Changing dynamics of Cyber threat

• Cyber attacks have come to be assessed as dangerous as terrorism a short time after their introduction.
• Many other instances warned that the world had to prepare for a kind of ‘cyber Pearl Harbour’, highlighting a new era of potential vulnerabilities.

Present scenario

• Despite an increase in cyber threats every year, there is no change in the method of response.
• In 2021, major cyber attacks were SolarWinds and Colonial Pipeline in the U.S., but these were merely among the string of attacks that plagued the world.
• Cost estimates to the world in 2021 from cyber attacks are likely to range between $3trillion-$4 trillion.
• If this trend continues, cyber crime damage costs would become more profitable than the global trade of all major illegal drugs combined.

Vulnerable sectors

• Major threats in the present information age- Credential threats, data breaches, phishing, ransomware attacks, IT outages.
• Results are also likely to be more severe than the damage stemming from the COVID-19 pandemic or any natural disasters.
• Most targeted sectors - health care, education and research, communications and governments.
• Health-care ransomware attacks cause longer stays in hospitals, apart from delays in procedures and tests, resulting in an increase in patient mortality.
• No organisation can possibly claim to be completely immune from cyber attacks.
• Preventive and reactive cyber security strategies are proving to be highly illusive in an increasingly hyper-connected world.
• Ransomware criminals are becoming more sophisticated, and are using ransomware to cripple large enterprises and even governments.
• Talk of the emergence of ‘Ransomware as a Service’ (RaaS) — a business model for ransomware developers — is no mere idle threat.
• Increasing trend of work from home, dictated largely by the prevailing novel coronavirus pandemic is likely to further accelerate the pace of cyber attacks.
• Also, a tendency to put everything on the Cloud could backfire, causing many security holes, challenges, misconfigurations and outages.
• Even as Identity and Multifactor Authentication (MFA) take centre stage, Advanced Persistent Threats (APT) attacks are set to increase, with criminal networks working overtime and the Dark web allowing criminals to access even sensitive corporate networks.

Inclarity over cyber protection measures

• Despite the talks among cyber security experts about emerging cyber security technologies and protocols, there is a little clarity whether what is available can ensure protection from all-encompassing cyber attacks.
• Technology geeks, therefore, insist on every enterprise incorporating SASE — Secure Access Service Edge — to reduce the risk of cyber attacks.
• Other solutions proposed to limit the risks to users from web-based threats:
• CASB — Cloud Access Security Broker
• SWG — Secure Web Gateway
• Zero Trust - puts the onus on strict identity verification ‘allowing only authorised and authenticated users to access data applications’, but it is not certain how successful this and other applications will prove to be in the face of the current wave of cyber attacks.

Challenges

• Misplaced effort by the West in preparing for a ‘potential Pearl Harbour type of strike’
• No attempt to devise standard methodologies.
• West focuses on ‘militarization’ of the cyber threat resulting in loss of valuable time.

Solutions

• A detailed study of low- and medium-level proactive cyber attacks during the past decade is clearly warranted.
• A low and medium tech, low and medium risk targeted operations could be just as effective.
• Individual companies should be prevented from attempting their own tradeoffs between investing in security and maximising short-term profits.
• Corporate protection and defence that could have huge external costs for national security, as evident in the SolarWinds attack, should be substantiated.
• Nations and institutions should actively prepare for a rash of cyber attacks.
• The emphasis should be on prioritising the defence of data above everything else.
• Law enforcement agencies can also play a vital role in providing effective defence against cyber attacks.
• There should be ‘planning and training for network failures so that individuals could adapt and continue to provide service even in the midst of an offensive cyber campaign’.

Way forward

• The focus should be on:
• prioritising building trust in systems- electrical grids, banks etc.
• creating backup plans including ‘strategic decisions about what should be online or digital and what needs to stay analog or physical,
• building capacity within networks to survive’ even if one node is attacked.
• Failure to build resilience at both the ‘technical and human level will mean that the cycle of cyber attacks and the distrust they give rise to will continue to threaten the foundations of democratic society’.
• Preventing an erosion of trust is critical in this day and age.