Profiling coordinated cyber incidents towards the critical infrastructure in Norway

The threat of possible cyber terrorism to critical infrastructures has brought cyber incidents to the attention of decision-makers. The National Security Authority in Norway has developed a coordination organ that detects cyber attacks towards various sectors simultaneously. Systematic profiling will improve the understanding of these attacks. Cyber incident risk profiling is based on systematic approaches for profiling traditional types of crime. The current study analyses 205 coordinated attacks detected towards Norway in 2004. Smallest Space Analysis (SSA) of 35 variables shows the co-occurrences of type of attack and country. The attack types that required more planning, such as root attacks, more commonly originated from industrialised countries, while the countries with less developed Information and Communication Technology (ICT) more often generated worms and viruses. These findings are discussed in relation to their implications, and the potential benefits of profiling coordinated cyber attacks.