Companies of all sizes are vulnerable to being targeted by cyber criminals. As global tensions rise, concerns about cybercrime are increasing. Businesses find themselves caught up in the effects of tensions between countries. Organizations are becoming increasingly targeted in nation-state backed attacks as governments worldwide are trying to steal secrets or lay foundations for future attacks.
Geopolitical relations between the West and China, Russia, Iran, and North Korea are currently worse than they have been for decades, and it has led to an increase in cyber-attacks on Western companies and infrastructure being attributed to these nation-states. Global tensions among the world's largest nations have risen in the past year, accelerated by Russia's invasion of Ukraine.
Nation-state attacks are becoming more common and widespread than ever before.
They often attack infrastructure, military, and businesses. These attacks are particularly prevalent in critical infrastructure industries, such as manufacturing, energy, and finance.
Organized crime groups, some of which are associated with these nation states, have also used cyber-attacks such as ransomware after realizing these kinds of criminal activities can be lower risk and have a lower cost of entry, but can result in some serious damage to critical infrastructure.
Differences between nation-state attackers and other cyber criminals
Nation-state hackers might take a different approach than ‘normal’ cyber criminals. While cyber criminals often attack for financial gain, nation-state actors often want to steal sensitive information, influence populations, and damage critical infrastructure.
Because nation-state attacks have a different motivation, they might use different tactics, techniques, and procedures than other cyber criminals. Many cyber criminals will aim to quickly get in and out of networks. Nation-state attackers often get in a network and loiter and hide for months, if not years.
What can be done
There are steps you can take to mitigate risks from nation-state cyber-attacks. In addition to cyber hygiene, organizations can consider the following to strengthen their security posture:
- Have a concrete plan for responding to a nation-state threat scenario. Instead of taking an approach of if we have an incident, plan for when we have an incident. Have a crisis communication plan that clearly outlines who will be notified, how, and when. What processes are truly necessary for business continuity and what can be taken offline. Consider your disaster recovery plan, too.
- Educate staff to be familiar with nation-state attacks, what they could look like, and the potential damage they could do. While security systems are important, employees are still the first and last line of defense. Educating employees is a crucial part of keeping an organization secure. Spread awareness of nation-state threats, and train employees to identify and report suspicious activity.
- Conduct due diligence with vendors, as they could be a vulnerability. When onboarding third-party vendors, have your security team evaluate their security posture, policies, and practices. Third parties can expose your company to new vulnerabilities, so you need to have situational awareness of what new risks may come with a new vendor.
- Isolate networks when possible and appropriate. Separate networks and systems into parts where only those who need access, have access. By having different security zones with different trust levels, you significantly reduce the risk of unauthorized access to sensitive data.
- Exchange information between organizations, including government and law enforcement agencies, to increase situational awareness, and help all parties monitor the threat landscape. To be a truly cyber mature company, participate in the network of organizations that exchange threat intel anonymously. By doing this, you not only help other organizations stop attacks faster, but your company is in a better place to prevent attacks or stop them before they do damage.
As the number of nation-state attacks continues to grow, organizations must take every step to secure their systems, thus protecting their employees and data.
Exchange threat intel to reduce operational risk
According to the Trellix & Center for Strategic and International Studies, nearly 9 in 10 (86%) organizations believe they've been the victim of a nation-state-orchestrated cyber attack. The same study showed that more than 90% of respondents said they are willing to share information on nation-state sponsored attacks, as long as they're able to hide full details of the attack and its effects. Exchanging threat intel between organizations has never been more essential to business continuity and safety.
As global tensions rise, cybercrime is becoming more of a focus point for companies doing business digitally. Businesses need to plan for attacks from criminals and nation state threats before they are targeted. It’s never been more important to have a cyber strategy, as nation-state hackers continue to wage war against countries and companies in cyberspace.
