Story image

Exclusive: How nation-state attacks impact businesses

13 Aug 18

With tensions between global superpowers rising, cyber attacks have become a new frontier for governments to gain an advantage over one another.

SecurityBrief spoke to PAS Global CEO and industrial cybersecurity veteran Eddie Habibi about nation-state attacks, the motivations behind them, and how organisations get caught in the crossfire.

How do nation-state cyber attacks affect businesses?

Nation-state cyberattacks pose a significant risk to businesses, ranging from theft of high-value intellectual property (IP) to complete shutdown of operations and irreparable damage to brand reputation.

Nowhere is this risk more prominent today than in critical infrastructure.

A cyber attack on the digital industrial control systems that enable safe operations can be manipulated to cause physical damage to a process, power, or manufacturing plant.

What form do these attacks usually take?

Nation-states have shown a great deal of interest in attacking the institutions and industries that define the strength of a nation.

That includes everything from manipulation of social attitudes about hot political topics to the disruption of electricity services by shutting down the power grid.

What are the typical motivations of a nation-state attack?

While it is difficult to speculate the exact reasons for any single nation-state attack, it is generally recognised that cyber attacks are a new, inexpensive, and stealth weapon of choice that can potentially cripple an economy and create chaos in a sustained multi-channel attack.

At this stage, I believe most nation-states are hard at work developing both offensive and defensive cyber weapons as a means of survival for the inevitable.

What can businesses do to prepare for the impact of such attacks?

Businesses must take a strategic approach to cybersecurity, especially in the critical infrastructure.

While being wary of the hype, businesses must also recognise that the Pandora’s box has been opened and there is no turning back.

A robust cybersecurity strategy, especially for operational technology (OT) assets, starts with industrial endpoint protection.

At the heart of endpoint protection is configuration security management.

Configuration security includes establishing an accurate and complete inventory of control system assets, identifying and addressing known vulnerabilities, institutionalising a strict management of change process, and securing an evergreen backup.

This is known as foundational security.

The rest of the security stack includes anomaly and threat detection, firewalls and access control, antivirus and more.

What are common misconceptions businesses usually have about these attacks?

The greatest misperceptions about cybersecurity risk associated with industrial control systems (ICS) include:

  •  my ICS is “air-gapped” (not connected to the Internet) and therefore secure;
  •  traditional IT security protection measures are adequate for protecting industrial control systems (ICSs)
  •  and most concerning is, IT alone, without the close involvement of OT experts, can solve the problem
Symantec releases neural network-integrated USB scanning station
Symantec Industrial Control System Protection Neural helps defend against USB-borne cyber attacks on operational technology.
Ramping up security with next-gen firewalls
The classic firewall lacked the ability to distinguish between different kinds of web traffic.
Gartner names LogRhythm leader in SIEM solutions
Security teams increasingly need end-to-end SIEM solutions with native options for host- and network-level monitoring.
Cylance makes APIs available in endpoint detection offering
Extensive APIs enable security teams to more efficiently view, enrich, and contextualise real-time intelligence collected at the endpoint to keep systems secure.
SolarWinds adds SDN monitoring support to network management portfolio
SolarWinds announced a broad refresh to its network management portfolio, as well as key enhancements to the Orion Platform. 
JASK prepares for global rollout of their AI-powered ASOC platform
The JASK ASOC platform automates alert investigations, supposedly freeing the SOC analyst to do what machines can’t. 
Pitfalls to avoid when configuring cloud firewalls
Flexibility and granularity of security controls is good but can still represent a risk for new cloud adopters that don’t recognise some of the configuration pitfalls.
Securing hotel technology to protect customer information
Network security risks increase exponentially as hotels look to incorporate newer technologies to support a range of IoT devices, including smart door locks.