The Cyber Guys: Are we going to have a catastrophic cyber event in 2024?
What would happen to the country if most of the internet went down for a day?
In January 2023, the World Economic Forum released a cybersecurity report that found 93% of cyber leaders, and 86% of cyber business leaders believe geopolitical instability makes a catastrophic cyber event likely in the next two years. Nation states may focus on cyber warfare to accomplish their objectives rather than kinetic alternatives.
With major wars going on in Gaza and Ukraine, that could look like an attack on critical infrastructure as a response to American policy in either region. On a small scale, this has already happened. In November the federal Cybersecurity and Infrastructure Security Agency revealed hackers had breached computers at “less than 10” water facilities in different parts of the United States. U.S. and Israeli authorities issued an advisory confirming that hackers had “accessed multiple U.S.-based” water facilities that operate Israeli-made equipment, likely by breaking into internet-connected devices with default passwords.
The U.S. and Israeli government agencies blamed hackers affiliated with the Islamic Revolutionary Guard Corps, a military branch of the Iranian government, for the activity.
In December the Jerusalem Post reported a significant cyberattack that impacted Israeli emergency services. Cyberattacks on critical infrastructure, such as emergency services, can result in response time delays, compromised communication systems, and even the loss of sensitive data. These attacks not only put lives at risk but also have far-reaching societal and economic implications.
The hacking goes both ways. A hacking group previously linked to Israel, known as “Gonjeshke Darande” or “predatory sparrow,” claims it took down 70% of the gas stations in Iran by gaining access to the payment systems.
But geopolitical instability is not the only threat in cyberspace. The WEF conducted cybersecurity scenario simulations in 2020 and 2021 called Cyber Polygon. In the 2020 exercise, it predicted the world would experience a “digital pandemic.” There could be a virus that mass-infects internet-connected devices similar to how the coronavirus mass-infected the physical world. In the case of a “digital pandemic,” the infection would spread so much faster the only answer might be to remove devices from the internet so they don’t get infected — effectively shutting down the internet for a time.
The 2021 Cyber Polygon exercise focused on an attack on third-party supply chains where major organizations were “collateral damage” of the attack. For example, in February 2022, a cyberattack on commercial satellite services in Ukraine caused electricity-generating wind farms to shut down across central Europe. In July 2021, supermarkets in Sweden were forced to close their doors after a cyberattack on IT services provider Kaseya, based in Florida.
But wait, there’s more! Cybercrime has become big business. Cybercrime is expected to grow from $3 trillion in 2015 to $10.5 trillion in 2025. Crime ranges from phishing emails looking for $100 Amazon gift cards, to social engineering of crypto wallets producing millions, to ransomware that affects small town business and huge multinational businesses alike.
As a business owner, what can you do to protect yourself? Are you doomed?
Of course not, you can set up a defense-in-depth strategy to protect your data. Change the default passwords on all your devices. Use good password hygiene. Set up multi-factor authentication on your systems wherever you can. Back up your data. Implement application whitelisting that allows only approved applications to run. Train your employees how to identify malware and social engineering schemes. Have a Business Associate agreement in place. Create an incident response plan in case of a cyber incident and develop a disaster recovery plan in case you lose access to all your data.
If a catastrophic event does occur in 2024, you can survive and thrive if you properly prepare. Want to learn how? Ask the Cyber Guys from CyberEye.