Cyber Warfare: How the Rules of Conduct Are Changing

by Andrew Douthwaite | Jan 24, 2023 | Breaches, Cybersecurity, Risk Mitigation & Prevention

Summary of Key Points

• Cyber warfare is similar to cybercrime, but it typically involves nation-states (rather than rival corporations or independent hacker groups).
• Cyber warfare is not currently subject to agreed-upon rules of engagement, which means that organizations in any vertical could potentially become targets.
• Managed Security Services Providers can help you assess your current posture, identify potential weaknesses, and help you fortify your defenses.

Safeguarding your organization’s digital assets used to feel as simple as hiring a few security guards and making sure all your employees knew to lock up correctly at the end of the day. However, with the internet now crucial to many critical business functions, a robust cybersecurity posture is no longer a want but a need.

As the war in Ukraine has demonstrated, even the nature of war is changing: While fighting was once constrained to the physical world, conflicts are increasingly unfolding on a digital front as well.

See also:

• Firewall Management Services
• Endpoint Detection & Response

What is Cyber Warfare?

Like cybercrime, cyber warfare involves a cyber attack or series of attacks launched by one party and targeting one or more other parties. However, unlike traditional cybercrime, cyber warfare typically involves nation-states (rather than rival corporations or independent hacker groups) targeting other nation-states or organizations within those rival states to sow confusion and destabilize their enemies.

Cyber warfare may involve:

• Stealing state secrets (including classified research)
• Disrupting civil infrastructure
• Interfering with rival military forces

Stuxnet: The World’s First Digital Weapon

However, cyber warfare is not only a tool of nation-states; it can also be used by terrorist organizations or other non-state actors seeking to further a hostile nation’s goals, including stealing national secrets or damaging critical infrastructure. A well-known example of cyber warfare is Stuxnet, which first surfaced in 2010. U.S. and Israeli intelligence forces used a worm to disrupt uranium refinement OT (Operations Technology) systems across Iran. As a result of the attack, 20% of Iran’s uranium refinement centrifuges, which it uses to create its nuclear arsenal, were destroyed.

Many cybersecurity experts consider Stuxnet to be “the world’s first digital weapon“, and this attack prompted many serious discussions about the fact that, unlike traditional warfare, whose rules of engagement are laid out explicitly in the Geneva Conventions, cyber warfare is not currently governed by any similar constraints.

As such, while specifically targeting a hospital for bombardment during a conflict is considered a war crime, attacking a hospital’s digital infrastructure using cyber warfare is not currently subject to similar rules of engagement.

The War in Ukraine May Signal the Dawn of a New Era for Cyber Warfare

According to many experts, the ongoing war in Ukraine marks a turning point in the history of cyber warfare. Russia’s invasion of Ukraine relies on both traditional military tactics and cyber warfare, which involves using digital tools to sow confusion, disseminate propaganda, damage infrastructure, dismantle government software, and carry out destructive espionage and attacks.

Microsoft’s 2022 Digital Defense Report found that 90% of Russia’s attacks during 2022 targeted NATO member countries, and 48% of those attacks targeted private IT firms based in member countries. As the war continues, Russian state hackers and state-backed organizations will likely continue to use cyber warfare to target Ukraine’s energy, transport, and digital infrastructures, potentially signaling the dawn of a new era in which civil organizations and even private companies are specifically targeted during times of war.

What Makes Cyber Warfare Different From Hacking & Other Forms of Cybercrime?

Cyber warfare is often defined as conducting military operations by virtual means, whereas cybercrime is typically motivated not by military gain but by criminal financial gain, a desire to steal corporate secrets, as a form of activism, or to gain fame or notoriety. Both types of cyber attacks differ from cyber terrorism, defined as using computer technology to engage in terrorism.

In essence, it is what motivates each of these actions that define which category a cyber attack falls under. Cyber warfare is primarily motivated by a desire for military gains, while cyber terrorism is primarily motivated by political ideology, and cybercrime is primarily motivated by a desire for personal gain (either in the form of financial gains or fame). However, the definitions of each of these attacks are not cut and dry, and some types of attacks may fall under multiple categories. Examples include a country engaged in cyber warfare spreading political propaganda to improve their international image and demoralizing their enemies or cyber terrorists engaging in ransomware attacks to fund their operations.

Should My Organization be Concerned About Cyber Warfare?

When it comes to cybersecurity, it is always better to be over-prepared than underprepared. While organizations in some verticals, such as finance, manufacturing, utilities, and healthcare, should take extra precautions due to their increased chances of being targeted, the fact that cyber warfare is not currently subject to agreed-upon rules of engagement, which means that organizations in any vertical could potentially become targets.

Safeguarding Your Organization

This section will discuss what steps all organizations should take to best prepare themselves to face a potential cyber warfare attack.

If your organization has been targeted, please contact our team of experts immediately and consider reading our educational article Hacked? Here’s What to Know (& What to Do Next).

Create an Incident Response Plan

The first thing any organization should do to strengthen their security posture is create an effective incident response plan (IRP). The purpose of an IRP is to provide instructions to your workers on how to identify, respond to, and recover from, a cyberattack.

Your IRP should be a living document that is updated regularly and include:

• A mission statement
• Clearly defined roles and responsibilities
• A list of cybersecurity or cyber warfare incidents that your team is likely to encounter
• Up-to-date emergency contact information for all relevant parties

For more information on creating an incident response plan, please consider reviewing our educational guide: Guide to Creating an Effective Incident Response Plan.

Familiarize Yourself With Common Forms of Cyberattack

Cyberattacks come in a variety of forms, and what may be unheard of yesterday may become commonplace tomorrow. By keeping up with the latest news in the cybersecurity world, you can help ensure your organization is prepared when disaster strikes.

Common forms of cyberattack include:

• Brute-Force attacks
• Phishing and social engineering
• Credential stuffing
• Cryptojacking
• Data breaches
• DDoS (Distributed Denial of Service) attacks
• DNS hijacking (also called DNS redirection or DNS poisoning)
• Drive-by attacks
• Exploits
• Malware (including ransomware)
• Supply chain attacks

For more information on these forms of attack and what motivates attackers, please consider reading our educational articles: Terms & Phrases Used in the Managed IT & Cybersecurity Industries and The Modern Hacker: Who They Are, Where They Live, & What They’re After

Strengthen Your Digital Fortifications

Securing your network and other digital assets may be daunting, but your MSSP (Managed Security Services Provider) can help you assess your current posture, identify potential weaknesses, and help you fortify your defenses. As part of this process, you should:

Secure Your Network

Something as simple as a well-designed firewall can help significantly improve your defense posture. However, while an ordinary, one-size-fits-all firewall is better than no firewall at all, a managed firewall can provide better protection and more information.

A managed firewall is designed to help you keep tabs on all network activities and send out an alert if it encounters anything suspicious. A managed firewall can also be tailored to meet your organization’s unique security needs and help ensure unauthorized users are kept off your network.

Keep Your Software Up to Date

Something as simple as a software update can mean the difference between a successful attack and a thwarted one. When software companies discover vulnerabilities or problems in their products, they develop and release patches, small snippets of code designed to address the situation.

However, your organization is only protected by security patches if they are installed. Cyber warfare actors and cybercriminals are also more likely to target recently patched software since they know that not all organizations are diligent enough to install the patches immediately.

Protect Your Endpoints

Even the strongest fence is useless if you leave the gate open. If they aren’t properly protected, endpoints such as laptops, tablets, and smartphones can allow unauthorized users to access your network. Safeguarding your endpoints is particularly important in BYOD (Bring Your Own Device) settings, where employers don’t have direct control over all network endpoints.

To improve your security posture, you should ensure that all endpoints that have access to your network use multi-factor or two-factor authentication, have appropriate security software installed, and that all software is kept up to date to ensure you can benefit from all new security patches.

Implement Secure Password Guidelines

Something as simple as implementing secure password guidelines can mean the difference between a secure network and a vulnerable one. To help ensure all team members are using robust passwords, you may want to develop a password policy based on section 5.1.1.1 (Memorized Secret Authenticators) of the NIST’s password guidelines.

Limit Permissions

Access to sensitive areas of your network, such as your security settings and financial records, should be granted on a need-only basis. By not granting more expansive permissions than an employee needs to do their job, you can limit the number of individuals within your organization who have access to sensitive data.

By curtailing access, you can help ensure that if a team member’s username and password become compromised (because, for example, they fell for a phishing scam), those credentials are statistically less likely to grant unauthorized users access to sensitive information. As part of this process, you should also ensure you have a clear offboarding procedure in place for revoking former team members’ credentials so that both former employees and potential cyberattackers can’t use inactive credentials to gain unauthorized access.

Back Up Your Data Regularly

If you are targeted by a ransomware or other type of malware attack, your data may become corrupted or lost. As such, having the ability to roll back to a recent backup can help you avoid service disruptions or other problems. However, any data generated after the last backup is unlikely to be recovered if an incident occurs, which is why it is important to back up all data regularly.

Invest in Regular, Ongoing Security Training

Defending your organization against cyber warfare is everyone’s responsibility. Even the best plan is only useful if everyone understands what it is, why it’s important, and how to implement it effectively. After all, even the most studious and diligent team member won’t be able to follow your cybersecurity and cyber warfare protocols if they don’t know what they are.

To help keep your team in fighting shape, all workers from the CEO downward should receive comprehensive cybersecurity training as part of your onboarding process and undergo regular refresher training. To help ensure your training is effective, all team members should:

• Understand why cybersecurity and cyber warfare defense is important
• Know what protocols are in place and why
• Have the tools and knowledge they need to identify suspicious activities
• Know who to report any suspicious activities to
• Understand what steps they need to be taking to best safeguard your organization

You may wish to consider running tabletop exercises as part of your training. Like fire drills, tabletop exercises are designed to give employees a chance to test their cybersecurity and cyber warfare defense knowledge in a safe environment. Team members are presented with a hypothetical scenario, such as a ransomware attack, and then instructed to work as a team and, with the help of your incident response plan, respond to the attack.

Once the scenario is complete, your team can sit down with your Managed Security Services Provider or in-house security team and evaluate their performance while also identifying any deficiencies in your IRP so they can be addressed. Regularly scheduled tabletop exercises can help keep digital security top of mind and ensure all workers are familiar with any changes or updates to the plan.

Stress-Test Your Defenses

Just like the best way to find out if a boat is leaking is to put it in the water, the best way to find out if there are any holes in your security posture is to put it to the test. Pen (penetration) testing involves hiring an ethical hacker to stress-test your security posture by searching for vulnerabilities and then attempting to exploit them to gain access to your network. Once the test is complete, the hacker will sit down with your team and explain what they did, what vulnerabilities they were able to discover and exploit, and what steps they suggest you take to address these security deficiencies. This information can then be used to improve your security posture through actions such as improving your cybersecurity and cyber warfare training, addressing hardware or software deficiencies, or updating company security policies.

Cyber warfare has become a serious threat, and that threat is only predicted to grow. Investing in a robust cybersecurity posture can help safeguard your digital assets and hinder the efforts of cyber warfare attackers targeting your country. Please contact our team today to learn more about which steps your organization should be taking to improve your security.

The 7 Most Common Types of Malware

by Andrew Douthwaite | Jun 1, 2022 | Breaches, Cybersecurity, Risk Mitigation & Prevention

Last updated August 19, 2022

Summary of Key Points:

• Malware is software designed to steal data, damage equipment, or spy on users.
• Viruses infiltrate a program or device and then spread across a network.
• Worms are viruses that self-replicate and spread without human action.
• Trojans disguise themselves as legitimate code or software, but allow attackers to carry out the same actions as authorized users.
• Ransomware restricts access to a device and gives control of it to an attacker unless a sum of money is paid to them.
• Malicious Adware uses ads to lure users to download other types of malware or visit sites that will automatically infect their devices.
• Malvertising is similar to malicious adware, but is delivered through a compromised website and only affects users while they are visiting it.
• Spyware is malware designed to gather a user’s data without their consent or knowledge.

In the internet age, organizations in all verticals are increasingly relying on digital tools to get the job done. From seemingly mundane tools such as email and digital calendars to highly specialized programs, more work than ever relies on digital and internet-connected tools, including the cloud. Unfortunately, this rapid increase in digital interconnectivity has brought with it a sharp rise in digital crime, including the distribution of malware. 

If your organization has recently been targeted or is currently being targeted in a malware attack please contact our team of experts for advice and practical assistance as soon as possible and consider reading our educational article: Hacked? Here’s What to Know (and What to Do Next).

See also:

• Our managed firewall services
• Our managed endpoint detection and response services

What is Malware?

Malware, short for malicious software, is a general term that encompasses a wide variety of malicious programs designed to steal sensitive data, damage equipment, or spy on unsuspecting users. In this article, we will discuss seven of the most common types of malware: 

• Viruses
• Worms
• Trojans
• Ransomware
• Adware
• Malvertising
• Spyware

2021 Saw An Alarming Increase in Ransomware & This Trend is Likely to Continue

According to a joint cybersecurity advisory issued by the Cybersecurity and Infrastructure Security Agency (CISA), along with the FBI and the NSA, and in partnership with the Australian Cyber Security Centre (ACSC) and the United Kingdom’s National Cyber Security Centre (NCSC-UK) 2021 saw the continuation of several alarming cybercrime trends, and found that “Ransomware [a type of malware] groups are having an increasing impact thanks to approaches targeting the cloud, managed service providers, industrial processes and the software supply chain” and that “More and more, ransomware groups are sharing victim information with each other, including access to victims’ networks.” 

The advisory also reported that the ransomware market, in particular, is becoming increasingly “professionalized”, with more criminals relying on cybercriminal services-for-hire to attack targeted organizations.

These alarming statistics highlight the importance of having an up-to-date and comprehensive cybersecurity incident response plan in place, investing in critical cybersecurity infrastructure to safeguard your digital assets, and offering all team members regular cybersecurity training.  

The 7 Most Common Types of Malware (& How They Can Impact Your Organization)

1. Viruses

Computer viruses are a form of malware designed to infiltrate one program or machine and then spread to other systems, much like the viruses that target the human body. As it spreads, the virus wreaks havoc on business activities by encrypting, corrupting, deleting, or moving data and files or launching DDoS or ransomware attacks on other connected machines. 

Viruses are particularly insidious because they may remain dormant for a set period, allowing the virus to spread to as many machines and devices as possible before launching the attack. Viruses may be delivered via email or inadvertently downloaded from infected or malicious websites and can also be delivered via physical media such as USB drives. Cybercriminals may leave infected USB drives in lobbies or parking lots, hoping that a worker will pick them up and plug them into their network-connected computer. 

Unlike worms (discussed below), computer viruses must be embedded in a host program and often remain dormant until they are activated by unsuspecting users, such as when a user plugs an infected USB drive into their machine, opens an infected file, or clicks on a malicious URL.

2. Worms

Worms are similar to viruses, but they do not require human action to infect, self-replicate, and spread to other machines. As soon as the system is breached, worms can infect both the entry point machine and spread to other machines and devices on the network unaided by humans. 

Worms rely on network vulnerabilities, such as unpatched operating systems, weak email security protocols, and poor internet safety practices. Originally, the goal of most worms was to damage system resources to hinder performance. However, modern worms are often designed to steal or delete files and are typically deployed against email servers, web servers, and database servers. 

The Stuxnet attack is a particularly devastating example of a worm at work. This attack targeted operations technology systems involved in uranium enrichment and impacted organizations across Iran, India, and Indonesia. 

3. Trojans

A trojan is a type of malware that has disguised itself as a piece of legitimate code or software. Once an unsuspecting user grants the trojan network access, it allows attackers to carry out the same actions as legitimate users, including exporting or deleting files, modifying data, and otherwise altering the contents of the infected device. Trojans are designed to appear innocuous and are often found in downloads for games, apps, tools, or even software patches. 

Many trojans rely on phishing, spoofing, or other social engineering attacks to trick users into granting them network access, but this is not always the case. Though trojans are occasionally referred to as trojan viruses or trojan worms, these terms are not strictly correct: unlike viruses, trojans cannot self-replicate, and unlike worms, they cannot self-execute. All trojans require specific and deliberate user actions to spread, such as convincing a colleague to try out this great new productivity app or download this fun game onto their work phone so you two can play together on your lunch break. 

4. Ransomware

Ransomware is one of the most common and widely discussed forms of malware, and for a good reason. According to a cyber threat bulletin from the Canadian Centre for Cyber Security, 2021 saw the average recovery cost from a ransomware attack more than doubled between 2020 and 2021, from $970,722 CAD (roughly $757,852 USD as of the writing of this article) in 2020 to $2.3M CAD (roughly $1,795,380 USD) in 2021. The same bulletin revealed that the increased impact and scale of ransomware operations between 2019 and 2020 was largely fuelled by the “professionalization” of ransomware and the growth of the ransomware-as-a-service (RaaS) model, which involves less-technically-savvy criminals hiring skilled attackers to distribute ransomware campaigns, with attackers being paid a percentage of the victim’s ransom payment.

Ransomware is focused primarily on financial gain and is designed to encrypt files on an infected machine and hold them hostage until a ransom is paid. With the invention of cryptocurrencies such as Bitcoin, which don’t rely on a central authority such as a bank and are therefore more difficult for law enforcement to trace, has made it easier than ever for attackers to extort victims.

Ransomware frequently relies on social engineering to manipulate unsuspecting users into downloading infected email attachments or clicking on URLs from untrustworthy sources. Once a device is infected, the program typically creates a back door, which allows the attackers to covertly access the device and begin encrypting files while locking owners and other legitimate users out. 

Even if your organization decides not to pay the ransom, you may still suffer financial loss. Employees who can’t access their work devices aren’t likely to get much work done, and your IT team and other technical specialists may need to be pulled away from other critical tasks to deal with the crisis. Depending on the nature of your business, even a few hours of downtime can have devastating consequences, as highlighted by the now-famous WannaCry attack that targeted the United Kingdom’s National Health Service (NHS) in 2017. The attack rendered the IT systems of hospitals and doctor’s surgeries inaccessible, which compromised medical care and put patient lives at risk. The attack knocked CT scanning facilities and MRI machines offline and left healthcare professionals unable to access vital data, including digital patient health records.

5. Malicious Adware 

Adware, also called advertising-supported software, is legitimate software that is designed to display ads to a user when they are online, thereby generating revenue for the website’s owner. Though it is not inherently malicious, it can be used for malicious purposes. 

While most legitimate organizations will carefully vet what sort of advertisements they allow to appear on their website (to ensure they don’t accidentally damage their brand by serving hateful or controversial content or drive business away by showing competitor ads), not all businesses are as meticulous as they should be. Cybercriminals may use malicious ads to trick unsuspecting users into downloading malware when they click on the ad or may use pop-ups, pop-unders (where the pop-up is intentionally hidden from view by the active window), or permanent windows that allow for drive-by downloads (where a user’s device becomes infected with malware simply by visiting the site). Malicious ads may also preemptively block antivirus programs from opening, further weakening your organization’s defenses. 

6. Malvertising

Malvertising (malicious advertising) is similar to malicious adware. One key difference is that adware only targets individual users and relies on infected digital ads served via unsuspecting websites. Once a device is infected, adware operates continuously on that device unless actively removed. On the other hand, malvertising is served by the compromised web page itself (not via third-party adware programs) and only affects users while they are on the infected web page. 

Like malicious adware, malvertising may take advantage of browser vulnerabilities to deploy drive-by-downloads. However, because the entire webpage (and potentially the entire website) is compromised, it can also forcibly redirect users away from the legitimate site to a malicious one or display advertising, malicious content, pop-ups, or pop-unders that the website’s owners did not intend to display. In the case of a forcible redirect, users may be brought to a different site infested with drive-by download malware (allowing attackers to compromise multiple sites and simply redirect them to the malicious site) or direct users to a site that looks almost exactly like the legitimate site as part of a wider phishing scam and attempt to trick unsuspecting users into handing over private information such as banking details or login credentials.

Malvertisements Cost Organizations More than Just Revenue & Site Traffic

While redirecting users to a different site impacts both website traffic and can compromise revenue streams, these are hardly the only potential costs. Website publishers may suffer reputational damage (since users are less likely to trust compromised organizations with their personal information going forward) and may be found legally liable for any damage suffered by users visiting their website. 

7. Spyware

Spyware differs from the other forms of malware we have discussed so far in that its goal is not to extort funds, steal sensitive files, or damage files but instead to, as the name suggests, spy on you and your organization. Spyware is designed to gather data without your consent and forward it to a third party. 

Spyware can also refer to legitimate software installed by companies to monitor their workforce or programs, such as tracking tools embedded in websites that you visit that are used for advertising purposes. However, we will be focusing on malicious spyware deployed by cybercriminals against unsuspecting targets such as businesses so they can profit from stolen data, including proprietary data and usernames and passwords (obtained via keylogging software).

Malicious spyware is a type of malware that has been installed without your informed consent and is designed to monitor your activities and capture personal, confidential data, often via keystrokes, screen captures, and other types of tracking tools. This stolen data is then aggregated and either used by the party that gathered it or sold to other parties. 

Malicious spyware is typically interested in confidential information such as:

• Login credentials
• Credit card numbers
• Account PINs

However, it will also monitor your keyboard strokes, track your browsing habits, and harvest email addresses (including your own and those of the people and organizations you are corresponding with). 

Unlike ransomware, spyware goes out of its way to remain undetected and obscure its activities. Spyware often embeds itself in other programs that users are likely to intentionally download and install, such as bundleware (bundled software packages), without the knowledge or consent of the company that is offering the legitimate software.

However, sometimes companies will purposefully embed spyware in their bundleware while describing and requiring you to agree to the spyware in the license agreement without explicitly using the term “spyware”, tricking users into voluntarily and unknowingly infecting their devices. Spyware can also infect devices using similar methods to other malware, including via compromised websites or malicious attachments. Trojan malware and malicious adware may also both include spyware.

Spyware can wreak havoc on any business environment, allowing cybercriminals to better:

• Steal data
• Commit identity fraud
• Damage computers
• Disrupt business operations

Safeguarding Your Business From Malware

There are a few steps you can take to safeguard your organization against malware. These include:

Avoid Abandoned USBs

Attackers will often leave infected USB drives in publicly accessible places such as lobbies or parking lots in the hopes that some unsuspecting employee will pick it up and plug it into their machine. Should you come across an abandoned USB drive, you should report it to security and then hand the USB drive over to your cybersecurity team for further analysis and proper destruction.

Keep Your Software Up to Date

Software developers frequently release security patches, small programs designed to address known flaws and improve security. However, your organization can only take advantage of these improvements if the security updates are installed.

Invest in Antivirus Software

While antivirus software may not seem cutting edge anymore, it still plays a critical role in any cybersecurity strategy.

Think Before You Click

While most email providers include built-in antivirus scanning that flags potentially harmful attachments or links, it never hurts to be cautious. If you encounter a suspicious link or file, do not open it. Instead, you should forward the email to your cybersecurity team for further analysis. If the email is purportedly from someone you trust (such as your company’s bank or your boss) but seems suspicious, you should reach out to that person independently to verify that they are the real sender. You should also carefully read the sender’s email address on any email you receive. 

For example, if your boss Jennifer Smith usually emails you from her work email (jennifersmith@yourcompany.com), but this email is from a different address, such as jenniferesmith@yourcompany.org or [email protected], you should not reply to the email, but should instead reach out to your boss independently to verify that she sent the email. This is particularly important if the sender is asking you for sensitive or personal information, such as banking details or your password, or asking you to do something unusual, such as purchase a large number of gift cards or make changes to company banking details.  

If someone sends you a URL, make sure you read it carefully. While you may be expecting a URL that directs you to www.yourbank.com and instead see www.yourbaank.com (note the extra ‘a’), you should once again independently verify that the sender is who they say they are before taking any action or handing over any information. It’s always better to spend a bit of time verifying than rush and take actions that could potentially compromise the safety and security of your organization.

Invest in Cybersecurity Training for All Employees

Even the most comprehensive and robust cybersecurity incident response plan and cutting-edge cybersecurity infrastructure depends on educated users for maximum efficacy. Ensure all employees undergo cybersecurity training as part of your onboarding process and periodically receive additional training. 

Only Buy Devices from Trusted, Reputable Sources

While it may be more budget-conscious and environmentally friendly to purchase gently used devices, second-hand devices may offer more than you bargained for in the form of pre-downloaded malware. If you still intend to purchase second-hand equipment, make sure you do so from a trusted, authorized retailer of pre-owned devices and audit each item thoroughly for suspicious programs before connecting it to your network.

Opt for the Paid Version

One of the easiest ways to avoid falling victim to malicious adware is to opt for the paid, ad-free version of the software you are using whenever possible. Most organizations that offer premium subscriptions to otherwise ad-supported free products do not serve ads to premium users, so opting for the paid version can dramatically reduce your attack surface.

Vet Ads Partners Carefully to Avoid Malvertisement

Ad networks serve users ads from millions of advertisers, and most rely on real-time bidding, which means the ads shown on a website are constantly changing. This can make it difficult, if not nearly impossible, for individual website publishers to separate malicious ads from innocent ones. As such, it falls primarily on the ad provider to carefully vet ads, so it is critical that all website publishers choose their advertising partners with care. 

Be Cautious About Cookies

With GDPR compliance affecting more organizations each day, almost all websites now ask users for their explicit permission before creating cookies. Cookies are considered by some to be a form of spyware, so make sure you only accept cookies from trusted sites and consider limiting your permission to essential cookies only.

Consider Using an Anti-Tracking Browser Extension

Not all of your browsing activities need to be tracked by third parties, whether for legitimate means like advertising or otherwise. Anti-tracking tools can allow you to better opt-out of omnipresent tracking, which helps keep your browsing activities and data private.

Avoid Third-Party App Stores

Cybercriminals are increasingly targeting people through their phones, often using apps. Third-party app stores may not vet the apps they offer as carefully as Apple and Google, so it is best to be cautious and stick to the official app stores. 

Stick with Official App Publishers

Apps are an increasingly common delivery mechanism for malware, particularly spyware. Before you download an app, make sure that you trust the company that developed it.

Limit App Permissions

A troubling trend in the app space is apps that ask for more generous permissions than they require. Many apps ask to access your microphone, camera, or location data without justifying why they need this information. To avoid handing over more data than you need or want to, you should regularly review your app permissions and ensure your current settings reflect your actual preferences.

Nothing is Ever Really Free

As the old saying goes: if something is free, it’s because you are the product, not the customer. While sometimes free can mean a limited-time trial that allows prospective customers to try out the product for themselves, it can also mean that its creator is profiting off of the data you generate. Before you start using new software, make sure you take the time to read through the terms of use and only agree to them if you understand and accept them. 

Are You Concerned About Malware? VirtualArmour is Here to Help!

While it may feel like malware is lurking around every corner, there are concrete steps you can take to better safeguard your organization and its data. In addition to the advice above, you should also consider partnering with a trusted MSSP like VirtualArmour. With offices in both Denver, Colorado, and Middlesbrough, England, we are able to offer live, 24/7/365 monitoring as well as industry-leading response times. 

The cybersecurity experts at VirtualArmour have extensive experience working with organizations in a variety of verticals, including healthcare, finance, retail, and energy and are also familiar with the unique needs of service providers and offer tailored plans based on your level of need, including essential services, premium services, and one-time consults. We offer a wide selection of cybersecurity services, including:

• Managed SIEM
• Endpoint detection and response
• Managed infrastructure and firewall
• Vulnerability scanning
• SOC as a service

For more information, or to get your free, no-obligation quote, please contact our team of experts today.

What the War in Ukraine Means for American Cybersecurity Engineers

by Andrew Douthwaite | Mar 28, 2022 | Breaches, Cybersecurity, Risk Mitigation & Prevention

Last updated September 27, 2022

Summary:

• The war in Europe has devastating physical consequences, but it’s also being conducted in cyberspace. Cyberattacks have already targeted Ukraine’s Defense Ministry and numerous banks. Accusations that Russia is engaging in cyberattacks stretch back years—to at least 2014, when Russia invaded the Crimea.
• Attacks by state sponsored threat actors could have consequences for businesses and other organizations in countries allied with Ukraine.
• In the US, the Cybersecurity and Infrastructure Security Agency has warned that businesses “large and small” should prepare themselves for disruptive cyber activity.
• Types of attacks businesses might face include the use of Advanced Persistent Threats (APTs), malware, ransomware, DDos, and various network security attacks.
• Organizations are urged to follow the advice of their national cybersecurity authorities, establish relationships with local governments in areas where they operate, and build trust between organizations via overcommunication, honesty, transparency, diligence, willingness to listen, and consistent actions.
• Proactively requesting information from threat intelligence partners, having a robust incident response plan, safeguarding endpoints and more can all reduce your risk of being affected by cyberattacks.
• Virtual Armor can provide effective services for businesses who want to improve their cybersecurity posture, including Managed SIEM, Managed Infrastructure & Firewall services, Vulnerability Scanning, and SOCaaS (Security Operations as a Service).

The Russian invasion of Ukraine has shocked the world, driving millions from their homes as they seek safety. However, in the internet age, wars aren’t fought in the physical world alone, and cyber warfare has become an increasingly serious threat. 

The Invasion of Ukraine is Already a Cyberwar

Though most of the news coverage of the situation focuses on developments in the physical world, early cyber skirmishing has already begun. Cyberattacks have recently targeted the Ukrainian defense ministry, and two banks in what the country’s deputy prime minister stated is the largest attack of this type ever seen in the country. 

While the Kremlin has denied they are behind the denial of service attacks, the disruption has brought concerns about the threat of cyberconflict into the spotlight. Ilya Vitayuk, the cybersecurity chief of Ukraine’s SBU intelligence agency, has stated that it is still too early to definitively identify the perpetrators behind the attack. This is because, as with most cyberattacks, the perpetrators worked hard to cover their tracks. However, he also added, “The only country that is interested in such … attacks on our state, especially against the backdrop of massive panic about a possible military invasion, the only country that is interested is the Russian Federation.”

Ukraine has accused Russia of cyberattacks in the past and believes the Kremlin is behind a string of cyberattacks against Ukraine starting in 2014. In an age when war is fought on battlefields, both physical and digital, combat is no longer confined to combatants on the ground. While Ukraine’s SBU has made cybersecurity a major security focus in the current conflict, a cyberattack on Ukraine by Russia or its allies could have wide-reaching consequences for Ukraine’s allies as well. As such, countries and private organizations alike need to remain vigilant.

The American Government Prepares to Respond

Cyberattacks, even those specifically targeting Ukraine, could seriously impact the United States. 

In response to the invasion of Ukraine, CISA (Cybersecurity and Infrastructure Security Agency) has issued a statement. Entitled Shields Up, it states (as of the writing of this article):

“While there are no specific or credible cyber threats to the US homeland at this time, Russia’s unprovoked attack on Ukraine, which has involved cyber-attacks on Ukrainian government and critical infrastructure organizations, may impact organizations both within and beyond the region. Every organization—large and small—must be prepared to respond to disruptive cyber activity. As the nation’s cyber defense agency, CISA stands ready to help organizations prepare for, respond to, and mitigate the impact of cyber-attacks. When cyber incidents are reported quickly, we can use this information to render assistance and as a warning to prevent other organizations and entities from falling victim to a similar attack.”

President Joe Biden has announced the American government is prepared to respond to cyberattacks from Russia if necessary, and “For months, we have been working closely with our private — with the private sector to harden their cyber defenses, sharpen our ability to respond to Russian cyberattacks, as well.” NBC News also reported that President Biden has a “menu of options for the US to carry out massive cyberattacks designed to disrupt Russia’s ability to sustain its military options in Ukraine.”

However, as the Shields Up announcement indicates, cyberwarfare concerns are not contained to the national and international stage. Organizations of all sizes and in all verticals need to be taking appropriate steps to proactively safeguard their digital assets. 

What Sort of Cyberattacks Should We Anticipate?

While we have no way of knowing exactly what sort of attacks the cyber warfare front of the Ukraine-Russia conflict will bring, we can look to a history of previous international attacks for guidance. According to Forbes, organizations should be prepared to handle:

Advanced Persistent Threats (APTs)

APTs is a broad term used to describe any attack campaign where an attacker, or group of attackers, establishes an illicit, long-term presence on a network in order to covertly mine highly sensitive data. Most intrusions of this nature that target private companies tend to focus on the theft of intellectual property, compromising sensitive data (such as employee or private user data), sabotaging critical infrastructure (such as deleting database data), or taking over websites with a goal of illegal financial enrichment, the strategies deployed against private companies can be used against nations and companies alike. 

With cyber warfare on our doorstep, now is the time to batten down the hatches and strengthen your cybersecurity posture. By improving your overall security posture, you can proactively guard against ATPs by making it difficult for intruders to infiltrate your network in the first place, preventing them from establishing a covert, long-term presence. 

Malware

Malware refers to any form of malicious software, typically spread by infected email attachments and suspicious website links deployed as part of phishing scams. While most email providers automatically filter out suspicious messages, one of the best steps organizations can take to improve their cybersecurity posture is to invest in employee cybersecurity training. 

Cybersecurity is everyone’s responsibility, from the CEO down to the summer intern. Teaching workers to identify and report suspicious activities can stop an attack before it even begins, so all team members should receive robust cybersecurity training as both part of their onboarding process and on an ongoing basis. 

Ransomware

Ransomware is a subset of malware, which uses malicious code to encrypt files and prevent legitimate users from accessing data or systems on either their individual machine or the organization’s network. 

DDoS

DDoS (Distributed Denial of Service) attacks are attempts to crash a web server or other online service by flooding the supporting infrastructure with more traffic than the network can reasonably handle. 

This type of attack can be instigated by either a large group of attackers working together or a single attacker with a sufficiently large botnet (connected computers performing repetitive tasks as directed by the user in charge). The goal of DDoS attacks is to overload the server, forcing it offline and preventing legitimate users from accessing the organizations’ products or services. 

Network Security Attacks

Network security attacks is an umbrella term for attacks aimed at disrupting an organization’s network and system for a variety of reasons, including causing service disruptions, stealing data, or corrupting files. While this is often done for financial gain, in the case of the cyberwarfare front of Russia’s attack on Ukraine, it is likely to be for political or military gain. 

To help safeguard themselves from these types of attacks, organizations should be taking proactive steps to safeguard their networks from network breaches. 

What Steps Should Your Organization Be Taking to Best Safeguard Your Digital Assets

Follow All Current Advice From Your National Cybersecurity Authority

The situation, both on the ground in Ukraine and in the digital sphere, is continually evolving, with new threats always on the horizon. To best safeguard your organization, it is vital to stay up to date on the situation and follow the current advice of your national cybersecurity authority. 

• In the United States, CISA has already launched their Shields Up initiative we previously discussed, and their website offers concrete advice on a variety of relevant topics, including insights on how to help critical infrastructure owners prepare for and mitigate foreign influence operations.  
• In the United Kingdom, the National Cyber Security Centre (NCSC) has published specific steps organizations should be taking to best safeguard themselves in the current heightened threat landscape. They also offer general cybersecurity advice for a variety of organizations, including small and medium-sized organizations, large organizations, public sector organizations, and self-employed and sole traders, and general advice on a variety of cybersecurity topics.
• In the European Union, organizations should follow the advice of ENISA (the European Union Agency for Cybersecurity). 

Establish A Relationship With Local Governments in Jurisdictions Where Your Company Operates

• In the United States, InfraGard is responsible for coordinating information sharing between critical infrastructure providers.
• Organizations operating in the United Kingdom should review information provided by NCSC’s Critical National Infrastructure hub.
• Organizations in the European Union should speak to their local CSIRT (Computer Security Incident Response Team) and CERT (Computer Emergency Response Teams) contacts. A full list of these can be found here. 
• In Germany, the BSI (Federal Office for Information Security) has released several cybersecurity warnings related to the situation. Current security warnings can be found here. 
• In Australia, the Australian Cyber Security Centre (ASCS) is providing guidance using ongoing alerts. You can also register to receive alerts from ACSC, and they provide general cybersecurity advice for small and medium businesses and organizations and critical infrastructure. 

Success Depends on Interorganizational Trust

Even the most comprehensive, best-designed cybersecurity strategy can be easily undermined if your organization lacks interdepartmental trust. A solid relationship between stakeholders and your security team is critical if you want to keep your organization secure. 

Building trust can be hard, but there are concrete steps your security team can take to build stakeholder trust. This includes:

Overcommunication 

Clear, concise, focused, and on-point communication is critical, and there is no such thing as too much information. Too many stakeholder-security team conflicts are rooted in a lack of communication, miscommunications, or misunderstandings. Opening the lines of communication, and keeping them open, is an excellent way to build trust.

Honesty & Transparency

When it comes to cybersecurity, honesty is the best policy. When it comes to admitting fault, acknowledging a mistake, or delivering bad news, stakeholders and security teams alike appreciate honesty. By being honest about your organization’s current security posture (including any deficiencies), security and stakeholders can work together to fortify your organization’s cybersecurity posture. 

On the other hand, lies, omissions, and misrepresentations cause cracks in your cybersecurity posture and foster inter-organizational distrust, with potentially disastrous consequences. All trusting relationships are built on a foundation of honesty.

Diligence

Hard work, dedication, and commitment from both your security team and your stakeholders is critical for building organizational trust. Both sides of the table need to know that the other side is working hard to fulfill their obligations and is willing to own up to any mistakes or shortcomings. It’s a lot easier to build trust when you know the rest of the team has your back.

A Willingness to Listen & Accept Feedback

Communication is a two-way street, and both stakeholders and security teams need to be willing to listen and accept honest feedback and not dismiss the other side’s suggestions and concerns out of hand. When one side feels that the other isn’t taking their concerns, expertise, or advice seriously, it undermines the relationship and damages trust, weakening the organization and compromising its security posture. 

Action

Talk is great, but only when it is followed by concrete action. When either the security team or the stakeholders promise to do something, the other side needs to see that they will follow through. When we can’t trust our teammates to act on their promises, those promises become meaningless. 

That being said, we are only human, and sometimes promises are broken. When this happens, it is critical to acknowledge that the promise was not honored, provide an explanation (budgetary concerns, staffing shortages, etc.), amend the promise so it can be reasonably accomplished, commit to action, and then act to fulfill the promise. A cycle of inaction and broken promises can impact more than your cybersecurity posture; it can poison your organization, driving away good workers and demoralizing those who remain.   

Initiate a “Request for Intelligence” From Your Threat Intelligence Partner

You can’t adequately defend yourself if you don’t know what you are defending against. A request for intelligence is a comprehensive report compiled by your threat intelligence partner. When requesting your report, make sure you specify your intended audience (such as your board of directors or security team) and any specific concerns you may have so that your vendor can tailor the report accordingly and ensure all critical and relevant information is included. 

A good request for an intelligence report should go beyond the normal overviews your partner is providing and should include specific concerns related to your vertical, industry, and operating locations. It should also provide information on threat actors you should be concerned about, as well as the TTPs (tactics, techniques, and procedures) those threat actors typically use. 

Collaborate Closely With Your Security Vendors

Your security vendor needs to take a proactive role when it comes to preparing your organization for cyber conflict and defense. 

• Vendor account representatives can help ensure your organization receives the correct level of care and attention and help you get the most out of your security products and services.
• You should also work closely with your product vendors to confirm turnaround times and automation options for ruleset and patch updates (to ensure your software automatically downloads and installs security patches as soon as they are made available).

A good vendor should be already communicating with you about the situation in Ukraine, but if you have not received any communications, you should reach out directly to your vendor, representative, or support team.

Keep an Eye Out for Disinformation & Misinformation

Disinformation and misinformation featured heavily in the lead-up to the conflict in Ukraine. On February 3rd, 2022, the United States even predicted that Russia might use fake graphic videos as a pretext for invasion, a prediction that came true two weeks later. Videos like these and other forms of misinformation and disinformation serve two purposes: to bolster internal sentiment for an invasion (or justify an ongoing invasion) and distort the narrative abroad. 

As such, it is vital to get your news from trustworthy sources and rely on the advice of local and national leaders as well as your security team to ensure you are getting the facts. As the situation continues to evolve, it is also vital that you are keeping your incident response plans up to date and keeping the lines of communication open both across your organization and between your organization and relevant third parties, such as your managed security services provider (MSSP) and relevant government bodies. 

Consider Adopting Secure Communications Tools

Organizations that are concerned about the security and privacy of their business communications (including eavesdropping, data loss, communications metadata exposure, or non-compliance) should consider increasing communications security or switching to more secure communications tools. Organizations with employees in and around Ukraine should also be aware that those individuals may face communications disruptions.

Encrypted messaging and calling solutions like Element and Wickr are ideal for low-bandwidth environments and can be used to enhance the security of your everyday communications as well as work as out-of-band communication channels during incident responses. They can also be used to provide traveling executives with improved communications security. If you are concerned about the security of your current in-house communication tools or are looking to replace them with a more secure option, your managed security services provider can help you make the right choice for your organization. 

Build Out Your Incident Response Ranks

Small and medium-sized organizations often don’t have the resources to support a full, in-house cybersecurity team, which is why many choose to partner with an MSSP. A good MSSP can help you augment your in-house security team, provide employee cybersecurity training, and help you evaluate your current cybersecurity position and incident response plans. 

Should an incident occur, your MSSP can help you respond effectively (mitigating, or even eliminating, damage), conduct a thorough investigation into the root cause of the incident, and help you prepare any reports required for relevant legislative bodies (such as GDPR, HIPAA, or CCPA).

Safeguard Your Endpoints & Practice Good Software Hygiene 

Safeguarding your endpoints (smartphones, laptops, and tablets that have access to your network) and hosts (such as networks) is vital. Endpoint detection and response (EDR) involves using tools and solutions to detect, investigate, and mitigate suspicious endpoint and host activities. Unlike traditional anti-virus software, EDR isn’t reliant on known behavioral patterns or malware signatures, allowing it to quickly and easily detect new threats. Depending on the nature of the threat it has detected, EDR is also designed to trigger an adaptive response (much like your immune system springing into action).

One of the easiest yet most critical steps any organization can take to improve their security posture is to keep all their software up to date. When software developers discover vulnerabilities in their products, they release patches to address them. Cybercriminals often target recently patched software in the hopes that not all organizations have been as diligent as yours about installing new security patches. Installing patches takes a few minutes, and the process can often be automated and scheduled so that patches are installed during non-business hours to completely eliminate downtime. 

Take Proactive, Preventative Steps Before an Incident Occurs

As the old saying goes, the best defense is a good offense. By being proactive and shoring up your cybersecurity defenses before an incident occurs, you stand a better chance of mitigating or even eliminating damage. Regular pen (penetration) testing, which involves hiring an ethical hacker to stress-test your defenses and search for vulnerabilities, can help highlight security deficiencies so they can be addressed before a cyber attacker is able to exploit them.

Investing in ongoing cybersecurity training is also critical: Employees who can’t identify potential threats are more likely to fall for things like phishing scams, and employees who don’t know how to respond to an incident won’t be able to respond effectively. As such, it is critical that you review your incident response plans regularly and make sure all relevant stakeholders are kept up to date.

You may also want to consider running tabletop scenarios. Tabletop scenarios work like cyber incident fire drills: Your team is presented with a hypothetical scenario and asked to respond, allowing them to put their cybersecurity training to use in a no-stakes environment. Tabletop scenarios not only familiarize your employees with potential threats and help them hone their response skills, but they are also a great way to identify and address security gaps before they can be exploited. 

Concerned About Your Cybersecurity Stance? VirtualArmour is Here to Help!

The situation in Ukraine has put many organizations on edge, and trying to figure out how to shore up your organization’s cybersecurity defenses against cyber conflict may be overwhelming. Fortunately, the VirtualArmour team is always here to help.

We offer a variety of security solutions, including:

• Managed SIEM
• Managed Infrastructure and Firewall
• Vulnerability Scanning
• SOCaaS

We also offer tailored services à la carte, allowing you to pick and choose the services your organization requires to create your own premium services package or essential services package. We also offer personalized, one-time expert consults.

We have extensive experience working with organizations in a variety of highly-specialized industries, including energy, finance, healthcare, and retail, and are well-versed in the unique security and IT challenges faced by service providers. With offices in both Denver, Colorado, and Middlesbrough, England, we are able to offer live, 24/7/365 monitoring and industry-leading response times. 

Our team of experts can help you assess your current cybersecurity posture and create or update your incident response plans. We also provide cybersecurity training through our VirtualArmour Academy. For more information or to get your free, no-obligation quote or free cyber risk report, please contact our team today.

Suggested Reading & Useful Links

The Cybersecurity Situation in Ukraine

The situation in Ukraine is constantly shifting, and it can be hard to stay up to date and get the facts your team depends on to best inform your cybersecurity posture. To help you get the information you need, we have compiled a list of links to relevant organizations below. 

The United States

• Cybersecurity and Infrastructure Security Agency (CISA) offers general cybersecurity advice and cybersecurity warnings and updates regarding the situation in Ukraine.
• InfraGard is a partnership between the FBI and members of the private sector designed to protect critical American infrastructure. Registration is required to join, and there are application requirements that must be met for membership.  

Europe

• ENISA (the European Union Agency for Cybersecurity) offers advice on a variety of cybersecurity-related topics. 
• In Germany, the BSI (Federal Office for Information Security) has released several cybersecurity warnings related to the situation in Ukraine. Current security warnings (in German) can be found here. 

The United Kingdom

• The National Cyber Security Centre offers advice and guidance on a variety of cybersecurity topics, as well as specific advice targeting organizations with an interest in UK Critical National Infrastructure.
• Organizations operating in the United Kingdom should review information provided by NCSC’s Critical National Infrastructure hub.

Australia

• The Australian Cyber Security Centre (ASCS) has issued a cybersecurity alert related to the ongoing Russian invasion of Ukraine. Concerned organizations can also register to receive security alerts from ASCS here. ASCS also offers general cybersecurity advice for small and medium businesses and critical infrastructure organizations.

Educational Articles from VirtualArmour

Cybersecurity is a complex and continually evolving field. To best safeguard your organization and its digital assets, it’s important to stay up to date. 

To learn about the latest news and developments in the cybersecurity sphere, please consider visiting our Articles and Resources page and reviewing the educational articles listed below.

Cybersecurity Basics For All Organizations

• Hacked? Here’s What to Know (and What to Do Next)
• Building a Cybersecurity Incident Response Program
• Terms and Phrases Used in the Managed IT and Cybersecurity Industries
• The SMBs Guide to Getting Started with Cybersecurity
• Cyber Hygiene 101: Basic Steps to Keep Your Company Secure
• Identifying a Breach: Finding Indicators of Compromise (IOC)
• Making Sense of TTPs, Cybersecurity, and What That Means for Your Business
• The Shift From Cybersecurity Being a Want to a Need Just Happened
• What is a Managed Services Security Provider (MSSP)?
• What Your Vulnerability Scan Report is Telling You (and What It’s Not)
• What is the Difference?: MDR vs EDR

Cybersecurity Basics By Industry

• Cybersecurity Basics Every College and University Needs to Have in Place
• Case Studies & Services: Health Care
• The Ultimate Guide to Cybersecurity in the Healthcare Industry
• The Rising Cost of Healthcare Industry Data Breaches
• Case Studies & Services: Finance
• How the Financial Industry Can Strengthen Their Cybersecurity
• Case Studies & Services: Retail
• Case Studies & Services: The Energy Sector 
• Case Studies & Services: Service Providers
• Cybersecurity for the Manufacturing Industry, What You Need to Know

Minimizing Your Risks

• What Are the Risks of Using Unsupported Hardware?
• The Ultimate Guide to Managed Threat Intelligence (2020 Edition)
• Airports are a Hacker’s Best Friend (and Other Ways Users Expose Themselves to Risk)
• Keeping Your Network Secure in a “Bring Your Own Device” World
• Basic Website Precautions: Keep Intruders Out with these Fundamental Security Best Practices
• What is Cybersecurity Insurance and Does Your Business Need It?
• What Your Business Can Learn From Netflix About Credential Sharing

Common Threats (and How to Avoid Them)

• The Modern Hacker: Who They Are, Where They Live, and What They’re After
• The Growing Trend of “Hacktivism”, and What it Means for Businesses
• In a Remote World, Social Engineering is Even More Dangerous
• Hackers Are Increasingly Targeting People Through Their Phones
• How Fear Motivates People to Click on Spam
• Ransomware is Only Getting Worse: Is Your Organization Prepared to Confront it?
• Everything You Need to Know About Ransomware (2019 Edition)
• 5 Old-School Hack Techniques That Still Work (and How to Protect Your Data)
• DNS Spoofing: What It Is and How to Protect Yourself
• Don’t Let Phishing Scams Catch You Unaware
• Cryptojacking: Because Every Currency Needs to Be Protected
• Why Your Company Could Be the Next Equifax or CapitalOne