Bouncing back from a cyber attack

You could argue there's always something an organisation might have done better to dodge a cyber attack. 

Networks and devices need to be secure by design. But even then, there are still too many projects taking place where secure by design isn't considered, known, or understood as a concept. There may be projects which are considered secure by design, yet the designer does not fully grasp the principles of securing a specific network media, for example the intricacies of securing wired versus Wi-Fi or radio frequency (VHF/UHF) based networks.

While there's an appreciation of the fundamental importance of security in IT, that can't always be said of operational technology (OT). The security posture of OT and IoT systems are going through the same pains IT did 20 years ago of building these skills and understanding, often from scratch. 

The Asia-Pacific (APAC) region is on the pulse of IoT adoption with spending expected to reach $437bn by 2025. Big tech, car manufacturers, consumer electronics, and even healthcare providers are aggressively pushing smart devices, and for good reason. There are infinite benefits for consumers and businesses alike with the efficiency and support, real-time visibility and action networked devices provide. 

But the millions of new devices joining networks daily is expanding the threat surface area, creating new points of access for hackers to exploit, whether to steal data or use a device as an attack vector or entryway to access other parts of the network. 

In fact, APAC was the most cyber-attacked region last year, making up 31% of global instances. These numbers rendered victim blaming a common occurrence.

A cyber attack, or rather, the act of cyber crime, is still a crime. And while greater involvement and offensive capabilities from law enforcement will support the cause, organisations need to remember when a disaster strikes, it’s about what you do next. 

You could look at it like a customer service issue. If confronted by an unhappy customer, an organisation knows to listen to them, identify a solution, and follow them up to ensure their issue is resolved and doesn’t happen again – this is how you would make good on an issue, and encourage return to business. Alternatively, if none of those efforts are made, disaster will inevitably strike again and again, and force customers to move away from the businesses’ services. 

In the case of a cyber attack, the inconceivable has already happened – all you can do now is bounce back. 

The big picture issue is that too often IoT (internet of things) networks are filled with bad code, poor data practices, lack of governance, and underinvestment in secure digital infrastructure. Due to the popularity and growth of IoT, manufacturers of IoT devices spring up overnight promoting products that are often constructed using lower-quality components and firmware, which can have sometimes well-known vulnerabilities exposed due to poor design and production practices. These vulnerabilities are then introduced to a customer environment increasing risk and possibly remaining unidentified.

So, there’s a lot of work to do, including creating visibility over deep, widely connected networks with a plethora of devices talking to each other. All too often, IT and OT networks run on the same flat network. For these organisations, many are planning segmentation projects, but they are complex and disruptive to implement, so in the meantime companies want to understand what's going on in these environments and minimise disruption in the event of an attack. 

Unlike wired networks, gaining successful and reliable visibility and detection tools for wireless networks in the OT and IoT space is challenging as many products are incapable of operating in the wide frequency ranges used in the OT space. However, there are now tools capable of monitoring a wide bandwidth and detecting malicious wireless traffic and behaviour.