Prepare, but don’t panic, over supposed Russian cyber threat

Abundance of caution

Ken Westin, director of security strategy at Cybereason, said the risk of a Russian cyber attack right now was probably low, but that if an agency such as the DHS was aware of a threat and failed to notify people, it would face a backlash should something happen, hence the need for an abundance of caution.

Nevertheless, said Westin, the uncertainty around the intentions and capabilities of Russia’s offensive cyber teams was creating a stressful situation for all.

“Today, neither organisations nor private citizens should panic due to the DHS bulletin, but should remain vigilant, identify what assets may be targeted, establish plans for business continuity and cyber resilience, and pay attention to the news and threat intelligence if the situation escalates in the coming days,” he said.

Kev Breen, director of cyber threat research at Immersive Labs, said that given Russia’s hosting of advanced cyber criminal gangs, such as REvil, it would be a grave error to assume the state itself doesn’t have equally advanced capabilities.

“An attack of significant magnitude, including a deliberate attack on US critical infrastructure, would almost certainly have wider geopolitical consequences,” he said. “With this new bulletin, the DHS is working on the basis that to be forewarned is to be forearmed – and preparation is key.

“In this fast-paced world of constant cyber attacks and zero-day exploits, it is always better to err on the side of caution. It is better to assume you are a target and have strategic plans in place to match that of the adversaries’ capabilities. Resilience is as much about planning and exercising capabilities to ensure all potential risks are mitigated, in advance, as well as possible.”

Tom Garrubba, vice-president at Shared Assessments, said that all organisations, regardless of industry, should be operating at an increased state of alert as the geopolitical world and the cyber threat environment collide.

“Proper diligence is expected, and hopefully mandated, to ensure all cyber defensive tools and techniques are employed to protect your most precious data assets,” he said. “Continuous intelligence, monitoring, and dialogue with critical partners and suppliers should be ongoing to ensure ‘all is ready’ in the event of recovery needs or additional support is available in the event that something was to occur.”

Cybereason’s Westin added: “My concern with Russia today is that they have an arsenal of zero-day exploits at the ready, as well as initial access to some targets already. However any zero-days they may possess will be ‘spent’ on initial execution, so there is risk in Russia deploying them and exposing their capabilities.

“The US and allies also have offensive cyber capabilities, and businesses can be caught in the crossfire and be collateral damage. A key target may be not just critical infrastructure, but also our financial and healthcare systems or electricity grids to try to trigger a panic.”

New rules

While cyber warfare has been talked about for years – and many old hands in the security game agree that the West has been in a low-level cyber war with Russia for some time now – escalation of the Ukraine crisis into open conflict (a kinetic war) accompanied by cyber attacks on this scale would be a global first.

“The cyber security industry has gotten used to tossing around the idea of ‘nation-state’ adversaries, but I think we’ve yet to see cyber attacks used in concert with a fully fledged military campaign,” said Tripwire strategy vice-president Tim Erlin.

“The DHS’s warning sets that expectation that something has changed in the threat profile, and that organisations should be prepared for a change in the types of attack they see.”

Erlin added: “It is entirely valid for organisations to wonder what they are supposed to do differently when faced with this type of alert. Cyber security calls for constant defence already, and an alert like this doesn’t magically remove the obstacles that are preventing organisations from implementing solid security controls. For most companies, a DHS alert simply doesn’t create budget or add people to their staff.”

Roger Grimes, a defence evangelist at KnowBe4, said he thought it was “fairly natural” for cyber attacks to accompany kinetic battles, but that the possible targeting of entities other than government and government-linked contractors and suppliers was probably new. “Russia has changed that equation enormously over the past year,” he said. “Nation-state attacks are happening by the tens of thousands and occurring against organisations with no direct government affiliation. Everyone is apparently a fair target these days.”

Grimes theorised that the current situation marked a fundamental moment of change in the world of nation state-backed attacks and cyber war, which he suggested may be permanent, at least without some kind of Geneva Convention-style agreement to control such activity.

“Right now, it is do what you want with near impunity, with low risk,” he said. “We are in an especially dangerous and risky time because no one knows what the response will be if one side or the other goes too far.

“For example, if one side unilaterally attacks another side in cyber space, does that mean that a kinetic response is allowed or warranted? Does one side over-react? I think we will all be less stressed when the new rules of cyber warfare are figured out.”