Cyber Defense eMagazine July 2021 Edition

Applying PR tactics is a new page in the hacker playbook to mask the organizational root causes of
cyberattacks. Within these companies being targeted, it’s not a factor of negligence, it’s a lack of a clear
understanding as to what these cybersecurity risks mean and how to translate them into impact. There's
a big gap between the IT side of the house and the operational departments; each side has a separate
administration department that doesn't always share security-related information in a timely manner. In
the Colonial Pipeline’s case, their corporate exposure to the internet was most likely very tight, but
exposure through its refineries—where they probably have their own security rules and procedures—
was weaker and may not have matched up more stringent corporate security policies.
Threat intelligence remains very compartmentalized and there's no central repository to share
information. In many of these cybersecurity instances, investigators have to go to multiple sources, in
multiple departments, to begin pinpointing the root cause of the attack. The highly operationalized
companies who prioritized what is only important to their specific part of the organization prolong the
attack identification process. From the IT department down to the industrial control systems, there needs
to be a better accountability structure in place and support for corporate-wide threat/risk data sharing—
especially in utilities.
Attackers - A Victimless Mindset
Oftentimes, criminals who do these types of attacks are under the impression that it’s a victimless crime
and at one point, the company will get reimbursed by their cyber insurance provider. In the Colonial
Pipeline case, the hackers are hitting the company’s bottom line as well as affecting the price of gas all
along the U.S Eastern seaboard. “We are sorry. We wanted to start a little fire not a big fire” is far from
an already morally dubious ‘Robin Hood’ act. Imagine what would have happened if this was a wellcalculated
attack on purpose, like the 2015 attack on the Ukraine power grid.
To combat criminal hackers there needs to be a real-time, institutional understanding of what the threats
are and a universal repository of data shared among all organizations, similar to how the National Oceanic
and Atmospheric Administration (NOAA) shares all weather-related information to benefit everyone. But
the fact remains that companies don't want to talk about their cybersecurity issues fearing bad PR and
shareholder repercussions. All organizations need to share information on security breaches to create
resiliency that enables quicker and more effective attack responses. To achieve this resiliency and
collective response, companies need to have an overall risk management strategy—not just a bunch of
vendor management tools—to create a reasonable strategy.
Conclusion
We live in a world where virtually everything is connected to the internet and there will always be bad
actors looking for a way in. Companies need to embrace this reality, but a lot of organizations chose to
downplay their chances of being hacked. The minute devices are connected to the internet there is an
Cyber Defense eMagazine – July 2021 Edition 49
Copyright © 2021, Cyber Defense Magazine. All rights reserved worldwide.