Connect with us

Cyber Security

Weaponised Cybercrime: What Organisations Can Learn from the Conflict in Ukraine

Published

1 year ago

on

Written by Ram Narayanan, Country Manager at Check Point Software Technologies, Middle East

On February 24th, 2022, Russia launched a full-scale military invasion of Ukraine with attacks on land, sea, and air.  What has been less visible but nonetheless a critical element of the conflict is the battle being waged in cyberspace.  Just like the military conflict with its wider consequences in terms of disruption to trade and the tragedy of the refugee crisis, the war in cyberspace has an impact beyond the borders of Ukraine and Russia. While no one can predict how long this war will last, we can say for certain that the cyber aspects of the conflict in Ukraine will continue to resonate long after the guns have been silenced, as highlighted in Check Point’s Mid-Year Security Report 2022.

So, what does the conflict teach us about cyberwarfare and how can organizations prepare themselves for this new world order?

A New Era of Cyberwarfare
One thing we can take away from what’s happening in Ukraine is that cyberwarfare has become an established component of global conflict both in the propaganda battle as well as in the actual conduct of military operations.  From Distributed Denial of Service (DDoS) attacks and website defacements to destructive critical infrastructure attacks, activity on both sides has escalated dramatically since the initial invasion in February.

Just three days into the conflict in late February, Check Point Research (CPR) noted a 196% increase in cyberattacks on Ukraine’s government and military sector. And these attacks have shown no signs of slowing down in the months since. New figures from CPR report that between February and August of this year, cyberattacks on Ukraine’s government and the military sector more than doubled, increasing by a staggering 112%, while Russia’s same sector decreased by 8%.

While Russia has not completely disconnected from the internet as per previous reports, government and military networks and websites have implemented different measures to limit access to their resources from outside of Russia, which makes the execution of some of the attacks more difficult. Indeed, Ukraine has been under constant attack – throughout the conflict, corporate networks have experienced over 1,500 cyberattacks a week on average. This is 25% higher than before the conflict, versus 1,434 weekly cyberattacks on Russian corporate networks.

Russian operations, in particular, have focused on a campaign of disruption and destruction, with government and state-sponsored APT groups conducting sophisticated operations that have ranged from critical infrastructure attacks to espionage missions. For the first time, we’ve also seen coordination between cyberattacks and kinetic military assaults. One notable example took place on March 1st when a Russian missile assault on Kyiv’s TV tower coincided with a simultaneous cyberattack designed to knock out the city’s broadcasting capabilities.

CPR also reported that the most attacked industry In Russia during the conflict was the finance sector, with an average of more than 2600 attacks per organization every week, an increase of 24% compared to before the conflict. The second most attacked industry during the conflict was Communications, with an average of 1928 weekly attacks per organization (8% decrease). This could possibly be due to a heavier focus on the finance industry having greater activity, due to global sanctions implemented on Russia by government and business organizations outside of Russia. Disrupting this sector will also severely disturb the day-to-day normal activities of its citizens, similar to attacks on the Communications sector, where the majority of services provided online such as calls or internet services would push normal activities into disarray.

CPR also reported that the most attacked industry during the conflict in Ukraine was the finance sector, with an average of 1,841 cyberattacks per organization every week, a decrease of 29% compared to the period before the conflict, followed by the government and military sector, with an average of 1,406 weekly attacks per organization, which also saw the highest increase in weekly cyberattacks with a 112% increase compared to before the conflict, which could be due to increased attacks inflicted on them by factions siding with Russia. Manufacturing was the third most heavily attacked sector, with over 400 attacks per organization every week (64% decrease).

Like Russia, the finance sector also saw major attacks, probably as an outcome of the various government and individual financial aid received, as well as cybercriminals who were looking to cash in on known donations being sent to Ukraine for the war and refugee efforts. It was not surprising to see the manufacturing sector also being heavily attacked as this is one of the key critical industries for any country to be sustained, with its global wheat exports contributing heavily to Ukraine’s economy. Such disruptions would now not only impact inflows of funds into Ukraine but negatively impact their exports.

Perhaps the defining aspect of these attacks, however, has been the strength and relative successes of Ukraine’s cyber defenses, something that highlights the importance of ongoing operational security. But continued vigilance is just one of the factors at play here. The other notable impact has come from the army of volunteers who have flocked to support Ukraine, and whose involvement might change the face of cybersecurity as we know it.

A Battleground Without Borders
The cyber battle that’s raged in Ukraine has silently swept up thousands of “volunteer troops” ranging from hacktivists to cybercriminals via technology companies like Elon Musk’s SpaceX. The digital front has also attracted the attention of high-profile collectives with the powerful Conti ransomware group publicly vowing to protect the Kremlin’s interests while Anonymous declared war on Russia itself.

One of the most interesting aspects of the cyber warfare that has raged in Eastern Europe has been Ukraine’s willingness to recruit keyboard warriors from both sides of the law to join its ranks. During the first few days of the war the Ukrainian Minister of Digital Transformation, Mykhailo Fedorov, posted on Twitter a call for “digital talents” to join the country’s newly created IT army, with operational tasks being allocated to them via a designated Telegram channel that attracted hundreds of thousands of members.

The formation of a state-affiliated cyber force is unprecedented and, while the birth of Ukraine’s IT army is an extraordinary achievement, looking forward it could prove to be problematic. Recruiting and engaging members via Telegram is far from secure. How do you vet the people that are coming forward and stop other parties from infiltrating them or using them for their own recruitment? The fact that just about anybody could be serving within Ukraine’s cyber army is a major concern. There are equal concerns on the Russian side where state-backing has given cybercriminal groups both the means and opportunities to step up their activity.

Opening the Floodgates for Future Cyberattacks
When the Russia-Ukraine war does come to an end, it is likely that the cybersecurity space will find itself in a far worse situation than it is today. Whether it’s through the anonymous recruitment of Ukraine’s IT army or the cybercriminals in Russia to whom this conflict has given an opportunity to hone their craft. After the conflict, whatever the outcome, these APT groups, hacktivists, and individuals are not just going to disappear. Instead, they will turn their newfound expertise and tooling toward fresh targets unleashing a tsunami of cyberattacks across the globe. We have already started to see early warning signs of this with attacks on NATO partners, as well as on those countries who have come to Ukraine’s aid, increasing in both frequency and intensity.

But it’s not just government departments in those countries that should be concerned, businesses must also prepare themselves for what will follow in the wake of this war. Cybercriminals need a steady income stream in order to recruit new members and invest in technology, and they will turn their attention towards enterprises to boost their coffers when state support has run dry.

This conflict has seen cyber activity change the face of warfare forever. But it has also had the “collateral damage” effect of raising the threat level for cyber-attacks on government and commercial organizations globally. While we were already in an era of sophisticated fifth-generation cyberattacks, threat actors have raised their game during the war and we know that even more, integrated and sophisticated cyberattacks are coming down the line. Organizations need to ready themselves now. Mitigating attacks won’t be enough, companies must adopt a prevent-first cybersecurity strategy.

And prevention is at the heart of Check Point’s Infinity platform, the first modern, consolidated security platform specifically designed to guard against zero-day vulnerabilities and sophisticated fifth-generation attacks across all networks, cloud deployments, and endpoints. Part of Infinity’s success is its ability to leverage Check Point’s ThreatCloud, a real-time global threat intelligence platform that monitors networks around the world for emerging threats and vulnerabilities.

Related Topics:
Continue Reading

Cyber Security

Databases Are the Black Boxes for Most Organisations

Published

4 days ago

on

November 30, 2023

By

Nik Koutsoukos, the Vice President of SolarWinds, says databases represent the most difficult ecosystems to observe, tune, manage, and scale

Tell us about the SolarWinds database observability platform.
Nearly everything a modern business does from a digital perspective requires data. Thus, databases are among the enterprise’s most valuable IT assets. This makes it critical for organisations to ensure their databases are optimised for performance and cost.

That said, databases represent the most difficult ecosystems to observe, tune, manage, and scale. Not only are there different types of databases that serve different purposes, but they are also populated by different types of data, adding to their complexity. The implications of not having visibility into your databases can be anywhere from a costly annoyance to a significant issue that causes business service disruption. For example, most application performance issues, between 70% and 88%, are rooted in the database.

For this reason, databases have largely been seen as a black box for most organisations. You know what goes into it. And you know what comes out and how long that took. However, the complexities that occur within the black box of the database are harder to discern.

This is where the SolarWinds Database Observability comes in. This offering is built for the needs of the modern enterprise environment and helps ensure optimal performance by providing full, unified visibility and query-level workload monitoring across centralised, distributed, cloud-based, and on-premises databases. Organisations armed with SolarWinds Database Observability enhance their ability to understand database implications as new code is deployed, utilise real-time troubleshooting of database performance issues, and isolate unusual behaviour and potential issues within the database.

How does database observability help IT teams track and manage infrastructure, applications, and possible threats?
Database observability collects data about the performance, stability, and overall health of an organisation’s monitored databases to address and prevent issues, and provides deep database performance monitoring to drive speed, efficiency, and savings. With SolarWinds Observability — which supports MongoDB, MySQL, PostgreSQL, and SQL Server database instances — database performance, responsiveness, and error rate are conveniently displayed in dashboards.

Moreover, alerts can be configured to notify admins by email or other methods when user-defined thresholds are crossed. This allows them to identify and remedy issues before they can develop. By gaining insight into the activities taking place inside their database instances, teams can understand user experience as well as ensure systems can scale to meet demand.

What sort of enhancements has your observability platform received recently?
Just this November, we announced major enhancements in the Database Observability capability within our cloud-based SolarWinds Observability platform. SolarWinds Database Observability provides full visibility into open-source, cloud-enabled, and NoSQL databases to identify and address costly and critical threats to their systems and business. It is now possible to navigate across all of the samples collected globally, giving IT teams an empirical distribution of random samples, which resembles the main workload.

What factors according to you will drive the adoption of observability tools in the MEA region?
The Middle East, Türkiye, and Africa (META) are riding a wave of rampant digital transformation as organisations seek to remain competitive. According to IDC, digital transformation spending in the Middle East will accelerate at a compound annual growth rate (CAGR) of 16% over the five-year period, topping US$74 billion in 2026 and accounting for 43.2% of all ICT investments made that year. As organisations continue to shift workloads to multi- and hybrid-cloud environments, the complexity of their IT environments still continues to increase. This raises the potential for visibility and monitoring gaps which ultimately translate to underwhelming or outright frustrating experiences for end users.

Tell us about the top three trends you foresee for 2024.
There are clear signs of the continued adoption of cloud technologies to allow enterprises to become more agile, giving engineering teams the ability to focus on their core competencies and expand and contract on demand.

The adoption of Kubernetes is also increasing as the refocusing introduced by the cloud enables the move to microservices-based architectures which require sophisticated orchestration management.

Finally, we are starting to see an uptick in Vector databases, as applications demand better handling of relationships between data points.

What is going to be your top priority in terms of strategies for 2024?
We will continue to deliver on our vision of making observability easy. OpenTelemetry is driving observability, but data collection is nothing if it can’t provide insights. So, we aim to ensure the data is both collected and curated such that users find it easy to consume and extract valuable insight.

Regionally, through 2024, we will continue to focus on our key markets of the UAE and Saudi Arabia, the ongoing enhancement of our product portfolio, and the strengthening of our channel ecosystem to create more markets for our business and for our partners.

Continue Reading

Cyber Security

ManageEngine Intros Enhanced SIEM with Dual-Layered System for Better Precision in Threat Detection

Published

5 days ago

on

November 30, 2023

By

ManageEngine, the enterprise IT management division of Zoho Corporation, today unveiled the industry’s first dual-layered threat detection system in its security information and event management (SIEM) solution, Log360. The new feature, available in Log360’s threat detection, investigation and response (TDIR) component, Vigil IQ, empowers security operations centre (SOC) teams in organizations with improved accuracy and enhanced precision in threat detection.

A quality SOC ensures people, processes, and cutting-edge technology function well. However, enterprise security is made difficult by staffing shortages and solution orchestration complexities. Following recent upgrades to the security analytics module of Log360 designed to facilitate SOC optimization through key performance metric monitoring, the company has focused on addressing pressing challenges in security operations.

“In a recent ManageEngine study, a majority of respondents revealed that their SOCs are understaffed. These resource-constrained SOCs grapple with significant obstacles, such as process silos and manual investigation of alerts, which are often non-threats, low-priority issues or false positives. These lead to extended detection and response times for actual threats. To overcome these challenges, we recognize the imperative adoption of AI & ML for contextual event enrichment and rewiring threat detection logic,” said Manikandan Thangaraj, vice president at ManageEngine.

“We pioneered a dual-layered, ML approach to heighten the precision and consistency of threat detection. First, Vigil IQ ensures genuine threats are discerned from false positives. Second, the system facilitates targeted threat identification and response. This advanced system significantly improves the accuracy of identifying threats, streamlining the detection process and allowing SOC analysts to focus their valuable time on investigating real threats.”

Key Features of the Dual-Layered Threat Detection System of Vigil IQ in Log360:
Smart Alerts: Vigil IQ, the TDIR module of Log360, now combines the power of both accuracy and precision in threat detection. With its dynamic learning capability, Vigil IQ adapts to the changing nature of network behaviour to cover more threat instances accurately. It will spot threats that get overlooked due to manual threshold settings, thereby improving the detection system’s reliability.

Proactive Predictive Analytics: Leveraging predictive analytics based on historical data patterns, Vigil IQ predicts potential security threats, facilitating the implementation of proactive measures before incidents occur. This predictive intelligence drastically reduces the mean time to detect (MTTD) threats.

Contextual Intelligence: Vigil IQ enriches alerts with deep contextual information, providing security analysts with comprehensive threat insights. This enrichment of alerts with non-event context accelerates the mean time to respond (MTTR) by delivering pertinent, precise information.

Continue Reading

Cyber Security

Cybersecurity on a Budget: Affordable Cybersecurity Strategies for Small Businesses

Published

6 days ago

on

November 29, 2023

By

According to a survey by Statista, typically, global enterprises dedicate a minimum of 12% of their IT expenditure to information security measures. While larger companies can afford to spend a lot on building a robust cybersecurity strategy, smaller businesses cannot. So, let’s explore some affordable cybersecurity strategies for small businesses that may cost less but have a greater impact.

Train your employees
An article from Forbes found that, annually, 34% of businesses worldwide encounter incidents involving insider attacks. Whether intentional or unintentional, employees tend to be the reason for most data breaches. Per the same article, phishing emails account for 67% of accidental insider attacks.

Phishing attacks mostly instil a sense of urgency in the victim, making it harder for them to think clearly before making a decision. For example, employees may click an email announcement about a bonus that actually came from a malicious outsider impersonating your company’s CEO.

To avoid such mistakes, it’s imperative to train employees on the types of phishing attacks and the ways to identify them. Even going as far as sending a mock phishing email occasionally to test their instincts and educate them can go a long way.

Assess your vulnerabilities
One of the most important cybersecurity strategies is to assess all your risk points by periodically reviewing all your business processes. Pay more attention to teams that deal with a lot of customer data. For instance, sales and marketing teams may handle customer data on a day-to-day basis, so they are at high risk of leaking or mishandling data. Assess their daily activities, create a record of all the risk points, and find ways to mitigate them.

Encrypt your data
Encrypting your data can be an effective method to protect it in case of data leaks. Let’s say a hacker gets hold of your company’s data, but it’s encrypted. Unless the hacker gets the encryption key from you, they cannot access your company’s data. This adds another layer of protection in addition to the everyday cybersecurity best practices that you should be following in your company. So make it a point to encrypt all your data, especially sensitive and critical data.

Limit access to critical data
Not everyone requires access to all data. Try to limit access to critical and sensitive data to fewer employees by basing access on work duties or requiring approval for access, making it a multi-step process to access it. Additionally, periodically review who has access to what data to ensure there aren’t any misallocations of access.

Secure your Wi-Fi
A secure network will reduce the chances of a hack or unauthorized access to your sensitive data. So switch your Wi-Fi to WPA2 or later, as it offers more security. Your business might already be using it, but it’s best to be sure. Additionally, change the name of your SSID and have a strong pre-shared key to keep your Wi-Fi safe from hackers.

Prevent physical theft
Through April 2023, there were 3,785 robberies in London, and 1,765 were of mobile phones. This highlights how important it is to secure your physical assets, as they might contain critical and sensitive information about your organization.

Here are some ways to protect your physical assets, such as PCs, laptops, scanners, and printers:

  1. Restrict unauthorized access to assets.
  2. Install a physical tracker on all devices to track down lost items.
  3. Enable remote wiping of data to erase information if a device is lost.

Cybersecurity strategies are seldom drafted with affordability in mind. However, it is crucial to consider them from a financial perspective, as small businesses are also increasingly susceptible to cyberattacks. These tips can help you take the first step toward creating a secure IT environment. Learn more about cybersecurity solutions for your business.

Continue Reading
Advertisement

Follow Us

Trending

Copyright © 2021 Security Review Magazine. Rysha Media LLC. All Rights Reserved.