CS Mar Apr 2022

Ukraine backup
CALL FOR HELP PROMPTS RAPID RESPONSE
A TEAM OF EXPERTS HAS BEEN SET UP TO HELP DEFEND UKRAINE FROM CYBER-ATTACKS
Acyber rapid-response team (CRRT) is
being deployed across Europe, after
a call went out from Ukraine for help,
as reported by the BBC.
The newly-formed team of eight to 12
experts from Lithuania, Croatia, Poland,
Estonia, Romania and the Netherlands has
committed to help defend Ukraine from
cyber-attacks - remotely and on site in the
country. An official warned attacks were
likely. "We can see that cyber-measures are an
important part of Russia's hybrid toolkit," the
CRRT official said.
It comes after the UK and the US blamed
Russia for cyber-attacks earlier this month
that temporarily took a small number of
Ukrainian banking and government websites
offline.
The Lithuanian Ministry of Defence tweeted:
"In response to Ukraine request, [we] are
activating [a] Lithuanian-led cyber rapidresponse
team, which will help Ukrainian
institutions to cope with growing cyberthreats.
#StandWithUkraine."
CRRTs are a European Union initiative to
deepen defence and co-operation between
member states. They are said to be equipped
with commonly developed cyber toolkits
designed to detect, recognise and mitigate
cyber-threats. An official told the BBC that
the team was "composed of different cyberexpertise,
such as incident response,
forensics, vulnerability assessment, to be able
to react to a variety of scenarios". Russia has
previously been accused of 'hybrid warfare',
combining cyber-attacks with traditional
military activity, in Georgia and Crimea. "The
EU and Ukraine blamed Russia after
thousands of people in multiple cities in
Ukraine experienced power cuts, in 2015 and
2016, when hackers temporarily shut off
electricity substations," states the BBC. "The
US, UK and EU also blamed it for the hugely
disruptive NotPetya wiper attack."
Experts say about 2,000 NotPetya attacks
were launched in 2017, mainly aimed at
Ukraine, but the malicious software spread
globally, causing billions of dollars of damage
to computer systems across Europe, Asia and
the Americas.
POSITIVE NEWS
According to John Fokker, head of cyber
investigations & principal engineer, Trellix, the
news that the EU is deploying a Cyber Rapid-
Response Team is extremely positive. "The
initial cyber-attacks on Ukraine were intended
to be very public and evident in their nature
and impact. However, we anticipate that this
will change in the future, and any attacks will
be incredibly discreet, as attackers seek to
conceal their activity and ultimate objectives.
"Cyber-attacks are increasingly used as
a means of modern warfare. Our research*
found that Russian and Chinese nation-state
backed groups are believed to be responsible
for nearly half (46% combined) of all
observed APT threat activity. Cybersecurity
John Fokker, Trellix: Cyber-attacks are
increasingly used as a means of modern
warfare.
must be a worldwide priority and we must
collaborate to defend against these threats."
Threat intelligence will be crucial to
mitigating risk, he adds. "It will allow security
professionals to strengthen detection, plus
respond in real-time to active threats. The use
of machine learning analytics will also help
to predict and detect attacks, identify root
causes, and guide adaption and response to
whatever threat Ukraine may face."
*https://www.trellix.com/en-us/threat-center/threatreports/jan-2022.html
www.computingsecurity.co.uk @CSMagAndAwards Mar/Apr 2022 computing security
21