By Matthew Hurling, Government Programs Lead for Middle East & Africa, Mandiant
Geopolitical summits, elections and sporting meets are some of the most visible events whether they’re taking place on an international, national, or regional scale. They also present unique cyber security challenges for critical infrastructure and supply chains. From a summer of sporting events running through to the FIFA World Cup, as well as the G20 and COP27 summits this winter, no matter whether these last from a single day to multiple weeks or months, defending against cyber threats must be an important consideration for organisers and is no longer something that cannot be taken seriously nor left to the responsibility of other parties.
Defending these kinds of societal events requires active defences backed up by the latest intelligence on potential attackers. Organisers need to have strategic security programs plus the right technical solutions in place to harden their security posture prior to an event and to support operations once it kicks off. Delivering resilient cyber capabilities in a compressed timeframe under intense public attention and scrutiny is a major challenge that requires focus and investment to properly plan and implement.
There are three key phases to think about here, in the run up to and during a major event:
- Understand the environment: Prepare, harden and exercise
- Anticipate threats: Test, monitor and defend
- Survive attacks: Respond, contain and remediate
Understand the environment
This phase should take place before a major event, with the aim of proactively protecting and hardening the event’s security posture. Do you know enough about the potential adversaries and have you prepared your people, processes and technologies in the right way?
Some of the critical things to think through in the preparation phase include:
- Ensure you can monitor and investigate alerts, proactively hunt for attackers and contain and remediate threats
- Deploy endpoint and network detection technologies across the entire environment and multi-factor authentication across all accounts and external facing services
- Create alerts for emerging and currently exploited vulnerabilities as well as current and imminent threats based on the latest information about the threat landscape
- Monitor social media, blogs, forums, news sites and chat apps for threats, misinformation and disinformation campaigns
- Coordinate with relevant national agencies to obtain and contribute related intelligence.
When it comes to hardening infrastructure, conduct compromise assessments and validate controls to check the security and integrity of the environment and the key data that needs protecting. Think about what all the different ways into that environment might be, and make sure to log and regularly scan all externally facing assets on the network.
In the heat of the moment, you don’t want to be struggling to think who should be involved, so make sure you’ve designated a crisis-response team and that you’ve got the right organisational, executive and communications support. Conduct a tabletop exercise to ensure that all participants understand their roles and responsibilities during an incident, and test backup procedures to ensure that critical data can be rapidly restored and critical business functions can remain available.
Anticipate threats
Once the major event has begun, and there will be an increased risk of destructive or disruptive cyber attacks. This is when you should go into an elevated active defence mode – or ‘shields up’. Key priorities will include continuously validating security controls and defending critical assets. It’s all about inhibiting the access an adversary needs to leverage to achieve their goal.
Testing is important again here – whether that’s ad-hoc penetration testing exercises on all externally facing assets, testing the internal team and technology’s ability to detect, prevent and respond, or testing the incident response team’s reaction times against real adversarial methods.
Monitoring what’s happening in real time is key in this phase:
- Establish a situation room to bring together operations, intelligence and external organisation information and communications
- Continuously monitor, analyse and report relevant data and analysis from intelligence sources
- Conduct enhanced hunting and monitoring for indicator-less behaviours; assume attacks are happening and technical controls have missed something
- Continuously validate security controls effectiveness against active attack behaviours.
- Restrict egress communications on critical systems.
Ultimately, the focus should be on protecting critical assets – what are your crown jewels and what might an adversary go after? Protect specific high-value infrastructure and network architecture to limit or remove adversary access to critical systems, and make sure you have offline backups in place to use if needed.
Survive attacks
By this stage, you’ve hopefully spent a long time prepping, building and testing defences, and now it’s all about being ready to respond and providing continuity.
During the major event, national, international and social media coverage often parallels real-time activity. Having extensive intelligence on existing and emerging threat actor tactics, techniques and procedures enables you to have an effective and efficient incident response.
Effective incident and breach response extends beyond technical investigation, containment and recovery and includes executive communication and crisis management, such as legal, regulatory and public relations considerations. Doing this requires taking a potential adversary’s view of the situation. Preparing for an incident from only one side, without invoking real-world experience and known data on threats, solves only half the equation.
Following the major event, take time to detail successes, challenges and recommendations. We can always continue learning from similar events and try to share as much information as possible to avoid future similar circumstances.
The cyber security challenges we face today are often too big to tackle alone and the necessary cyber defence operations maturity and capacity require significant, sustained focus and investment. These challenges become even more acute during major events. Protecting such events means having rapid and adaptable cyber defences under unique duress and pressure.
A prepared and practiced cyber strategy and playbook helps ensure a favourable outcome not just for the hosts, but all participants, spectators, and those watching on from around the world.
