France Establishes New Government-Focused Cyber Incident Response Unit
France created REACTIV, an ANSSI-led interministerial cyber incident response unit for state services, after the DGFiP breach exposed up to 678,000 taxpayers.
ANSSI announced REACTIV (Interministerial Response & Action against Data Breaches) on September 7, a dedicated incident response capability for French state services. It lets ANSSI require ministries to take urgent protective measures for citizens' data and lead centralized technical crisis communications during attacks on state services. The move follows the DGFiP tax authority attack that exposed data of 350,000 to 678,000 taxpayers, after which the Prime Minister ordered an extensive audit of ANSSI. Two suspects aged 16 and 18 from the ZeroBytes hacking group were arrested in late August.
- REACTIV allows ANSSI to require ministries to take immediate data-protection measures under tight deadlines
- ANSSI will lead centralized technical crisis communications for attacks threatening state services
- Follows DGFiP breach exposing sensitive data of 350,000-678,000 taxpayers
- Two suspects, aged 16 and 18, from the ZeroBytes group arrested in late August
- Staffing and budget for REACTIV undisclosed, prompting skepticism about its effectiveness
Full article266 words · extracted from infosecurity-magazine.com · click to collapse
The French national cybersecurity agency (ANSSI) will be equipped with a new cyber incident response unit dedicated to help state services.
This new mechanism, called Interministerial Response & Action against Data Breaches (Réponse & Action Interministérielle face aux Violations de données, or REACTIV), is designed to strengthen ANSSI's authority by "making it possible to immediately mobilize the skills and resources needed by the Agency alongside the ministries concerned," the Agency said in a statement dated September 7.
In practice, REACTIV grants ANSSI two new prerogatives:
- The ability for the Agency to require ministries, within tight deadlines, to take the immediate measures necessary to protect citizens' data entrusted to government administrations
- The establishment of centralized technical crisis communication led by ANSSI in the event of an attack that threatens state services
However, the human and financial resources allocated to REACTIV have not yet been disclosed, leaving some observers skeptical about whether the initiative will have the necessary teeth to deliver on its ambitions.
The announcement comes a few weeks after the Directorate-General for Public Finance (DGFiP), France’s national tax authority, was hit by a major cyber-attack that exposed sensitive and personal data of between 350,000 and 678,000 taxpayers.
The incident prompted French Prime Minister to request an “extensive audit” of ANSSI and the creation of a new incident response unit with the Agency.
Two individuals, aged 16 and 18, were arrested at the end of August on suspicion of participating in the hack as members of the “ZeroBytes” hacking group.
Image credits: Victor Velter / Agence nationale de la sécurité des systèmes d’information / Skorzewiak / Shutterstock.com
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/france-new-government-cyber/