CS1907

cyber espionage
a "sobering story" that demonstrates how
wide the scope is when we talk about nation
state cyber-attacks. "The temptation is to
think of one government's agency fighting
another," he says. "However, as this story
demonstrates, the reality is that the
battlefield extends beyond that to businesses,
public services and other organisations. In
this case the Post Office, local government
and banks are the victims that were caught
in the crossfire.
"This attack also shows that we need to
change awareness of what constitutes critical
infrastructure. Again, we are not just talking
about the energy sector, communications
and industrial organisations. Threat actors
will also target the economy and, if a largescale
attack is launched against the UK's
banks, you can bet the situation will quickly
become critical. The government has a
responsibility to ensure a good standard of
security and defence across all major
organisations to safeguard the UK."
MASSIVE INVESTMENT
Andy Barratt, UK managing director of
cybersecurity consultancy Coalfire, argues
SOFTWARE: A SOFT TARGET
that Iran's effort to steal sensitive data from
UK public sector organisations "is another
example of a surge in nation-state backed
cyber espionage in recent years". Even a
cursory look at the cyber strategies of
countries around the world - both in Asia
and the West - shows that there is massive
investment in offensive digital capabilities,
he points out.
"It's interesting that Iran is seeking to extract
data, rather than bring down core
infrastructure like other nation-state attacks
have done - North Korea's WannaCry hack,
for example, brought parts of the NHS to a
standstill. It's possible that Iran is being
careful, given the West's penchant for
military activity in the Middle East. But it's
also possible that this was an intelligencegathering
exercise to collect the data needed
for more targeted espionage in the future."
Public sector employees are a good target
for accessing data, if the end goal is to access
government infrastructure, he warns. "The
attack costs are relatively low and a huge
database of potential targets can be built up
quickly."
David Atkinson, Senseon: the battlefield
extends beyond that to businesses, public
services and other organisations.
Andy Barratt, Coalfire: Iran is another
example of a surge in nation-state
backed cyber espionage in recent years.
State hacking campaigns, such as Cloudhopper, that target software
supply companies are incredibly dangerous. "By breaching one company,
you can create a backdoor into thousands of others," cautions Simon
Whitburn, SVP Cyber Security Services at Nominet, pictured above. "The
information gathered from these types of attacks can then be used for
spear phishing attacks on high value individuals, which is where serious
damage can be done.
Defending against this type of campaign can be very tough, he adds. "There is a
feeling amongst users that, if lots of people trust and use a service, then it must be secure.
This can result in companies downloading software without checking it themselves first.
Cloudhopper demonstrates that this is a dangerous assumption. Whenever a company uses
an outside service, even from a reputable source, they need to check that there is nothing
malicious lurking in the code. This will add to the deployment time, but could help protect
organisations against this type of malware spreading. One way of noticing if third party
services have been compromised is to measure DNS traffic, which could flag if a programme
is calling out to a command and control centre."
www.computingsecurity.co.uk @CSMagAndAwards July/August 2019 computing security
27