Why Proactive Cyberdefence Matters to National Security

Advances in information and communication technology, and the digitisation that came with them, have changed almost every part of daily life. Sareeka A. G., a product consultant at ManageEngine, argues that this has a price. A connected digital ecosystem woven through critical infrastructure opens huge room for innovation and growth, but it also widens the attack surface. How a country handles the opportunities and dangers of cyberspace, in her view, has a direct bearing on both its development and its security.

Most people accept that cyberattacks are a real and near threat. Fewer, she suggests, appreciate how far the damage from such attacks can reach across a country and its population. Her analysis looks at the scale of that impact, at the people behind the attacks and at the ways they can be stopped.

Four kinds of attacker, and what each can do to a country

Sareeka sorts attackers into four groups according to their motives and the scale on which they operate.

State-sponsored attackers

These are individuals or organisations outside government that receive quiet backing from a government body. Their work usually serves the political, commercial or military interests of the country they come from.

With nations distrusting one another and each seeking an advantage, attacks of this kind have become routine, she writes. The techniques vary widely, from spear phishing supported by carefully researched social engineering through to elaborate advanced persistent threat (APT) campaigns. The aim is to get inside networks and reach confidential material: trade secrets, research findings and war strategies among other things. Cyberespionage is common, and so are insider attacks, in which a trusted person is paid to carry out part of an operation. If the right data falls into the wrong hands, Sareeka warns, a state-sponsored attack could bring down a whole nation-state.

Hacktivists

Hacktivists, whether acting alone or in groups, use cyberattacks to voice political or ideological extremism. Many past attacks have been a form of protest. Favourite methods include large distributed denial of service (DDoS) attacks that knock government servers offline, and posting videos and images that attack a state's policies onto official websites.

Hacktivism can look like electronic civil disobedience with no real malice behind it. Sareeka points out, though, that bringing down the networks of organisations delivering essential services, hospitals for example, can do terrible harm to ordinary people.

Organised criminal networks

These are groups of malicious actors who run centralised operations for illegal profit. Some have political goals and attack in order to spread terror.

Here she focuses on supervisory control and data acquisition (SCADA) systems. Their communication networks underpin electricity distribution, aviation, manufacturing, waste and water control, oil and gas transport and other industries at the core of a modern economy, and they run physical processes and sensitive functions. Attackers can break into these networks by getting physical access to a plant or by setting up remote access. Once in control of SCADA systems, they can tamper with critical controls and cause physical damage, or collect intelligence for a real terror attack with devastating results.

Low-level individual criminals

The last group are hackers who break into single devices or company networks for money or personal benefit. Their attacks tend to be small and carry no hidden agenda.

It is easy to dismiss them as irrelevant to national security. Sareeka disagrees. Guarding the borders is one part of national security; keeping a country safe from within is another.

She offers an example from the COVID-19 pandemic, during which governments everywhere turned to technology to contain and treat the disease. Suppose a text message arrives, apparently from the Ministry of Health, telling you to install an app that alerts you when someone infected with COVID-19 is close by. It sounds like a sensible way to avoid catching the virus. The message, however, might be phishing, and the app might be malicious, harvesting information from the phone and passing it to attackers. They could then demand a ransom, seize control of the device or commit identity fraud and other crimes. One such case looks trivial. When thousands of people are caught out and their identities abused, she argues, the result can be a large-scale security crisis.

Building the defences

Cyberthreats keep changing and growing more complex, and Sareeka calls for a complete approach to IT security that covers both the physical and the virtual world. She sets out five areas.

Tighten physical security

Public and private bodies holding sensitive information need to guard their premises against physical attack, checking visitors carefully and admitting only authorised people. Passcodes, ID cards and biometrics should be used together. Round-the-clock surveillance, good maintenance and physical isolation of sensitive servers and devices stop attackers from getting hands-on access to facilities and tampering with equipment.

Find vulnerabilities and fix them

A risk assessment is one of the first steps towards a secure IT environment. Organisations should inventory all their data assets, identify the vulnerabilities attached to each, judge how likely each is to be compromised and estimate how bad the impact would be. With that information, every asset can be rated high, medium or low risk and given suitable protection.

After classification comes scanning the network for weaknesses and closing them. Sareeka stresses that security information and events must be tracked continuously to keep an eye on the health of the network. VPNs protect connections over untrusted networks, and multi-factor authentication (MFA) guards against misuse of credentials. Keeping systems current and applying software patches promptly also helps protect network devices.

Stop insider attacks

Firewalls, proxy servers and other perimeter defences help keep intruders out, but insiders need a different approach, because they already hold the permissions to reach the assets they want to damage. A hostile nation-state might steal an insider's credentials or pay a trusted employee to work for it. Using machine learning (ML) and artificial intelligence (AI), organisations can build a baseline of normal behaviour for every user account and entity on the network. Comparing live activity against that baseline exposes suspicious behaviour so IT administrators can be warned.

Automate the response

Advanced SIEM tools can be set up to respond to threats automatically, for instance by suspending malicious accounts or temporarily blocking certain actions. During an attack, that lets administrators contain the damage, protect whatever assets remain and support business continuity. Modern security tools can correlate huge volumes of event logs, infer that an attack is coming and alert specialists. They also produce detailed reports that help with forensic investigation afterwards.

Regulate cyberspace

Beyond these technical measures, Sareeka argues that protecting cyberspace depends on drafting strict cyberlaws and regulations and enforcing them well. Clear rules that spell out which activities are criminal, and what penalties and punishments follow, give a structured legal basis for dealing with attacks and the people behind them.

A country's cyberspace, like its geographic and physical borders, needs constant watching and protection. Her first step for governments is to recognise the harm cybercrime can do to society and act on it. Cybersafety depends on everyone, she adds: without individuals taking part, cyberlaws remain words on paper. The way forward she proposes is a coordinated response across agencies, with preventive and counteractive measures against cyberthreats applied in sensible proportion.