The vast majority of cybersecurity professionals believe that the business they work for is a target of nation-state hackers, but only a small fraction believe that their organization can confidently identify whether attacks are actually being carried out by hostile states.
See also: Python ransomware targets Jupyter Notebook tool
According to an analysis by cybersecurity firm Trellix, half of all organizations believe they have been targeted by a nation-state cyberattack in the past 18 months, while a further 42% believe they will be attacked in the future. Fewer than one in 10 businesses believe they are not a target for nation-state hackers at all.
For organizations that have been targeted by nation-state hackers, the most likely suspects identified by cybersecurity personnel are Russia and China, along with mercenary cybercriminals suspected of working on behalf of governments.
North Korea, Iran and Western governments are among those organizations suspect of being behind attacks, while some cybersecurity personnel admit that it is very difficult to tell who is behind the campaigns.
See also: Mythic Leopard hacking group attacks Indian government
When asked how confident they were that, without help, their organization could tell the difference between cyberattacks carried out by nation states and attacks carried out by cybercriminals, just a quarter said they had complete confidence that this would happen.
This lack of awareness could lead to problems, as state-backed hacking operations are often designed to create long-term persistence in networks, meaning that if an intrusion is not properly identified as the work of a hostile government it could lead to missed backdoors and other remnants of the attack – and later exploits.
Even organizations that are unsure of their ability to detect nation-state-sponsored cyberattacks say it is important to be able to do so, although many are limited by cybersecurity strategy or lack of resources. The vast majority – 90% – of respondents said their own government should do more to help them protect themselves from these types of attacks.
See also: Mars Stealer malware distributed via OpenOffice ads on Google
Defending against cyberattacks, especially from adversaries with significant resources behind them, is a challenge, but there are steps you can take to improve your chances. This includes measures such as implementing critical security patches and requiring the use of multi-factor authentication to keep attackers out of your network.
It is also vital for cybersecurity personnel to fully understand the network they are defending, so they can identify all assets that need protection and take action against any potentially suspicious activity.
Information source: zdnet.com
