ZDNET explores nation state actors not just breaching critical network assets, but their attempt to undermine trust in the entire system:
“We’ve really got to think about the fact our adversaries are attacking more than just our technology. Our adversaries are now starting to critically undermine the trust that our stakeholders have,” said Cooper.
There are many in the cybersecurity industry who would argue that technology alone can solve this problem — protect systems with the relevant tools to keep them safe from attacks. But this is perhaps ignoring the wider issue: there isn’t an antivirus product to protect against declining faith in big institutions, or to defend against fake news.
“The bigger system, that’s the thing we have to defend, not just the technology. While we’re focusing on protecting the technology, our adversaries are focused on attacking the system. And by attacking the system, they’re critically undermining the trust in that system,” said Cooper.
In order to achieve that, it can’t just be about “looking for our technology comfort blanket,” he said, adding: “we’re going to find it lacking”.
The idea nation state actors are eroding trust in the entire system is an insightful distinction many people overlook. It is the difference between viewing an attack through a tactical lens versus a strategic one.
All too often nation state backed breaches are part of a much larger, multi-faceted operation rather than a singular goal. We need to always consider attacks from this perspective so we can better understand a potential end state. Merely focusing on the obvious goal will not allow us this insight and will ultimately cement failure to adequately defend the crown jewels.
This is where solely employing technological cyber defense is inadequate. Leveraging threat intelligence will be far better at allowing an organization to craft the right strategy to defend against a variety of attacks, actors, and vectors. There is no one-size-fits-all solution to cyber defense. There are some basic tactics, but using a combination of technology and strategy will almost always be the correct mix.