PARTNER
Strengthening cybersecurity in an era of global tensions and conflict
By Ming En Liew
GovInsider sits down with two cyber experts ahead of GovWare 2022 to find out how events like the Russia-Ukraine war are impacting the cyber landscape today, and what can be done about it.
The Russia-Ukraine War and Covid-19 pandemic has ushered in a new era of cyber attacks characterised by a fragmented landscape and increased vulnerability. In light of this, cyber experts emphasise a need for information sharing for a cyber resilient future. Image: Canva
“This is a new era…the scale of the use of cyber as a means of warfare is unprecedented,” adds Vincent de Crayencour, Chief Business Development and Strategy Officer at non-governmental organisation CyberPeace Institute. The Institute was established to reduce the harms from cyberattacks on people’s lives, provide assistance to vulnerable communities, and call for responsible cyber behaviour and accountability, according to Crayencour.
Even critical civilian infrastructure is not off limits in the proliferation of cyber attacks, he says, referring to a rise in attacks on energy production and distribution, information and communication systems, as well as transportation networks. In September alone, three attacks on nation-states were reported, disrupting Albania’s border systems, Sweden’s elections, and the Japanese government website.
These come on the heels of the Covid-19 pandemic, which has accelerated the increase of sophisticated cyberattacks that have caused major damage and costs to all economic actors, Crayencour says. Currently, the impact of the Russia-Ukraine war has also extended to cyberspace, and is rippling beyond the two nations.
Crayencour highlights a cyberattack that happened on the day of Russia’s military invasion of Ukraine (24th February 2022), which disrupted internet services for countries throughout Europe. A cyberattack targeted global communications firm Viasat, disabling internet access for users across the region, some of which ended up without internet for over two weeks.
In France, nearly 9,000 subscribers of a satellite internet service were deprived of internet access, while around a third of 40,000 subscribers of another satellite internet service provider in Europe (Germany, France, Hungary, Greece, Italy, Poland) were affected. Corporations too faced disruptions, as a major German energy company lost remote monitoring access to over 5,800 wind turbines.
So far, the war has seen 33 countries affected by related cyberattacks, according to data from the CyberPeace Institute. This includes different sectors of critical infrastructure, including transportation, public administration and the financial sector.
An increasingly fragmented landscape
“These events and the usage of attacks on critical infrastructure during geopolitical tensions is just showing that you can trust nobody,” says Dr Mikhaylov. As a result, the cyber industry is becoming increasingly fragmented.
“Each country and bloc wants to be completely isolated,” he says. “Big companies that belong to the government try to take control of the supply chain, and be completely sure that they can trust each single byte of code that they have.”
But cyber issues have no international borders, said Juliette Wilcox CMG, Cyber Security Ambassador for UK Defence and Security Exports, Department for International Trade, United Kingdom, during an interview with GovInsider. “If there’s a vulnerability in any one country, it infects others very quickly, including those who are not connected in any way except for a bit of software link.”
Additionally, such fragmentation will only hurt the industry, he says. “Exchange of knowledge always makes the products better,” he explains, without which, organisations end up spending more resources to polish their cybersecurity products.
To address this, Dr Mikhaylov suggests taking an open source approach instead. Open source software comprises a source code that is publicly available for anyone to inspect, modify, and enhance. This approach will make the software more secure for everyone, as the community is able to check the software in question and enhance it as necessary.
At the moment, he suggests that there is a lack of international oversight for such open source programmes, which hinders their development and uptake. He is proposing for international bodies like the United Nations to play a larger role in promoting these, similar to how they take a vested interest in managing sectors which transcend national interests, like nuclear technology.
For instance, in October 1956, 81 nations unanimously approved the International Atomic Energy Agency’s Statute, which lays out the Agency’s function to promote the safe, secure and peaceful development of nuclear technologies.
“The more committees there are with an open software approach…the more codependence exists, and the stronger the software developed,” Dr Mikhaylov says.
Open source software can also improve the cyber resilience of the world as a whole, he adds, as countries that may lack the budget or resources to develop their own cybersecurity programmes can now draw on the knowledge of others.
Holding threat actors accountable
To ensure accountability, Crayencour believes that countries should look into sharing knowledge and data on cyber attacks.
Documenting such attacks is crucial to informing future action. It can help nations identify ways to clarify the law in relation to the use of cyber in armed conflicts, and to promote accountability in judicial proceedings in response to such attacks, Crayencour says.
In the hack of IT provider Solarwinds, for example, the organisation came out to share the vulnerabilities that eventually led to the breach. This information then urged them to strengthen their cyber posture through a security-by-design approach, and saw many others in the industry following suit, reported GovInsider.
Besides organisations, governments too play a role in holding responsible actors accountable, says Crayencour. This can be exemplified by governments issuing condemnatory statements or sanctions in response to cyber attacks by other nation states, much like how the United States and the United Kingdom condemned Russia for cyber attacks against the country of Georgia in 2020.
As cyber attacks continue to increase in both frequency and complexity, Crayencour emphasises the importance of examining the costs first and foremost in human terms as opposed to financial ones. If left unchecked, cyber threats can cost people their lives, health, and livelihoods.
“This would and should more strongly influence the investments [in cybersecurity] to ensure people are at the centre of the response needed, recognising the importance of funding and supporting cybersecurity resilience, especially to vulnerable communities,” he says. “We must make it understood that cyber is about people, not technology.”
Vincent de Crayencour and Dr Dmitry Mikhaylov will both be participating in a panel titled ‘Tech Talk: Evolving Impact of Global Tensions and Conflict’ happening from 4pm to 4:45pm on 18 October at Level 1, Exhibition Hall, Sands Expo and Convention Centre, with Crayencour moderating the panel.
Crayencour will also be speaking at 3pm, in a session titled ‘Tech Talk: Cyberattacks in Time of Conflict: The Case of Ukraine’.
Keen to hear from them but have yet to reserve your slot at GovWare? Do so now through the link here!
This article is published in partnership with GovWare 2022.