The future of cyberthreats: When attacks cause physical harm

The ability of cyberthreats to compromise information systems is an ongoing danger to all organizations. However, an emerging threat presents a new challenge — cyberattacks that may cause physical harm to systems and persons. This threat has become acute for certain sectors such as critical infrastructure.

Related: Threat from cyber hackers is growing, U.S. grid regulator says

Historically, cyberattacks seek to harm a target by either causing disruption of a system or covertly entering to commit espionage or data theft. Recently, a new cyberattack has evolved to harm targets by causing physical damage or corruption of a system.

For example, in 2016 one piece of malware targeted Ukraine’s power grid and cut power to 20% of the capital. The attack occurred toward the end of winter and left residents without electricity, lights, and, in some cases, heat. It involved malware that could activate or deactivate controls, and, as the attack was unfolding, it became clear that it was engineered for maximum effect because it also took backup power sources offline.

Another significant event occurred in August 2018, when cybercriminals breached the security of a petrochemical plant in Saudi Arabia in an attempt to manipulate and sabotage the plant’s operations. Though unsuccessful at causing an explosion, investigators believe that the attack was intended to cause a catastrophic event. While the attack failed in this instance, investigators raised the alarm that the compromised system is utilized by thousands of critical infrastructure operators globally and is an ongoing vulnerability.

Related: Playing it safe: Cybersecurity for small- to medium-sized businesses

Also in the case of the Saudi Arabia hack, investigators concluded that the hackers custom built nearly all their tools and could do so because they were able to obtain a copy of the critical software from eBay. This suggests the hackers were funded and possibly affiliated with a state actor. Undoubtedly, this has generated concerns about the increased use of commercial off-the-shelf (COTS) software.

Targeting the energy sector

Adding to this is a resurgence of cybercriminals specifically targeting the energy sector. One group, Dragonfly, has launched several high-profile and concerted attacks against the energy sector. To date the group has mostly been involved in cyber-espionage, but security firms believe that the group possesses the technical tools and capability to physically compromise a system.

For many observers, these attacks marked a turning point for infrastructure companies; they show that hackers are not only motivated and bold enough to launch attacks on infrastructure that jeopardize the wellbeing of individuals, but sophisticated enough to be successful. Moreover, the technologies involved in these attacks are ubiquitous and many are integral to traffic control systems, waterworks systems and electricity supply networks. And, as clear in the Saudi Arabia attack, COTS software opens the door for cybercriminals to purchase identical software in order to learn how it works so as to discover and exploit vulnerabilities.

Protective measures

Despite the advanced capabilities of hackers, organizations can take steps to protect themselves. For example, organizations can remediate vulnerabilities in COTS software through solutions designed to scan software and identify flaws. This attenuates concerns about hackers obtaining software and exploiting existing flaws because system glitches are routinely identified and remediated. Moreover, organizations need to recognize potentially malicious activity on their systems — such as repeat remote access requests, system activity at unusual times and access request from harmful domains.

Unfortunately, it’s likely that attacks that aim to physically interfere with software or security systems will only increase in the future. To combat this growing threat, organizations can take several steps:

• Security by design: When developing smart infrastructure, organizations should design it not just with security to prevent intrusions, but to minimize damage in the event of a compromise. For example, should certain critical software be custom-designed to prevent easy analysis by hackers? Can physical, manual, and programmatic fail safes be included to prevent malicious events?

• Enhanced training: Companies should also strongly consider training board members and staff, including employees in non-technical departments, and those trainings should be tailored to employees’ responsibilities. For instance, board training should focus on the importance of investing in cybersecurity and keeping the board appraised of liability risks posed by cyberthreats. Likewise, non-technical employees should receive training on how to detect cyberthreats, recognize common attack tactics like phishing emails, and most importantly what to do in the event of a suspected attack.

• Cyber insurance: Also a consideration for organizations is whether their insurance policies cover this type of harm. Cyber insurance typically contemplates coverage for unauthorized disclosure of personal or confidential data and does not necessarily factor in damage to persons or real property. Therefore, infrastructure and energy companies should confirm whether they are covered should they experience this type of attack

Evolving threat

Cybersecurity is an evolving threat that requires companies to adapt. There is no question that cyberthreats will continue to grow more sophisticated and potentially, more dangerous. Therefore, it is imperative that organizations begin taking preventative measures now, especially when it comes to protecting systems that can affect the physical safety of a system. Ultimately these conversations are better had before, rather than in the aftermath, of an attack.

Anna Rudawski ( anna.rudawski@nortonrosefulbright.com) and Alexis Wilpon (alexis.wilpon@nortonrosefulbright.com) are associates, and David Kessler (david.kessler@nortonrosefulbright.com) is head of the U.S. Privacy, Data Protection and Cyber Security Group, at Norton Rose Fulbright.