Preparing your organization for elevated cyber threats posed by geopolitical conflicts

Whether an intended target or not, damage to an organization’s data, infrastructure, and reputation can be significant. Beyond cyber attacks that are aimed at disrupting system availability and integrity, there is also the risk of disinformation campaigns, which can impede society’s coordination in response to threats. The intent of these cyber attacks—typically denial of service attacks (DoS) and malware (although a variety of tactics may be leveraged)—can be to cause panic, confuse, and distract from the broader geopolitical situations and, in some cases, impede the ability to respond to these situations effectively. For example, cybercriminals may see geopolitical conflict as an opportunity to take advantage of the public’s fears—aimed at psychological, political, physical safety, and/or economic concerns—and need for information by executing targeted cyber warfare campaigns. Similarly, opportunistic adversaries may exploit a desire for information to launch targeted phishing campaigns to extract sensitive personal and financial information.

To adequately respond and protect both commercial and government organizations, cybersecurity leaders and their support teams should consider probable types of attack; potential intended targets; threat actors including copycats or counteragents; and possible tactics, tools, and procedures (TTPS) as well as normal network activity patterns¹. That baseline information can provide the foundation of data in order to prepare for and identify potential future assaults and may act as precursors to other forms of business disruption. While protection and prevention are critical components, cybersecurity and business leaders should also proactively collaborate to prepare for a security event from a sophisticated nation-state style adversary. Bolstering crisis response practices, including preparing to act decisively in an uncertain environment and to communicate with law enforcement, is essential to prepare for cyberwarfare threats.

Attack Indicators

Security teams and business leaders should be on the lookout for signs that your organization may be experiencing a cyber attack. Some common symptoms of attack may include:

• Slower than normal internet speeds due to a spike in external network traffic, or higher than normal internal traffic leaving your network
• Files have been unexpectedly encrypted, blocking your access to them, or they are missing altogether
• New programs running, security programs turning off or reconfiguring themselves, previously stable applications crashing suddenly
• New toolbars or extensions that haven’t been installed by the user/organization
• Excessive antivirus warnings or antivirus logs missing
• Login issues, such as: password changes unexpectedly, accounts locked after excessive login attempts, accounts logging in at strange times or from strange places
• Increased number of phishing emails/scams/emails from external senders
• Customer or vendor complaints or disruption

While these patterns are useful indicators, it is also critical to consider other enterprise risks that could impact security posture—for instance, supply chain and vendor disruptions from global or multi-national operations are possible and may influence normal traffic patterns or crisis operating procedures. These factors require significant strategic executive engagement to keep security and risk indicators in lockstep so that organizations can be ready to respond effectively to attack.

Takeaways for executives

Leaders can build (and retain) trust in times of crisis, navigate the organization through multifaceted risk, protect the enterprise from adversaries, ensure resiliency, and provide vision to navigate uncertainty in this crucial moment in history. Acknowledging the threat and taking steps to prepare and protect your enterprise are critical, as well as establishing proactive lines of communication with government and law enforcement.

• Things are not business as usual – there is heightened risk of nation-state attacks and opportunistic penetration of security defenses; executive leaders and boards should be actively engaged in monitoring the situation, resourcing security functions appropriately, and information sharing with industry and law enforcement
• Protection will require elevated vigilance, which requires rapid tuning of technical defenses as well as proactive communication and stakeholder engagement. Employees are likely to experience attempted attack and can be a resource in early detection and prevention
• Incident and crisis response playbooks may be impacted by global and multi-national supply chain disruptions – updating and executing playbooks, tuning security tools, and reinforcing awareness can help fortify security defenses for more resilient programs in the longer term
• Offensive skillsets and experiences of security teams are critical to operate in cyberwarfare – many cyber operators have not had extensive simulation experience (or formal training in adversary engagement); continuing to evolve learning and development opportunities for cyber teams and related business functions will be required to keep pace with modern threats
• Sharing intelligence proactively with peers, government, and industry is critical to collective strength of our defenses – updating security protections to reflect IOCs and rapidly addressing vulnerabilities is critical

Information sharing is imperative to collective protection during this time. To stay up to date on the latest threat intelligence, Deloitte Risk & Financial Advisory is offering access to its threat intelligence portal and bi-weekly threat briefings at no cost to our clients. For more information, please contact detectandrespondportal@deloitte.com.