Work in cybersecurity long enough, and you’ll notice how awash this space is with F.U.D. Fear, Uncertainty, and Death. It’s a natural enough place for the industry to gravitate towards– there’s a lot of fear out there and it’s an easy way to market security. But sometimes events in a point in time warrant some F.U.D. If you’re worried about cybersecurity, now would be one of those times.
Unfortunately, this week diplomatic efforts failed and Russia has invaded Ukraine. Aside from the tragic loss of life and political consequences for Ukrainians, Russia has also unleashed its cyber warfare capabilities, crippling critical infrastructure in Ukraine and bringing the necessities of everyday life to a standstill. Russia has also vowed to retaliate against any sanctions and interference from the West.
Most news outlets and talking heads have been focused on Russia’s ability to attack and disrupt essential systems like the American power grid and other utilities—which would no doubt be devastating. The thing is though…systems like that are obvious targets, which is why it may be unlikely that they’ll be attacked. First, any attack on the power grid or banks—even by a technically non-state actor like the Russian-affiliated Fancy Bear organization—would almost surely be considered an act of war. And while it might disrupt American life, it would also almost certainly galvanize the American public into demanding action. Political inaction and hand wringing would simply not be an option, and it would risk a dangerous military escalation that could easily spiral out of control. And secondly, American defenders are well aware of the vulnerabilities in these systems, and are likely taking steps to harden them.
Think about it this way. Why put the time and effort into trying to crack some of the most hardened and observed systems in the world when there are literally hundreds of thousands of small- and medium-businesses powering the consumer economy running unpatched endpoints and out of date operating systems, offering unprotected WiFi open to all and any, and for whom security is not their first priority.
In military parlance, these businesses are called targets of opportunity. Individually they aren’t catastrophic and almost nobody would notice. But if enough of them go down, it starts to add up. The fear among cybersecurity experts is that we could see a repeat of the NotPetya malware that was unleashed against Ukrainian targets (likely by Russia) in 2017 but then spread globally.
Just because your business might be small or in a non-essential industry doesn’t mean it’s safe. Everything from a regional paper company in Pennsylvania to a neighborhood coffee shop in California could be a target. Organizations of this size typically don’t have the resources, budget or perceived need to invest huge sums of money and time into best-of-breed security programs. Even medium-sized companies often underinvest in security unless they’re in a heavily-regulated industry or there’s a perceived need for it. Realistically, for most companies security isn’t top of mind when you’re just trying to clear operating expenses. So unless it’s vital to securing new business, most small or medium businesses typically rely on safety in anonymity and a faith that the digital vendors they use are secure and prioritizing security.
There’s a certain logic to this, but it’s also potentially a recipe for disaster in the modern era when the battlefield extends into the digital realm. So are we saying that every coffee shop or small business with a WiFi router and a Square terminal needs to go out and hire a security expert? Or that medium-sized businesses need to immediately invest their entire operating budget into building a full Security Operations Center?
No. Not at all.
But there are simple and relatively easy things that every business owner or mid-market security team can do that will drastically reduce their risk, especially if it’s made part of a regular routine. For additional guidance, see theShields Up guidance from the U.S. Cybersecurity Infrastructure & Security Agency (CISA).
Have a response plan. If you’re the unfortunate instance of a cybersecurity incident, does your organization have a response plan in place? If so, excellent. Now is the time to review it and make any adjustments necessary. If not, now is the time to think about how you’ll respond. Who needs to be notified? What actions need to be taken? Should customers be notified and who will handle that? How will you determine what?
Check out this guide from CERT for small and medium businesses for more information.