Protect and survive: dealing with adversarial nation states

Attacks in cyber­space can have grave phys­i­cal con­se­quences, as the 2010 Stuxnet cyber attack showed. Believed to have been joint­ly car­ried out by the US and Israel, the infa­mous cyber assault crip­pled Iran’s nuclear pro­gramme after tak­ing over sys­tems and caus­ing cen­trifuges to tear them­selves apart. 

More than a decade lat­er, there has been a surge in warn­ings of a sim­i­lar attack tar­get­ing crit­i­cal infra­struc­tures such as util­i­ties and water, fol­low­ing Russia’s inva­sion of Ukraine. Alerts from offi­cials in the US and UK describe how Rus­sia is con­stant­ly scan­ning busi­ness sys­tems, look­ing for weak­ness­es through which to attack.

Grow­ing sanc­tions imposed on Rus­sia make the coun­try a sig­nif­i­cant cyber threat to the West. So far, Russ­ian cyber attacks have remained basic, con­sist­ing main­ly of basic dis­trib­uted denial of ser­vice (DDoS) – flood­ing web­sites with traf­fic to make them unus­able – although Ukraine says attempts to hit its elec­tric grid have tak­en place.

But more broad­ly, the war has height­ened gov­ern­ments’ and busi­ness­es’ aware­ness of the threat posed by all nation-state adver­saries. Aside from Rus­sia, sev­er­al oth­er major nation-state play­ers are active­ly per­pe­trat­ing attacks on the West, each with dif­fer­ing aims. 

The main hos­tile nations are Chi­na and Rus­sia, with Iran and North Korea “a close sec­ond”, says Philip Ingram, MBE, a for­mer colonel in British mil­i­tary intel­li­gence. “They use a mix of state and crim­i­nal capa­bil­i­ties, many of which are state-spon­sored.”

Some nation-state attack­ers are aim­ing for finan­cial gain through gov­ern­ment-sanc­tioned organ­ised crime. One exam­ple is the North Kore­an group Lazarus, which was recent­ly linked to a $625m (£492m) cryp­tocur­ren­cy heist. “Eco­nom­ic con­straints lim­it North Korea’s efforts to bit­coin heists and ran­somware attacks – some­thing the West is get­ting slight­ly bet­ter at thwart­ing,” says Ian Thorn­ton-Trump, CISO at threat intel­li­gence firm Cyjax.

Oth­er nations are look­ing to steal busi­ness and state secrets. Chi­na wants to gain eco­nom­ic advan­tage through intel­lec­tu­al prop­er­ty, which helps the nation “save bil­lions in devel­op­ment costs”, Ingram says. 

Chi­na has a “very capa­ble” cyber sec­tion with­in its mil­i­tary, says Jamal Elmel­las, chief oper­at­ing offi­cer at secu­ri­ty con­sul­tan­cy Focus on Secu­ri­ty. “They see cyber as an addi­tion­al weapon in their arse­nal.”

Fol­low­ing the Stuxnet attack, Iran’s cyber strat­e­gy is region­al- and defence-focused. Thorn­ton-Trump thinks the coun­try is now in watch and learn mode as events in Ukraine unfold. “They des­per­ate­ly want to have sanc­tions removed and con­duct­ing a major Iran­ian cyber cam­paign would be coun­ter­pro­duc­tive to facil­i­tat­ing those dis­cus­sions.”

Mean­while, Rus­sia is focused on diplo­mat­ic and mil­i­tary tar­gets as well as influ­enc­ing through dis­in­for­ma­tion. “This has been evi­dent in Ukraine, and after inter­fer­ence in elec­tions across the globe,” says Ingram.  

At the same time, the Russ­ian threat comes from organ­ised crime. This is not nec­es­sar­i­ly sanc­tioned by the gov­ern­ment but is “very capa­ble”, says Elmel­las.

Hos­tile nation states are a threat to all busi­ness­es, espe­cial­ly if they oper­ate in crit­i­cal sec­tors such as util­i­ties, finan­cial ser­vices or health­care. In gen­er­al, firms devel­op­ing and field­ing new tech­nol­o­gy should be on alert, Ingram says. 

Those involved in a sup­ply chain are also more like­ly to be attacked as a route into large organ­i­sa­tions such as gov­ern­ments. This hap­pened dur­ing the 2020 Solar­Winds breach, which saw Russ­ian adver­saries gain access to US gov­ern­ment depart­ments after attack­ing an IT soft­ware provider.

It’s a grow­ing risk for busi­ness­es to become part of the fall­out of a glob­al major cyber attack, even if they are not them­selves a tar­get. “The Solar­Winds attack pro­vid­ed adver­saries with inci­den­tal access to many oth­er busi­ness­es which were not them­selves tar­get­ed,” says Gem­ma Moore, direc­tor at infor­ma­tion secu­ri­ty con­sul­tan­cy Cyberis.

Oth­er attacks see­ing busi­ness­es become part of the col­lat­er­al dam­age include the 2017 Not­Petya inci­dent and Wan­naCry ran­som attacks. Per­pe­trat­ed by North Korea, Wan­naCry brought the NHS to a stand­still after hit­ting mul­ti­ple organ­i­sa­tions via out-of-date Win­dows XP sys­tems. 

Address­ing the nation-state threat requires a sol­id cyber­se­cu­ri­ty strat­e­gy. This includes hav­ing “a strong foun­da­tion” includ­ing the basics, says Ian Ush­er, deputy glob­al prac­tice lead of strate­gic threat intel­li­gence at cyber­se­cu­ri­ty con­sul­tan­cy NCC Group. “Patch­ing, access con­trols, assess­ing defen­sive mea­sures, log­ging, back­ups and inci­dent plan­ning.”

Threat intel­li­gence also plays a vital role. “It helps organ­i­sa­tions under­stand their unique place with­in the land­scape so they can tai­lor intel­li­gence col­lec­tion around the threats most rel­e­vant to them,” he says.

In addi­tion, busi­ness cul­ture is inte­gral in pro­tect­ing from the nation-state threat. Firms need to under­stand which busi­ness data is crit­i­cal and ensure it is pro­tect­ed from all risks, Ingram advis­es. 

As part of this, cyber­se­cu­ri­ty should be part of a wider busi­ness risk strat­e­gy. “The threats should be prop­er­ly under­stood so the risk can be mit­i­gat­ed in an as cost-effec­tive and busi­ness-enhanc­ing way as pos­si­ble,” says Ingram, adding that a sound cyber­se­cu­ri­ty pro­file is “a real mar­ket­ing asset”.

Invest­ing in tech­nol­o­gy is also impor­tant. Lega­cy tech­ni­cal debt will over­whelm firms who have under­in­vest­ed in IT and secu­ri­ty con­trols, says Thorn­ton-Trump. “Some nation states and cyber­crim­i­nals will no doubt exploit these oppor­tu­ni­ties as vic­tim coun­tries strug­gle to man­age the basic neces­si­ties of their cit­i­zens in an increas­ing­ly polarised polit­i­cal cli­mate.”

Over­ar­ch­ing this, gov­er­nance is key, says Elmel­las. “It is there for a rea­son: as the organ­i­sa­tion scales up, so should its secu­ri­ty capa­bil­i­ty. You need to be aware of where the bound­aries are and secure them – which is even more crit­i­cal now than ever, as the bor­ders have moved with increased home work­ing. Test your defences; you have to see secu­ri­ty as a func­tion­al resource.”

Nation-state adver­saries will con­tin­ue to respond, espe­cial­ly in light of sanc­tions such as those imposed on Rus­sia by the UK and the US. For this rea­son, it’s impor­tant to be alert – after all, the most dam­ag­ing attacks are those that go unno­ticed. 

“The most suc­cess­ful nation-state attacks are those we don’t see or know about,” Ingram warns. “Adver­saries can be qui­et­ly sit­ting in a net­work, watch­ing, lis­ten­ing and steal­ing what is want­ed, rather than per­pe­trat­ing attacks designed to cause nui­sance or harm.”