Organisations changing cyber strategy in response to war in Ukraine
Some 65% of organisations have changed their cyber strategy in response to the war in Ukraine, according to new research.
Venafi has announced the findings of new research that evaluates the security impact of the increasing number of nation-state attacks and recent shifts in geopolitics.
The survey of over 1100 security decision makers (SDMs) globally found that 65% of Australian organisations have changed their cybersecurity strategy as a direct response to the conflict between Russia and Ukraine, while nearly two-thirds (69%) suspect their organisation has been either directly targeted or impacted by a nation-state cyberattack.
Other key Australian findings from the research include:
79% believe were in a perpetual state of cyberwar
87% believe geopolitics and cybersecurity are intrinsically linked
65% have had more conversations with their board and senior management in response to the Russia/Ukraine conflict
61% doubt they'd ever know if their organisation was hacked by a nation-state
60% think the threat of physical war is a greater concern in their country than cyberwar
"Cyberwar is here. It doesn't look like the way some people may have imagined that it would, but security professionals understand that any business can be damaged by nation-states," says Kevin Bocek, vice president, security strategy and threat intelligence at Venafi.
"The reality is that geopolitics and kinetic warfare now must inform cybersecurity strategy," he says.
"We've known for years that state-backed APT groups are using cybercrime to advance their nations wider political and economic goals. Everyone is a target, and unlike a kinetic warfare attack, only you can defend your business against nation-state cyberattacks. There is no cyber-Iron Dome or cyber-NORAD. Every CEO and board must recognise that cybersecurity is one of the top three business risks for everyone, regardless of industry."
Venafi research into the methods used by nation-state threat actors shows the use of machine identities is growing in state-sponsored cyberattacks. The digital certificates and cryptographic keys that serve as machine identities are the foundation of security for all secure digital transactions. Machine identities are used by everything from physical devices and to software to communicate securely.
Venafi research has also found that Chinese APT groups are conducting cyber espionage to advance China's international intelligence, while North Korean groups are funnelling the proceeds of cybercrime directly to their country's weapons programs. The SolarWinds attack which compromised thousands of companies by exploiting machine identities to create backdoors and gain trusted access to key assets is a prime example of the scale and scope of nation-state attacks that leverage compromised machine identities. Russias recent HermeticWiper attack, which breached numerous Ukrainian entities just days before Russias invasion of the country, used code signing to authenticate malware in a recent example of machine identity abuse by nation-state actors.
The only way to reduce risks of machine identity abuse is through a control plane that provides observability, governance and reliability.
"Nation-state attacks are highly sophisticated, and they often use techniques that haven't been seen before. This makes them extremely difficult to defend against if protections aren't in place before they happen," says Bocek.
"Because machine identities are regularly used as part of the kill chain in nation-state attacks, every organisation needs to step up their game. Exploiting machine identities is becoming the modus operandi for nation-state attackers."
