Cyberattacks and the methods by which the public and private sectors deter and counter them have occupied the headlines with increasing frequency in today‚Äôs tech-ladened world. Often we hear of the failures of those entrusted with our personal data, the consequences of seemingly poor cybersecurity management, and the damage to reputation or ‚Äď worse still ‚Äď IT infrastructure of public bodies and private organisations alike when a cyberattack was at least partially successful.
However, it‚Äôs fair to say that having robust cybersecurity measures in place is a game of cat and mouse. This is something not likely to change, at least for the foreseeable future. The ability to avert and respond to cyberattacks has become a critical government and business concern with the global cybersecurity market estimated to be worth $96bn this year in 2018, an increase of 80% year-on-year according to Gartner.
More often than not cyber activity is the domain of criminal gangs interested in making money from their actions. However, today more than ever, state-backed players and even governments themselves have been much more active, with different objectives. Critical infrastructure ‚Äď financial institutions, power networks, healthcare providers and so on ‚Äď have all fallen victim.
Russia, Iran and North Korea, among others, have been accused of unashamedly increasing their activity with growing sophistication ‚Äď although all have and continue to deny the accusations.
Despite that denial, the increased threat led to an unprecedented step taken by the US and UK earlier this year. In April they issued a joint warning about the activities of Russia and the impact they could have on governments, businesses and even personal home networks.
The UK‚Äôs National Cyber Security Centre‚Äôs chief executive, Ciaran Martin, suggested Russia was trying to access personal routers in homes and small businesses saying this was ‚Äúa very significant moment as we hold Russia to account and we improve our cyber defences at the same time‚ÄĚ.
The statement, which was followed by the Australian government saying it had noted a rise in the number of these sort of attacks, offered technical advice on how individuals could improve their cybersecurity. A British brief read: ‚ÄúRussian state-sponsored actors are using compromised routers to conduct spoofing ‚Äėman-in-the-middle‚Äô attacks to support espionage, extract intellectual property, maintain persistent access to victim networks and potentially lay a foundation for future offensive operations.‚ÄĚ
This evolving threat from ‚Äėenemy‚Äô states and criminal organisations alike continues to occupy the thoughts of those wanting to protect IT networks and much as those that rely on them. Just days after the joint US-UK statement, NATO held its annual Locked Shields exercise, now in its eighth year. The five-day live-fire drill, led by NATO‚Äôs Communications and Information (NCI) agency and NATO‚Äôs Cooperative Cyber Defence Centre of Excellence (CCDCOE), simulated an attack on the critical infrastructure of a fictional country, Berylia.
‚ÄúBerylia experienced a deteriorating security situation, where a number of hostile events coincided with coordinated cyberattacks against a major civilian internet service provider and a military airbase,‚ÄĚ explains CCDCOE Kadri K√ľtt.
Involving as many as 4,000 virtualised systems and more than 2,500 attacks, the real-time defence exercise was designed to enable national cyber defenders to practice the protection of national IT systems and critical infrastructure under the intense pressure of a severe cyberattack. Involving more than 1,000 cybersecurity experts from 30 countries, the drill was a red versus blue scenario.
Twenty-two blue teams from CCDCOE member states and experts from NATO and the European Union (EU) made up rapid reaction teams deployed to assist in containing and countering a large-scale cyber incident and all its multiple implications. Red teams carried out the attacks intended to cause severe disruptions to the operation of the electric power grids, 4G public safety networks, military drone operations and other critical infrastructure components.
‚ÄúThis year the exercise involved critical infrastructure that our entire modern lifestyle depends upon: power supply, clean water and emergency communications,‚ÄĚ says K√ľtt. ‚ÄúThe exercise trains the teams in how to protect unfamiliar environments and to make the right decisions with incomplete information, as computer emergency specialists often have to do in real-life situations.‚ÄĚ The exercise addressed areas noted for their particular difficulty, she adds, including protecting unfamiliar specialised systems, writing good situation reports under serious time pressure, detecting and mitigating attacks in large and complex IT environments and well-coordinated teamwork
‚ÄúIn addition to maintaining complex IT systems, blue teams must be effective in reporting incidents, executing strategic decisions and solving forensic, legal and media challenges,‚ÄĚ K√ľtt continues. ‚ÄúTo stay abreast of market developments, Locked Shields focuses on realistic and cutting-edge technologies, scenarios, networks and attack methods.‚ÄĚ
As well as teams from across member states, NATO and the EU, the private sector played a key role. Among others, Threod Systems provided their drones expertise, Ericsson assisted with 4G public safety networks for law enforcement and emergency, and Siemens assisted with software. ‚ÄúThe role of private sector partners is crucial. We cooperate with industry partners that bring specialised capabilities and technologies used all over the world,‚ÄĚ says K√ľtt.
Considering the interdependencies in the cyber realm, nations have to take measures to protect their vital services, critical information infrastructure and military systems, K√ľtt explains, adding that in the real world, the military cyber domain cannot be separated from the civilian sphere.
‚ÄúIn 2018 the exercise highlighted the growing need to enhance dialogue between technical experts and decision-makers,‚ÄĚ she says. ‚ÄúCCDCOE integrated the technical and strategic game, enabling participating nations to practice the entire chain of command in the event of a severe cyber incident involving both civilian and military players.‚ÄĚ
According to K√ľtt the exercise ‚Äúhighlighted the growing need to enhance dialogue between technical experts and decision-makers‚ÄĚ.
Locked Shields 2018, the largest and most complex international live-fire cyber defence exercise in the world, was won by the NATO team with France and the Czech Republic taking second and third place, respectively. Although the exercise was a success, K√ľtt warns the job is never done.
‚ÄúThe systems running our critical infrastructure and military technologies are in constant development, we have to test and drill our resilience and defence on a regular basis,‚ÄĚ she says. ‚ÄúOur cyber defenders will never be ready, they have to keep learning and practicing cooperation with like-minded nations on a regular basis.‚ÄĚ
The cat and mouse continue to do battle. <!–