Happy New Year! As we look back at a globally disruptive 2020 how quickly we forget that the year began with the threat of war!
When Iranian military mastermind General Soleimani was killed in a targeted US drone strike in Iraq on January 3 2020 the world truly did hold its breath. Within hours the Iranians were mobilised to retaliate and American forces were put on high alert.
Thankfully, the moment passed, but it revealed our fragility. Within a month the world faced another threat.
A mystery flu virus we had heard was circulating in China quickly spread around the globe. By year’s end COVID-19 would infect about 80 million people worldwide and kill more than 1.7 million people. Economies have been shattered. Unemployment has soared and previously secure businesses have shut their doors.
No-one has been spared: all of us have lost our freedom — forced into lockdowns and curfews and forbidden to travel or see loved ones. Our world will not be the same. The COVID-19 pandemic is the biggest event of 2020, but it is not the story of the year. The world is on a tilt, unsure of itself and more dangerous than it has been in living memory. COVID-19 will fade (or not) but our world will not be the same. It has been said that a pandemic is a social phenomenon with a medical aspect. That’s what we are seeing.
The world was unraveling well before COVID-19, but the virus has revealed its depth and accelerated changes especially in the digital world. COVID-19 has lifted the lid on simmering tensions and fears: racial divisions; deep inequality; loss of faith in institutions; the retreat of democracy and rising authoritarianism. The other big event of 2020, still unfolding, was the devastating SolarWinds cyberattack targeted against top US government agencies and corporations. US officials believe that Russian state-sponsored hackers are responsible. An act of cyberwar is usually not like a bomb, which causes immediate damage. Rather, it is more like a cancer – it’s slow to detect, subtly spreads, difficult to eradicate and causes ongoing and significant damage over time. Here are some points that cybersecurity experts can make so far of the SolarWinds cyberattack:
1. The victims were considered highly secure — From top cybersecurity firm FireEye to the US Treasury and Department of Homeland Security, Microsoft, Intel and many other organisations, the victims of the cyber attack have comprehensive cybersecurity policies and practices in place. SolarWinds estimates about 18,000 organisations were affected. Many have world-class cybersecurity teams. These are some of the hardest targets to breach globally.
2. This was almost certainly the work of a nation state — not criminals: Cybercriminal focus on financial gain. They use techniques like ransomware to extort money from their victims, steal financial information, and harvest computing resources for activities like sending spam emails or mining for cryptocurrency. Cyber attacks on national governments agencies, on the other hand, have entirely different motives. They look for long-term access to critical infrastructure, gather intelligence and develop the means to disable certain industries. They also steal expensive intellectual property.
3. The attack exploited trusted third-party software — The hackers gained access by slipping their malware into software updates of SolarWinds’ Orion software, which is widely used to manage large organisational networks. When users of SolarWinds software automatically updated their systems earlier this year, they unwittingly invited a Trojan horse into their computer networks. Russian cyber attackers have used this tactic before, in 2017. This was during the infamous NotPetya attack, which was considered the most financially destructive cyberattack in history.
4. The extent of the damage is unknown — It will take time to uncover the extent of the damage. The investigation is complicated because the attackers gained access to the victims’ systems in early 2020 when global focus was on the growing COVID-19 pandemic. The cyber attackers had time to infiltrate and hide their access and control of the victims’ systems – deleting logs and other evidence within compromised systems. A large complex cyber breach like this usually spreads laterally to other systems and applications within the network to lie dormant and avoid detection! It may be activated at a future date after the network has been declared ‘clean’!
5. The fallout could include real-world harm — There is a very thin line between gathering information and causing real-world harm. Similar to how spying or espionage can easily escalate into warfare in both the physical and cyber worlds.
No one knows the full extent of the SolarWinds cyberattack, but the scope is large and the victims represent important pillars of the US Government, economy and critical infrastructure. Information stolen from those systems and malware the hackers have likely left on them can be used for follow-on attacks.
I believe that the impact of the SolarWinds cyber attack has been deliberately understated because of the more important underlying issue of how trustworthy are the information systems of these compromised government agencies and organisations in future?
The US and its allies are, of course, engaged in similar cyberoperations. They are active participants in various cyberconflicts that rage, largely unseen and unacknowledged, across the digital world.
The NSA and CIA exist to break into foreign information systems and steal secrets, and they are extremely good at it. They, along with the defence department, regularly use cybertools to access intelligence from foreign servers across the world and to place foreign information systems and critical infrastructure at risk. Cyber attacks are more effective weapons than bombs and missiles.
The Snowden leaks revealed the sophistication and extent of capabilities attributed to the US. As solid as the US cyberoffense is, the defence leaves much to be desired demonstrated by recent disasters, including the hacks of SolarWinds, the Office of Personnel Management, Equifax and Sony. The reality is that the US Government and private companies both under-invest in cybersecurity.
Effective defense is a collective effort, but agencies and companies individually are often clueless when it comes to countering the sophisticated cyber attacks by nation states such as Russia and China.
The SolarWinds cyber attack removes the notion that the US possesses a monopoly on cyberweapons and sophistication. Even though US federal agencies do possess some of the greatest cyberespionage and warfare tools and talent on the planet, the playing field is disturbingly even.
Unlike nuclear weapons, or even sophisticated conventional arms, powerful cyberweapons are cheap to produce, proliferate with alarming speed and have a disregard for borders. Unable to match the US in military spending, Russia, China, Iran and even North Korea view cyberweapons as a great equaliser.
Why? Because the US is extremely vulnerable to cyberattack: the US is more reliant on financial, commercial and government networks than their adversaries, and, at the same time, their systems are frighteningly more open and vulnerable to attack.
Unlike conventional wars, you cannot withdraw troops from the battlefield. For the indefinite future, adversaries will test cyber defenses, attack networks and steal information.
In this respect, cyberconflict is more like fighting a disease than fighting a war, an ever-mutating disease with intent, and for which no vaccine exists!
Effective national cyberdefense requires corporate engagement, intelligence sharing and trust. Neither the government nor private sector can succeed on their own.
Companies and agencies, particularly those providing software services and critical infrastructure, must be held more accountable for cybersecurity lapses that place us all at risk.
Even in the face of perpetual cyberconflict, we should be prepared to sit down and talk with our cyberadversaries.
It is hard to imagine a comprehensive agreement on cyberconduct that any country would abide by, or even trust others to follow, however, lessons learned from the cold war and nuclear arms race, diplomacy is probably the only path to ensure a more secure future.
A good place to start might be on the potentially most destabilising and destructive cyber attacks e.g. attacking nuclear command and control systems, or global financial infrastructures that could disrupt national economies causing global recessions.
In the meantime, until some law and order is negotiated in the cyberspace-Wild West, it’s time to better defend our digital homelands and pray that cooler heads will prevail.
It is a new digital world we have entered this New Year, wishing you all blessings and stay safe in both physical and digital worlds
