Everyone who has ever been online is likely aware that cyberattacks can target individuals. You only need to follow the news to know that they can also target businesses – both small-to-medium-sized enterprises and giant corporations. But how about the prospect of a cyberattack successfully targeting entire countries?
Instead of the more conventional modes of warfare, cyber attacks leveled against countries – called cyber warfare – are becoming increasingly commonplace. And while these might not involve troops on the ground, bombs, missiles, or any of the other components associated with warfare, they nonetheless have the potential to disrupt critical systems, cause considerable damage, and maybe even lead to loss of life.
There are multiple examples of such attacks, which target critical infrastructure. As such, they blur the line between attacks on companies and direct attacks on nations – by hitting infrastructure that’s of crucial importance to the wellbeing of nations.
Cyber Warfare in Action
One illustration of such an attack took place in May 2021. That was when Colonial Pipeline, a U.S. pipeline system carrying jet fuel and gasoline to the Southeastern United States, was the victim of a ransomware cyberattack. The Colonial Pipeline Company was forced to stop the entire pipeline’s operations in order to contain the cyber attack. In the end, it agreed to pay a multimillion-dollar ransom to restore operations. And, of course, that took a lot of time to do.
Another recent example of such a cyber attack was one targeting the Oldsmar, Florida water treatment center in February 2021. In this instance, attackers used remote access systems controlling the network belonging to the water treatment plant to alter the chemical mix that entered the water. They attempted to massively increase the quantities of sodium hydroxide in the water, which would have made it potentially hazardous to drink. Fortunately, an employee became aware of the alteration and was able to revert it prior to it causing any harm.
Depending on who launches such attacks, they could be viewed as representing the ultimate form of asymmetric guerilla warfare. That’s a small group of individuals, perhaps just one or two people, instigating damage that could affect hundreds, thousands, or even millions of people.
Cyber Attacks Are Bigger Than Ever
However, it’s not always just small groups of hackers responsible for these attacks. In the first successful, publicly acknowledged cyber-attack to have targeted a power grid, a December 2015 attack on the Ukraine power grid hack left approximately 230,000 people in Ukraine without power or with regular power outages for several hours. This incident occurred during the Russian military intervention in Ukraine and is reported to have been the result of a Russian cyber-military unit known as Unit 74455 or the Sandworm Team.
At face value, the idea that it’s possible to disrupt an oil pipeline, a water treatment plant, or a power grid may seem strange. After all, these are physical pieces of infrastructure – rather than websites or online services that are more frequently the target of cyberattacks. But in an age of connected infrastructure, the overwhelming majority of infrastructure, physical or otherwise, can be controlled remotely using connected technologies.
For example, in the case of Colonial Pipeline, the pipeline itself used various valves, pumps, thermostats, pressure sensors, and other “smart” pieces of technology to control the flow of jet fuel, diesel, and petrol through the vast lengths of pipes. This opens up the possibility of them being hacked – with the possible results ranging from espionage (monitoring information and potentially exfiltrating sensitive data) to sabotage (as seen in the Oldsmar water treatment center scenario).
Putting the Right Defenses in Place
Cyberwarfare attacks such as this are only going to become more commonplace. It’s imperative that organizations and governments alike protect themselves and their assets against the threat of cyber warfare. Simulated wargames can help highlight weaknesses and train government and private organizations for how they would act in the event of an attack on critical infrastructure.
They should also make sure that they are utilizing the best possible tools for safeguarding these assets from would-be attackers. Furthermore, getting cyber insurance is crucial for organizations. Whether or not you’re actively involved in procuring or extending your cybersecurity insurance coverage, the solutions that come together to create a robust zero trust strategy are security best practices. Rooted in identity and access management (IAM), zero trust requires identity management, authentication, access management, and continuous monitoring to create checkpoints, requiring authorization and authentication at the access point of applications containing sensitive data.
In the same way that the method of attack favored by bad actors (including nation states) continues to change and develop, so too do the defenses that can help protect against them. However, by seeking out the right cyber security expertise and guidance, it’s possible to put in place the right protections so that the risk of successful attacks can be greatly minimized.
The twenty-first-century wars will increasingly be fought digitally in the online arena – with the effects of these attacks spilling over into the real world. It’s critical that this threat is taken seriously. Failure to do so, and the results could be disastrous.
