Slovakian Lessons On Proactive Cybersecurity & Vuln Disclosure

The speakers, from Slovakia's national CSIRT, explain how their unit moved from reactive incident handling toward proactive services after the NIS2 directive widened its remit. They cover the legal and technical reasoning behind non-intrusive scanning of public-facing networks, and the role national law gives the team as a coordinated vulnerability disclosure intermediary while a national disclosure policy is still pending.

The core of the talk is three services built since 2021. Achilles runs semi-automated vulnerability assessment against assets that constituents register in a government system, using Nessus as the main scanner, with monthly reports and a ranking of the worst-performing organisations. Afrodita is a threat intelligence service that shares indicators through MISP and issues early warnings after analysts manually validate the data. The team illustrated its value with a distributed denial-of-service campaign that had no effect on organisations that had been warned in advance. A third service offers on-demand penetration testing, configuration benchmarking and open-source vulnerability research.

Looking ahead, the team plans a second version of Achilles, intended to be open source, with more frequent scanning, a client web portal and additional scanners to reduce dependence on one vendor. Their main lessons are that proactive services need explicit legal support, reliable asset data and automation, since manual validation does not scale. In the Q&A they explained that false-positive suppression is kept per organisation and that the scanning service is offered free to constituents.