Businesses and cities share a very real threat in today\u2019s increasingly complex world, faced as they are with the ever-present possibility of a cyber attack, including state-sponsored cyber attackers. \u00a0Here the current key considerations for cyber security are highlighted.<\/p>\n
A cyber attack can come at anytime, and without warning \u2013 many of them devised by more and more sophisticated hackers, with an ever-expanding arsenal of tools at their disposal.<\/p>\n
The profile of an attacker has evolved from the lone actor to highly organised groups often funded by nation states. These state-sponsored cyber attackers are no longer simply targeting your installations or private data \u2013 they\u2019re engaging in cyber espionage and IP theft, looking for an entry point into critical infrastructure, or building management systems.<\/p>\n
Such attacks have already been shown to cause devastating levels of damage on an increasing scale \u2013 in some cases putting companies out of business, shutting down entire power grids across cities, and crippling essential services, leaving lives at risk.<\/p>\n
A cyber attacker needs only a single entry point to gain access to a target\u2019s network and critical infrastructure. Physical security systems are increasingly being used as that entry point, with this issue emerging as the most significant evolving risk in the sector.<\/p>\n
The extent of the nation\u2019s cyber security risk was recently revealed by the UK\u2019s top cyber-defence centre. In its latest Annual Review, the National Cyber Security Centre (NCSC) revealed that the organisation has been defeating an average of 10 attackers per week \u2013 most of those attacks executed by state-sponsored cyber attackers employed by hostile nations.<\/p>\n
In the same report, the head of the NCSC, Ciaran Martin, warned UK businesses that it\u2019s just a question of time before the UK gets hit with a widespread cyber attack, stating, “I remain in little doubt we will be tested to the full, as a centre, and as a nation, by a major incident at some point in the years ahead, what we would call a Category 1 attack.\u201d<\/p>\n
A Category 1 attack is defined by the NCSC as a cyber attack that causes \u201csustained disruption\u201d of essential services or affects national security, leading to severe economic or social consequences, or even to loss of life.<\/p>\n
The only way to combat this looming threat is to be aware of the risk and bolster existing security systems. Just as you might prepare for the possibility in your area of a natural disaster, such as an earthquake, you must take the correct preventative measures to brace for a cyber attack knowing that although you may not get hit for many years, there\u2019s also the possibility that it could happen tomorrow.<\/p>\n
In today\u2019s world, it seems that everything is increasingly connected \u2013\u00a0 from your phone, to your car, to your toaster, to your surveillance system. With technological advances, businesses and cities have come to rely upon this inter-connectivity for running operations smoothly, allowing for greater convenience and better collaboration.<\/p>\n
Yet for all of the practicality presented by the world of IoT, this intertwined approach is also the very thing that can leave your most critical infrastructure vulnerable to an attack \u2013 after all, your physical system is only as secure as its weakest point, or the least trusted device connected to it.<\/p>\n
In spite of this known risk, the interconnectivity of business operations can\u2019t be easily escaped. An offline strategy is no longer a viable strategy \u2013 the base of software and hardware updates alone is so fast that if you keep your system in a closet, you\u2019ll miss out not only on functionalities that keep your system at optimal performance and resilience, but also on critical updates that keep your deployments safe.<\/p>\n
Even if you could operate offline, there\u2019s still always the risk of a breach being brought in from a third party. All it takes is a USB stick, or unauthorised access to another local device.<\/p>\n
The best way to combat a cyber attack is to seal off any and all entry points to a potential infiltrator, such as a state-sponsored cyber attacker. This process starts with building trust.<\/p>\n
You need to first be able to trust all the people you work with, starting with your employees. Many businesses have been exposed to a malware attack or data breach that began internally \u2013 for example, a loyal employee plugging in a personal device at work, such as a phone, not realising it\u2019s already been hacked.<\/p>\n
Many such breaches can be prevented with the simple introduction of generalised employee training, designed with cyber security in mind.<\/p>\n
It is equally important that you trust those working with you on your supply chain \u2013 your vendors, manufacturers, and those deploying your systems.<\/p>\n
You must be sure to select vendors and integrators that build their own businesses on a foundation of cyber security best practices. This starts by asking some key questions before engaging in a partnership:<\/p>\n
Is the vendor being transparent about cyber vulnerabilities? Do they have a strategy in place to close up security gaps? Do they place a priority on security when developing their own products? Will they take responsibility if your devices get hacked? And finally, who owns the company building the hardware and software?<\/p>\n
This final question is particularly critical in light of the latest report from the NCSC\u2019s findings on the level of threat from hostile nations. Choosing the wrong foreign government-owned vendor could leave you vulnerable to \u201cback-door\u201d entry points, allowing a vendor to tap into your devices any time they wish to. In this way, they have the potential to execute denial of service to a third party, or to use their IP cameras to tap into your private network.<\/p>\n
With all of this in mind, it is clearly important to take the time to select partners who can show that they have your best interest at heart. The right vendors should rate cyber security as a top priority, over product prices and features. They should also be able to provide the right answers to all of the above questions.<\/p>\n