Increase In State-Sponsored Cyber Attacks

Western nations should brace for more cyber security attacks on critical infrastructure from "second tier" nation states, as warfare from developing nations increasingly shifts online, according to a US cyber security expert who spent more than 30 years with the National Security Agency.

Phil Quade, who has recently become chief information security officer at cyber security software firm Fortinet, rose through the ranks of the NSA in his three-decade long career, serving in both "offensive" and "defensive" capacities, protecting the country's secrets and attacking adversaries.

He said the so-called Five Eyes countries (an alliance between Australia, Canada, the US, New Zealand and the UK), had adversaries of all sizes, including states that would be too small to consider starting a traditional war, but now saw an opportunity to strike virtual blows.

"They recognise that you don't want to take on a nation state with planes, bullets and ships from their position, they want to take them on asymmetrically. I expect mid-sized and smaller countries will increasingly resort to more cyber warfare," Mr Quade said.

Examples of state-based attacks are numerous. In 2015 the Ukraine energy grids was temporarily switched off after cyber criminals, suspected to be acting for Russia, compromised information systems of three energy distribution companies.

North Korean state-sponsored groups were also linked to the 2014 Sony hack and cybersecurity company FireEye has previously said to be monitoring 30 groups linked to nation state cyber-attacks.

Mr Quade said he was in Australia to investigate why local clients were adopting the company's broad range of cyber security products more quickly than other countries, which still invest mostly in its flagship firewall product.

Strategy

The former NSA leader joined Fortinet in January and is responsible for building alliances with external c-suite executives and advancing the national dialogue on cyber security, as well as internally ensuring Fortinet's IT products and services are secure.

Mr Quade was also given permission to create a group dedicated to critical infrastructure protection, which he said would focus on community concerns around national assets, rather than business development.

Despite regular assurances from utility and telecommunications companies (considered critical infrastructure) that they have state-of-the-art cyber security defences, Mr Quade said that in his experience financial services companies were usually best in class for their approach to cyber security

"I don't want to be too critical, because my knowledge of the US is better ... but typically financial services does a nice job of communicating about shared risks. One man's detection is another man's prevention. But it goes mostly downhill from there," he said.

"[To get to the leading edge] the first thing to recognise is that we need to better integrate the disciplines of security. Right now we often manage IT and OT (operational technology) separately and then have a third person in charge of physical security.

"We need to get better at integrating these approaches and that will close the seams the adversaries seem to exploit."

Increasing Threats

According to Fortinet's latest quarterly threat landscape report, cyber-attacks are increasing in volume, variety and velocity.

The report found cryptocurrency mining malware was on the rise in APAC and globally, with cyber criminals utilising a technique termed crypto-jacking to mine cryptocurrencies by loading a script into a web browser without installing anything onto the computer.

In Australia specifically, it was also observed that attacks had been particularly concentrated on the healthcare and education sectors and this was attributed to the lower cyber knowledge of workers in these sectors, in conjunction with the bring-your-own-device trend.

Ransomware was also found to still be prevalent and three of the top 20 attacks identified by Fortinet had been targeted at internet of things devices.

In February the new mandatory data breach notification rules came into effect in Australia, meaning companies above a $3 million revenue threshold or that are subject to the Privacy Act, must disclose data breaches that could result in "serious harm".

Under the new laws, sea safety and support company Svitzer Australia was the first to publicly disclose that the email accounts of three Australian employees had been compromised between May 27, 2017 and March 1, 2018, with emails auto forwarded to two external accounts. After discovering the breach, the company stopped the theft within five hours.

Mr Quade said that internationally Europe's GDPR regulations on data breaches were considered the most aggressive, with penalties including 4 per cent of a company's revenue for failing to report a breach.

"It's a toothy way of causing movement. But in my whole career I've found you don't always have to use the stick, sometimes the carrot is the right approach," he said.

"The NDB scheme doesn't have the same toothiness as the GDPR, but that doesn't mean it's wrong, it's just a different balance."

Australian Financial Review

You Might Also Read: 

Cyber Criminals Catch Up With Nation-States:

Nation State Hacking Is On Trend In 2018:

 

« Will AI Replace Most Jobs?
NATO & EU Form Cybersecurity Partnership »

ManageEngine
CyberSecurity Jobsite
Check Point

Directory of Suppliers

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

BCS, The chartered Institute for IT

BCS, The chartered Institute for IT

BCS provides IT professionals with up to date and relevant certifications enabling them to manage IT security effectively within their budget.

Dome9

Dome9

Dome9 is a cloud firewall management service that stops vulnerabilities, secures remote access, and centralizes policy management.

CCL Solutions Group

CCL Solutions Group

CCL is one of Europe’s leading digital investigation specialists, supporting law enforcement, government and organisations across both public and private sectors.

IOTA Foundation

IOTA Foundation

The IOTA Foundation is a non-profit R&D organisation focused on developing the next generation of protocols for the connected world.

Padlock

Padlock

Padlock is a trusted platform with an intimate knowledge of the cybersecurity industry that connects businesses with freelance professionals

Newberry Group

Newberry Group

The Newberry Group provides comprehensive IT services and solutions that optimize operations, minimize risk and deliver measurable business value.

Information & Communications Technology Association of Jordan (int@j)

Information & Communications Technology Association of Jordan (int@j)

The Information & Communications Technology Association of Jordan is a membership based ICT and IT Enabled Services (ITES) industry advocacy, support and networking association.

Nexon Asia Pacific

Nexon Asia Pacific

Nexon solutions include cloud infrastructure and services, unified communications, managed security services, business continuity, secured high-performance network and business applications.

Tabidus Technology

Tabidus Technology

Tabidus Technology is a cybersecurity association that unites and provides the global protection options against cyber threats.

Cyberfort Group

Cyberfort Group

Cyberfort exists to provide our clients with the peace-of-mind about the security of their data and the compliance of their business.

Route1

Route1

Route1 is an advanced provider of secure data intelligence solutions to drive your business forward.

Seal Security

Seal Security

Seal Security revolutionizes software supply chain security operations, empowering organizations to automate and scale their open source vulnerability remediation and patch management.

Interlock

Interlock

Interlock are building blockchain-based security products that solve legacy web2 security issues - phishing and social engineering.

Swick Technologies (SWICKtech)

Swick Technologies (SWICKtech)

SWICKtech offer IT managed services to increase IT security, stability, and performance for your organization.

Infosec Ventures

Infosec Ventures

Infosec Ventures incubates and scales cyber security innovators that solve inefficiencies in cyber security.

Cyber Compliance Watch

Cyber Compliance Watch

Free index and notification of main new cyber security publications (standards and regulations) from agencies and regulators.