That same year, the WannaCry attack hit the UK’s National Health Service first and hardest, but within days it had spread to more than 150 countries. And when the International Committee of the Red Cross was attacked in 2022, sensitive data relating to more than half a million people around the world was exposed.
The costs associated with this global cybercrime epidemic run into the trillions, and this trend is accompanied by an increase in the rate of state-linked online attacks against civilian and humanitarian infrastructure.
The increasing scale and sophistication of these challenges means that narrow technical solutions to cybersecurity are no longer sufficient.
Only a collective response will work
Recognition of the seriousness of the situation has also driven a shift towards the idea of cyber resiliencerather than cybersecurity, whereby systems and societies are collectively able to react, adapt and recover when attacks occur.
However, while businesses and governments agree on the need for a global approach, their task is made more difficult by the growing fragmentation of the digital domain, driven by rapid technological advances and differences in political stance, regulatory approaches and organizational capacity.
Together, these factors create failures that increase the likelihood of cyber infiltration and mean that no company, government or international body has the capacity to fully manage international cyber risks alone.
Foundations in place
The foundations for the collective and cooperative work necessary for comprehensive cyber resilience are already laid and were laid at the UN.
In 2015, for example, the General Assembly approved 11 voluntary, non-binding standards for responsible state behavior in cyberspace, and reaffirmed them in 2021.
Cybercrime is a constantly evolving threat.
But to realize the potential of these standards, governments must identify what qualifies as critical infrastructure, assign responsibility to a competent agency, develop effective cyber capacity within these agencies, and create rules on incident reporting and cooperation to ensure that attacks and their spread are tracked and appropriately addressed.
Another step governments can take is to strengthen their participation in confidence-building measures, such as the UN-led directory of contact points.
This initiative establishes direct and secure communication channels about cyber incidents, including those affecting critical infrastructure, to reduce tensions, clarify misunderstandings, and promote more effective collective responses through the sharing of information and capacity.
Effective cooperation also depends on treating industry, civil society and academia as operational partners.
Initiatives such as the Cybersecurity Technology Agreement, the Paris Call, the Internet Governance Forum and the Center for Cybersecurity of the World Economic Forum already point the way forward, as do inclusive platforms such as the United Nations Cyber Stability Conference taking place this Monday and Tuesday, kicking off Geneva Cyber Week.
The coming months will also see the launch of the United Nations Global Mechanism on Information and Communications Technologies, which will provide a single permanent pathway for governments to ensure that steps towards more concrete progress remain on track, further strengthen confidence-building measures and redouble efforts to improve capacity development across the board.
Only this type of concrete, cooperative and collective effort can truly generate cyber resilience in each link of the chain and protect the vital digital infrastructure that today plays such a key role in our lives as individuals and in the future of humanity.
Robin Geiss is the Director of the United Nations Institute for Disarmament Research (JOIN). This is an edited version of a article which appeared on the UNIDIR website and the World Economic Forum website.