutions for debt collection, subscription services, marketplace split payments and credit management. More info on: https://www.buckaroo.nl/oplossingen/betaalmethoden/pim

Contact PiM: Gerd De Smyter, Mediarelaties KPN
gerd.desmyter@kpn.com
+31 (0)6 48226572

Contact Buckaroo: Lars Smit, Head of Marketing
l.smit@buckaroo.nl
+31 (0)6 58816954

The world has changed enormously since March last year, what impact has COVID-19 had on cybercrime?
“Cybercrime is a structural game of cat and mouse and 2020 was an extremely interesting year for criminals. COVID-19 forced society to speed up the push for digitalization. It became even clearer to everyone that we all rely on digital connections 24/7 – from the local baker to large organizations. Cybercriminals have known this for a long time and were able last year to make optimum use of the situation. Their strategy is to use means such as phishing e-mails to mislead as many people as possible about a major topic of current interest. The Euro 2020 Football Championships and the Olympic Games are among such topics. They didn’t go ahead, but instead there was an even more important topic that criminals could use: COVID-19. In combination with the exponential growth in the numbers of people who were active online, a huge attack surface was created. And that is precisely what cybercriminals are looking for. The bigger the attack surface, the greater the chances of success. That is an essential part of their earnings model. A cybercriminal is never out of work!”

Where in particular did companies go wrong?
“One reason was that in no time at all masses of people started working in the cloud. That shift couldn’t be controlled because suddenly almost everybody had to work from home. Many companies had to arrange this very quickly, so makeshift solutions were sometimes chosen. That’s very worrying. Now is the time for companies to organize their infrastructure and security more structurally and more professionally. They have to set up the basics properly, otherwise they are asking for trouble. Most security incidents occur simply because the basics were not right.”

“Now is the time for companies to organize their infrastructure and security more structurally and more professionally.”

Marcel van Oirschot, directeur KPN Security

What do you understand by security basics?
“There are three pillars: people, process and technology. People means awareness and behavior. Knowing what it is you’re clicking on. Should you send things via a secure e-mail program or an app? For example, family doctors could mutually agree to e-mail patient data only via a secure platform such as KPN Zorg Messenger. But if that is not strictly enforced, it is hard in practice to resist the ease and speed of an app. Process relates principally to a clear policy for matters such as passwords, back-ups and patch management. And that leads us naturally to the third pillar, technology. After all, a process works only if you have the right technology available.”

You hear very little about incidents even though we know that many occur. Why is that?
“People think that it’s quiet at the moment in the world of cybercrime. The opposite is true. It’s just that it isn’t publicized. Companies are apparently ashamed to be a victim of cybercrime. I understand that it isn’t nice when it happens to you, but you don’t have to be ashamed. Absolutely everyone is a potential victim. That’s why I would like a lot more to be made public, such as the hack at the University of Maastricht. We can all learn from it; each time it’s a wake-up call for a few organizations to get their security basics in order.”

Awareness is an especially important issue. What is KPN’s role in it?
“Making people and businesses aware of the urgency of security cannot happen overnight. Entrepreneurs already have a lot on their mind, so we are engaging with them – and not just about security. The continuity of their business is at stake here. We put ourselves in their shoes and think about how and with what means we can keep their business running. We do that as a reliable partner, a large and stable Dutch company to which businesses can entrust their data with confidence. Awareness will also be a recurring theme in the next three days at NLSecure[ID]. As a security community we have a common goal: to make the Netherlands more secure. Knowledge sharing is crucial in enhancing digital resilience. It all begins with awareness.”

“Entrepreneurs already have a lot on their mind, so we are engaging with them – and not just about security. The continuity of their business is at stake here. We put ourselves in their shoes and think about how and with what means we can keep their business running.”

Marcel van Oirschot, directeur KPN Security

Finally, do you have something to give the reader food for thought?
“Definitely. I didn’t devise it myself but it’s so very true: There is no excuse for not getting your security basics in order. Private and commercial. You can no longer get away with saying you didn’t know security is important. The subject has been in the press often enough. So, always be aware of your vulnerability and the impact if things go wrong. Prevention is better than cure.”

The needs and expectations of customers in this ever more digital society are constantly increasing, including in the field of security and privacy. Many people are working from home, and people’s private life is being played out increasingly digitally.

As internet security is one of KPN’s focal points, in the first quarter of 2020 KPN became the first major telecom provider to introduce DNSSEC, which checks whether a visited internet webpage is the right one. The introduction of the malware filter is a complement to this.

“Nowadays we are spending more time online at home, with an increasing number of devices,” says Jean Pascal van Overbeke, Consumer Market Chief and member of the Board of Management. “That requires an excellent and secure internet connection. KPN is building the best fiber network for that purpose, with integrity and security playing an important role. The introduction of the malware filter is an integral part of that development. With KPN you are secure online without any hassle.”

Malicious parties
KPN’s malware filter is a service that protects customers online against untrustworthy websites, thereby preventing them from falling victim to malicious parties that spread malware and/or undertake phishing expeditions. Malware includes computer viruses, Trojan horses, spyware and ransomware.

How does it work?
The malware filter is integrated in the network and checks automatically and anonymously whether the visited website is on a blacklist. If it is, the customer gets an error message on the screen. The customer can easily switch on the filter themselves with a single click. Subsequently, the entire fixed internet connection is protected, including all the household devices connected to that KPN modem.

Safe online
With KPN you are secure online without any hassle. KPN ensures that every connected household has a secure and protected internet connection. KPN makes internet secure by:

• Providing KPN Veilig free of charge for up to five devices (including antivirus service, privacy for your apps and parental supervision)
• The option to secure an addition ten devices with KPN Veilig
• DNSSEC
• E-mail spam filter
• Malware and phishing filter.

KPN is offering the malware filter straight away, free of charge to more than two thirds of its customers with home internet. For the remaining customers it will be available at the beginning of 2021. The malware filter will subsequently be made available also to customers with a mobile subscription.

For further information: https://www.kpn.com/service/internet/veilig-internetten/malwarefilter.htm

Well-controlled access to information is crucial. Only the right people should have access to the right systems, applications and data. If this process is not set up properly, it can have serious consequences. For example, the privacy of customers, partners and employees, and thus compliance with laws and regulations can be threatened. Failing IAM processes can also harm productivity. It is a nuisance for employees, for example, if they have to constantly log in, or are wrongfully denied access to data.

However, managing identities and keeping access rights in order is a complex matter. A new employee must have access to the right IT systems from day 1, but in a secure manner. If a person’s role changes, due to, for example, a change in job, then the associated rights must also be adjusted. When leaving employment, access rights must be withdrawn immediately. This is a complex and knowledge-intensive process that is often included in general IT management, resulting in high costs and efforts.

The advantages of Managed IAM
With Managed IAM, KPN Security offers total peace of mind in the area of identity and access management. This managed service features all the standard building blocks, knowledge and expertise that an organization needs for a successful IAM project. With full control over the costs and compliance with laws and regulations at every stage of this provision.

KPN Security’s Managed provides, among others:

• A proven solution. Managed IAM makes use of award-winning software from IAM specialist One Identity. As a Platinum Partner of One Identity, KPN Security offers the possibility of connecting organization-specific applications to the platform set up by KPN Security. KPN Security helps organizations protect themselves from start to finish, makes their digital transformations run smoothly, eliminates identity challenges and reduces their vulnerability to internal and external threats.
• Optimal control. Organizations must be able to demonstrate at all times that they have the management of identities and access to systems 'in control'. The portal to our Managed IAM service provides, among other things, insight into the use and performance of the service and the required information to demonstrate compliance on the basis of legislation and regulations. Extensive reporting formats are possible.
• Simplified management. Standardized building blocks simplify management, resulting in a shorter 'time to market' and lower management costs. KPN Security also takes care of updates, continuous adjustment and the development of new functionalities. Without the expense of bringing in outside expertise, the customer always has the most up-to-date and stable solution.
• Access to expertise. From the project phase (including IAM workshops and the design of a Transition & Transformation plan) to managing implementation, customers can count on guidance from IAM specialists. Based on a road map developed with the customer, KPN Security’s consultants and specialists set up and support governance and work processes, prioritizing, prepping, and onboarding your applications. KPN service employees are available for first-, second- and third-line support.
• Flexibility. Managed IAM grows stepwise with the needs and maturity of the organization. What’s more, the functional possibilities of the IAM platform are easily applied in phases to business processes and applications.

Always in control
“Organizations run serious risks when they lack an integral IAM policy. Think of the image damage that an organization can suffer from unauthorized access to information”, says Mathijs Valk, VP Identity Operations for KPN Security. “It is not for nothing that external auditors and accountants have made IAM a part of assurance and accountants declarations. With KPN Security’s Managed IAM, organizations are always in control, without the complexity of management and always with the right focus on their core activities.”

About KPN Security
KPN Security has played a crucial role in securing the critical infrastructure of Dutch organizations for decades. Every day, we help more than 1800 customers who rely on our knowledge and skills, and the most comprehensive security portfolio that is available on the market. We not only offer solid, ready-made security solutions for Identity, we also have a full range of services for managed security.

With more than 400 security professionals, we are the largest Managed Security Service Provider (MSSP) in the Netherlands and market leader in the Dutch IT security market. This also includes a state-of-the-art Security Operations Center. We provide these SOC services to protect and monitor the ICT infrastructure of KPN and its business customers from, among others, our KPN Network Operating Center (NOC) in Hilversum. So that they can harness the opportunities of the digital world with confidence.

For more information, see https://www.kpn.com/zakelijk/security.html.

The European Cyber Security Perspectives is a joint venture of TNO, the National Cyber Security Centre (of the Ministry of Security and Justice) and a large number of companies and educational institutions, including KPN. Partners who have contributed to the 2020 report are: NCSC, TNO, Deloitte, Trend Micro, Accenture, Palo Alto Networks, PWC, IDQuantique, Xebia, NLnet LABS, AnalyzeData, Leiden University, Radboud University, VU Amsterdam, and Eindhoven University of Technology.

A huge achievement in the global hackers competition that gets stronger by the year. This time, more than 300 teams from 75 countries competed to win during the Cyberlympics, which are organized to improve the level of cybersecurity internationally.

The KPN team participated in the preliminary rounds in September. Sector C won this stage convincingly, taking the European title in the process. On Saturday, 26 October, it was the world final. For eight hours SectorC gave the maximum effort in the competition against the best hacker teams in the world. The 11 finalists had to solve various challenging technical tasks. In addition to expertise and quality, good cooperation was also essential.

KPN Security’s strong position
‘The number of digital threats is increasing rapidly’, according to Marieke Snoep, director of Business Market at KPN. ‘We are happy that we can help make the Netherlands more secure. The fact that KPN has been chosen as supplier of security products and services for three areas confirms the strong position we occupy in the market’, adds Snoep. ‘As a leading telecom and ICT-player, we have the technology and the capacity to handle all security matters for municipalities. Municipalities can come to us for all their security issues.’

GGI-Veilig
GGI-Veilig, part of the Municipal Common Infrastructure, is tasked with increasing the digital resilience of municipalities. By collectively acquiring a cohesive products and services portfolio, municipalities save on procurement costs. The procurement has already been done for them. And the costs for using these products and services are lower too. Moreover, by using a joint portfolio, municipalities can collaborate better on their digital resilience.

Jan Kees de Jager, CFO KPN and Chairman Economic Board Zuid-Holland: “We are very impressed by the world leading capabilities at TU Delft and TNO in both fundamental and applied quantum technology exploration. KPN is eager to work with QuTech on the road to a quantum-based internet.”

Stephanie Wehner, Roadmap Leader Quantum Internet and Networked Computing at QuTech, explains that the agreement is an important milestone towards building the first quantum network in the Netherlands. This network, based on quantum entanglement, will connect multiple Dutch cities in a rudimentary quantum network. “The collaboration with KPN forms an essential step in bringing quantum technology closer to our ultimate dream, namely that anyone in Europe – and ultimately the world - can themselves make use of a quantum internet,” says Wehner.

“Our cooperation on forging the initial links will hopefully lead to a more secure and innovative post quantum future since the arrival of quantum computers will ultimately render much of today's encryption unsafe. Improving online safety is a top priority for KPN and this cooperation paves the way to deliver a new, quantum-based internet,” said Jaya Baloo, CISO and Quantum Ambassador at KPN.

Several EU Member States recently signed a declaration to work together on a space-based and terrestrial infrastructure for quantum communication. Freeke Heijman, liaison to the Ministry of Economic Affairs and Climate Policy, emphasizes: “The collaboration between KPN and QuTech ensures that the Netherlands will play a significant role in this developing ecosystem.”

KPN is the leading telecom operator in The Netherlands. KPN believes in the power of connection since almost one hundred and fifty years. In 1881, KPN started to build the national public telephone network in The Netherlands and first introduced the country to the miracle of telecommunications. It was the basis for today's widespread KPN network throughout the country. Today, KPN is building the Dutch digital highway of the future, rolling out fiber to more than 1 million households in the period 2019-2021 and upgrading its mobile network to make it ready for 5G, the next generation of mobile technology.

QuTech is the advanced research center for Quantum Computing and Quantum Internet, a collaboration founded in 2014 by Delft University of Technology (TU Delft) and the Netherlands Organisation for Applied Scientific Research (TNO). In 2015, QuTech passed an important milestone towards a rudimentary multi-node quantum internet in The Netherlands: the first “loophole-free Bell test”. In a loophole-free Bell test two remote systems – in our case 1.3 kilometers apart – show correlations that defy any explanation through classical physics. QuTech also leads the European Quantum Internet Alliance in the EU Flagship on Quantum Technologies.

Continue reading
Continue reading about quantum internet and its applications in the TU Delft Quantum Internet magazine or learn more by visiting QuTech’s YouTube channel.

From left to right: Stephanie Wehner (QuTech), Jaya Baloo (KPN), Jan Kees de Jager (KPN), Paul de Krom (TNO), Paul Althuis (TU Delft), Ronald Hanson (QuTech)

Recognition and prevention

Criminals try to make money in a variety of ways from phone fraud and scams. They use all kinds of tricks through telephone contact, SMS or WhatsApp. The website voorkomsmartphonefraude.nl focuses specifically on the form of smartphone fraud in which victims are coerced into taking out subscriptions and the new smartphones are subsequently taken away from them. This provides readers with information and tips on how to recognize and prevent smartphone fraud and what to do if you have fallen victim. Some of the tips:

• Trust your instinct and be alert. If something sounds too good to be true, it's usually not a good sign.
• Never take out a subscription for someone else.
• Never sign a contract you don't agree with.
• Never take out a subscription or contract against your will or if you can't actually afford it.
• Never respond to “suspicious” advertisements that promise that you will earn a lot of money quickly.

In addition, providers are asking people to report to www.fraudehelpdesk.nl any suspicious activity such as messages about earning money quickly with your cellphone.

Measures

Prior to this new cooperation, the various providers themselves had already taken measures to prevent fraud wherever possible. For example, creditworthiness tests are carried out in the shops, various providers have special rules for the sale of subscriptions to young customers, and shop staff are trained to recognize and take action in fraud situations. The Preventel joint venture has already resulted in a joint measure, whereby an extra check is carried out if a person submits several applications in a certain period of time for a subscription with a device. With the launch of www.voorkomsmartphonefraude.nl information is now available nationwide as well.

About Preventel

The Preventel foundation is a partnership of providers of telecommunications services. The foundation has a social purpose: to prevent individuals and companies from entering into obligations for the use of telecommunication services that they are unable or unwilling to pay for.

More information

For more information, please contact Christiaan van Dissel at preventel@brabers.nl.

See also:

www.voorkomsmartphonefraude.nl

www.preventel.nl

Voorkom Smartphonefraude is a joint initiative of:

Consequently, last Saturday, as part of the National Security Day, our Chief Information Security Officer, Jaya Baloo, signed the Prevention of Cybercrime covenant, in the presence of Minister of Justice and Security Ferdinand Grapperhaus and Secretary of State for Economic Affairs and Climate Mona Keijzer. The covenant signals the launch of the public campaign against cybercrime: ‘Eerst checken, dan klikken’ (Check before clicking). This government campaign is supported by a large number of partners including the banking, ICT, internet and telecom sectors.

Click deliberately or don’t click at all

The principal message in the national campaign: Don’t click systematically on every link. Look carefully before you click, don’t get distracted, and click deliberately. Through radio, TV and social media commercials and street advertising the government aims to make everyone aware of the danger of cybercriminals. On veiliginternetten.nl you can find tips to enhance your internet security even more.

Ensure security

We feel that it is entirely logical for KPN to sign this covenant. We do everything in our power to safeguard the security of our customers. For instance, we offer consumers KPN Veilig, a package that protects PC, laptop, tablet or smartphone against viruses and malware. And giving instruction is very important in this too: we draw our customers’ attention proactively to the risks and help them wherever possible so that everyone can go online securely. We recently amalgamated all the security services for the Business Market into a single organization, making KPN Security one of the biggest IT security companies in the Netherlands.

Low percentage, high priority
Women with a top position in the tech world can still not be taken for granted. According to InspiringFifty, the percentage of women in the ICT sector in our country is very low, at just 16 per cent. The percentage of women in STEM-studies (Science, Technology, Engineering & Math) is at 18.7 per cent also lower than in other European countries. It is therefore important to stimulate and increase diversity in the industry. InspiringFifty was founded in 2013 by two women who decided to give more visibility and recognition to women in technology under the motto ‘You can’t be, what you can’t see’.

“We have in-depth understanding of security solutions and have the capacity and experience at our disposal to carry out big projects,” says Martijn Hakstege, EVP KPN Security. “By combining our strengths with many years of experience in the market we can claim to be the top specialist in IT security. Additionally, we are the market leader in the field of Digital Identity and are strong in business consultancy. We understand our customers’ business and can translate that knowledge into the right security solutions. From today, we are offering all of this under the name of KPN Security.”

KPN Security will serve the entire breadth of the corporate market, covering small and medium-sized businesses, large companies and the government. For small businesses KPN Security offers mainly off-the-shelf security services: simple, effective and affordable. Medium-sized companies that want to outsource their security can come to KPN Security for managed security services, from protection and detection to response and prevention. Security solutions for large companies and the government are offered by KPN as part of an integrated package of services.

KPN Security also has a specific division devoted to security innovation, applying advanced technologies such as artificial intelligence and machine learning. Moreover, in providing its services KPN Security makes use of the experience and knowledge gained by KPN from the security measures it employs for its own networks.

That is why KPN has created the sixth consecutive European Cyber Security Perspectives report, which is published today March 11, 2019. In collaboration with both national and international renowned organizations from the government, private sector and universities.

Partners who contributed to the 2019 report are NCSC, Europol, The Dutch National Police, Deloitte, Kaspersky Labs Benelux, Hack in the Box, Accenture, Checkpoint, AnalyzeData, PWC, TNO, ID Quantique, The Pirate Party, Leiden University, Eindhoven University of Technology, University of Illinois, Delft University of Technology, University of Amsterdam, QuSoft, and KPN.

The influence of (geo) politics within the cyber security playing field is growing. Sergei Boeke (Leiden University) explores the the topic of Cyber Warfare in his article and Matthijs Pontier (Pirate Party) writes about the potential need for a Ministry of Digital Affairs.

The DDoS attacks on large banks showed how relatively easy it is to bring down the digital services of big companies. That is why preventing such attacks is of great importance. Rien Jansen (National Police) and Jesse Helder (KPN) describe in their articles possible mitigating measures against this many-headed monster.

About the European Cyber Security Perspectives 2019
The European Cyber Security Perspectives is a partnership of the Dutch National Police, the Dutch National Cyber Security Centre and a number of companies including KPN. KPN brought the parties together and published the report. The idea is that collaboration and knowledge is essential in the field of cybersecurity. The purpose of the report is to share this knowledge with the broader public.

During this interactive afternoon, extensive attention was paid to secure passwords and children were also taught how to better protect themselves against hackers and criminals who abuse the internet. The Dutch Military Intelligence and Security Service (MIVD) was also present. Director General Onno Eichelsheim from the MIVD explained to the children what cyber spying is, what dangers there are, and he also discussed online security with them.

Children could also learn how to break open mini-locks and there was an escape room with the themes: password security, fake emails, phishing, and sharing sensitive data online. The Police and the Public Prosecution Service (OM) held a workshop too. Finally, there was a practical workshop from Hack in the Class, where children learned the basics of hacking.

See an impression of the Kids Cyber Day

Having won the preliminary rounds, the KPN team was one of the top winning teams that were invited to play the game live at the global finals in Atlanta, USA. It was a great success. After nine thrilling hours, the KPN ethical hackers’ team (Sector C) won the Global Cyberlympics 2018.

KPN last reached the finals in 2015, having to content itself with second place as the result. Following that experience, the team was extra motivated to secure the title this year.

Partners who contributed to the 2018 report are NCSC, Europol, the Dutch National Police and the Public Prosecution Office, Deloitte, Kaspersky Labs Benelux, Philips, Accenture, Checkpoint, Zimperium, PWC, ID Quantique, Bits of Freedom, Startmail.com, Eindhoven University of Technology, Radboud University, Delft University of Technology, Vrije Universiteit Amsterdam, and KPN.

The digital resilience in the Netherlands is lagging behind the ever increasing threat. This became apparent from the Cyber Security Assessment 2017 published by the NCSC also discussed in this report. We see more cyber-attacks on a geopolitical level and even data leaks with a direct impact on our democratic processes. Last year vulnerable devices were exploited to conduct largescale DDoS attacks a number of times using botnets, which resulted in major disruptions.

A review of 2017 is incomplete without insights about WannaCry. Juan Sacco, hacker at KPN writes about his Red-Teaming and ethical work with Eternal Blue, the vulnerability used for WannaCry. Juan was the first to publish a clean exploit to help others mitigate it, and he explains in this article how he together with the KPN REDteam used this knowledge to prevent KPN get infected.

With this report we also take a look at what the future might have in store for us. For example, Tanja Lange, Professor of Cryptology at Eindhoven University of Technology, writes about the future of cryptography and the impact of quantum computers. Martijn van Lom, CEO of Kaspersky Labs Benelux, paints a picture of a time where robots are CEO’s and the implications this entails for security.

About the European Cyber Security Perspectives 2018 The European Cyber Security Perspectives is a partnership of the Dutch National Police, the Dutch National Cyber Security Centre and a number of companies including KPN. KPN brought the parties together and published the report. The idea is that collaboration and cooperation is essential in the field of cybersecurity. The purpose of the report is to share this cybersecurity knowledge. The entire Cyber Security Perspectives 2017 report can be found here.

KPN is continuously growing its security services portfolio both organically and inorganically, most recently with the acquisition of DearBytes in January 2017. The acquisition of QSight IT is complementary to KPN’s current security services portfolio and further strengthens its detection and prediction capabilities. In addition, the leading public cloud expertise of the Company broadens KPN’s (public) cloud propositions. Supported by these acquisitions, KPN is able to offer a broad range of high quality (cloud) security services to all of its SME, LE and Corporate customers.

“Providing our customers with top notch security services and products is a strategic priority for KPN,” said Eelco Blok, CEO of KPN. “With the acquisition of QSight IT we add a team of highly-skilled security and Microsoft professionals, significant security detection and prediction capabilities as well as corporate and large enterprise customers. Together, we will be able to provide our customers with the full scale of products, services and consultancy necessary to ensure that they can keep their ICT networks, systems and products safe – from prevention to detection and prediction.”

The transaction is subject to regulatory approval.

Today we see old vulnerabilities show up in new technologies, and hardware and software vendors are not held to account to ensure their safety. Therefore the capability of the security industry to prevent, detect, and respond is minimal. To successfully combat cybercrime, intensive collaboration and sharing knowledge and experience is necessary, now more than ever.

The report looks back at the developments in the past year with a summary of the annual Cyber Security Assessment in the Netherlands in 2016 by the NCSC. It discusses various forms of cybercrime, including phishing. It also examines the various threats in e-mail, insider threats, targeted attacks on devices and the opportunities and threats of Internet of Things. And what is the role of humans when it comes to cyber security? After all, no matter how well you technically protect yourself, if someone clicks the wrong link, you are powerless.

In 2016 KPN was the most exploited brandname in phishing emails from criminals in The Netherlands. In the article "SafeMail @KPN‘ Michel Zoetebier, Eva Kelder and Ruud Leurs explain what steps have been taken within the company to ensure that secure e-mails can be sent and receivers recognize correct emails from KPN.

In the article "My First Golang Project?” Bouke van Laethem of KPN discusses how you can use interesting information of the attacker against the attacker. The 2017 report contains many more interesting articles, including articles on DDoS, Quantum Key Distribution (QKD) and Ransomware.

About the European Cyber Security Perspectives 2017

The European Cyber Security Perspectives is a partnership of the Dutch National Police, the Dutch National Cyber Security Centre and a number of companies including KPN. KPN brought the parties together and published the report. The idea is that collaboration and knowledge is essential in the field of cybersecurity. The purpose of the report is to share this knowledge. The entire Cyber Security Perspectives 2017 report can be found

Previous editions can be downloaded here: Edition 3, Edition 2, Edition 1

Frank van der Post, Chief Commercial Officer en lid van de Raad van Bestuur KPN: “Wij merken een zeer sterk groeiende behoefte bij onze klanten aan gedegen maar ook eenvoudig te verkrijgen security dienstverlening tegen digitale dreigingen zoals ransomware en phishing. Met DearBytes halen wij een partij met veel expertise binnen die perfect past bij ons streven de beste dienstverlener voor onze klanten te zijn.”

DearBytes bestaat sinds 2001 en is een full service provider van security-oplossingen. Met kwalitatief hoogstaande diensten beschermt DearBytes organisaties tegen malware zoals ransomware en virussen. Bescherming tegen malware vormt de hoeksteen van de cybersecuritystrategie van vrijwel elke organisatie. Het portfolio van DearBytes omvat: products & support, professional services en een security operations center van waaruit 24/7 preventie-, detectie- en responsediensten geleverd worden aan klanten.

Erik Remmelzwaal, directeur DearBytes: ”De Nederlandse markt vraagt in toenemende mate om oplossingen tegen digitale dreigingen zoals ransomware en phishing. Malware is zelfs digitale dreiging nummer één voor de Europese zakelijke markt en vormt voor bedrijven een significant risico voor continuïteit en reputatieschade. Onder de paraplu van KPN kunnen wij nog beter inspelen op wensen van onze klanten en zijn wij optimaal gepositioneerd om het internet vrijer en veiliger te maken.“

De ondernemingsraden van zowel KPN als DearBytes hebben een positief advies afgegeven voor de transactie.

Within Partnership Talking Traffic, KPN will develop in its role as ICT provider a Data Services Hub, a service to facilitate a secure and reliable exchange of information between people, machines and organizations. Partnership Talking Traffic, the first customer of the Data Services Hub of KPN, expects to be able to provide road users with new technologies for driving and traveling advisories from summer 2017. This will be accomplished by such means as real-time information exchange between road users and traffic systems.

KPN expects that the Data Services Hub service may also appeal to other parties because of increasing connectivity and the emergence of the Internet of Things. Using the Data Services Hub, public and private parties will be able to cooperate digitally in a secure and reliable way while still retaining control over their own datasets. This makes the Data Services Hub more than just a Cloud service. KPN will connect the parties and ensure the secure transmission, storage, sharing and managing of datasets. The customer is and will remain the owner of the data and will decide who has access to information, when and on which conditions.

Frank van der Post, Chief Commercial Officer of KPN, said: ‘We see a growing demand for a new way of connecting. It's not about sharing data, but about responsibly exchanging information directly in a production environment where the central considerations are the importance of privacy and intellectual property. The cooperation between KPN and the current partners stands as an example of this new digital infrastructure. Parties that worked separately for many years will now be able to combine forces, with KPN acting as a neutral, trusted and reliable connector.’

Partnership Talking Traffic The members of Partnership Talking Traffic are Vialis, Dynniq, Swarco, Sweco, KoHartog Verkeerstechniek, Royal HaskoningDHV, Ziut, BeMobile, KPN, Flitsmeister, MTVNL and Locatienet and all authorities included in the Beter Benutten (Better Utilization) network, an investment program of the Ministry of Infrastructure and the Environment.

“Improving online safety is a top priority for KPN, not only by providing secure networks and systems for customers, also by continuously innovating with the latest advancements in science and technology including quantum," said Jaya Baloo, Chief Information Security Officer at KPN. "The arrival of quantum computers will ultimately render much of today's encryption unsafe. The quantum computer is capable of solving difficult mathematical problems exponentially quicker. Problems which would now take vast amounts of time, such as factoring attacks on encryption algorithms, would get a huge speed boost. This means that companies and organizations need to start thinking about new strategies for cryptography, such as increasing encryption key length, using QKD, and also developing and implementing post quantum cryptographic algorithms.”

Quantum information cannot be copied and eavesdroppers or hackers can be detected on the quantum link where the encryption key is exchanged. Quantum key distribution in the network enables the continuous generation and sharing of truly random keys which are then used for data encryption. The increase of the security of the encryption of highly sensitive and confidential information helps customers of KPN to achieve unmatched security for the transmission of confidential and sensitive information.

Kelly Richdale, VP Quantum Safe Security at ID Quantique said: "Where conventional cryptography is based on mathematical principles, quantum cryptography is based on quantum mechanical principles. This gives the ability to protect information across the network between data centers with a provably high level of assurance into the future, even after the advent of a quantum computer."

Today quantum encryption is also on the agenda during Quantum Europe 2016, a conference on quantum technology under the Dutch EU Presidency in 2016. During this conference, Kelly Richdale of ID Quantique will be talking about quantum key distribution. During the event a Manifesto will be presented containing a comprehensive strategy for Europe to stay at the forefront of this emerging technology.