Responding To Russia´s Cyber Aggression

As Russian hackers take center stage in the pantheon of cyber adversaries, NATO needs to step up and agree who’s the biggest cyber threat? Not long ago, China and its economic espionage were at the center of the Western narrative, but Russia has elbowed its way in.

“The Russian cyber threat is more severe than we had previously assessed,” US Director of National Intelligence James Clapper told Congress last year. More recently, Adm. Michael Rogers, who leads the NSA and US Cyber Command, said, “Russia has very capable cyber operators who can and do work with speed, precision and stealth.” Recent headlines include the news that Russian hackers appear to have stolen opposition research on Donald Trump, the presumptive GOP presidential nominee.

Yet even as the narrative shifts, there are two features of Russia´s cyber activities that remain too poorly known and understood in the West.

First, Russia´s greatest cyber advantage is its wealth of the most important cyber asset:  skilled and well-educated people. The government recruits and harnesses individuals with innovation and aplomb, for example, allowing its intelligence services to offer employment to hackers convicted of cyber-crimes in lieu of prison. 

But the more important trend is making common cause with criminal hacker groups: the government allows them safe haven in return for services on demand. In this way, the Russian government has been intentionally blurring the lines between cyber activists, criminals, and state-paid spies and hackers, adding a new layer of obfuscation to the tricky problem of attribution — that is, figuring out just who is behind a given attack. 

The result is a cadre of well-financed, persistent and technologically advanced “non-state groups” that can carry out various operations, and do so on a scale of a year or longer until they get what they are after. Some of the ones we know about go by the names APT28, the Dukes, Red October, Snake, and Energetic Bear.

Second, Russians acting for the government or with its approval are testing the boundaries of the cyber battlefield. Having already demonstrated its willingness to use such means in various conflicts and gray-zone confrontations, Russia is at the forefront of the global move toward a greater strategic use of cyber capabilities to persuade adversaries to change their behavior. Hackers with connections to the Kremlin have attacked, for example, a French television network, a German steelmaker, the Polish stock market, and the US State Department. These activities are carried out in pursuit of Russia´s strategic objectives.

Even if the attribution to Kremlin has been pretty clearly presented, there has been very limited political response from the West. This is encouraging – from the Russian point of view – because it is a license to act even more aggressively in the cyber domain. The coordinated attack on the Ukrainian electrical grid in December was clearly an attack on critical national infrastructure. Russia showed what it can do, when it wants. This should have awoken the West. But it did not.

It is difficult to say exactly where Russia might rank among the world’s cyber forces; governments like to keep their cyber abilities secret, and such capabilities cannot be calculated in the same way as tanks or fighter planes. Still, it is known that Vladimir Putin has poured resources and manpower into the field, creating a cyber command within the Defense Ministry to conduct cyber and information operations. 

The Russia military also has a specialized unit for cyber-attacks, while the Federal Protective Service (FSO), the Federal Security Service (FSB) and the Main Intelligence Directorate (GRU) are believed to have the lead in creating Russia´s offensive cyber capabilities. It is no stretch to assert that Russia is among the world’s top three, and when states´ level of offensive and defense capabilities are combined with their cyber dependence, Russia’s position appears to be the strongest in the world. To the Kremlin, the cyber domain offers an excellent opportunity to increase its power in world politics.

The more Russia develops its cyber capabilities, the more aggressive and confident it will become. Russia has the ability and will to conduct denial-of-service attacks, develop sophisticated malware, and exploit unknown software vulnerabilities. Unlike China, Russian cyber activities focus primarily on intelligence-gathering and military reconnaissance of critical infrastructure networks. Today’s intelligence operations enable tomorrow’s actions, and Russia is mapping networks to determine the resources necessary for future attacks.

The Russian government has stepped up its state-sponsored cyber-attacks because it perceives that there is no significant “price to pay” for such activities. This trend will continue as long as the West doesn´t push back.

A political response is now needed. The West should not tolerate Russian´s behavior in cyberspace. Western nations must develop effective ways to deal with Russia’s cyber operations and have the political courage to act against it. This is one important topic to be discussed in NATO´s upcoming summit in Warsaw. Otherwise, the West will continue to send the wrong message to Kremlin

DefenseOne:

« Top 10 Technologies For Information Security
Technology Advances Too Fast For Government »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

Paraben

Paraben

Paraben provides digital forensics solutions for mobile devices, smartphones, email, hard drives, and gaming system.

Berkman Klein Center for Internet & Society

Berkman Klein Center for Internet & Society

The Berkman Klein Center for Internet & Society is a research center at Harvard University that focuses on the study of cyberspace.

Morgan Lewis Law

Morgan Lewis Law

Morgan Lewis is an international law firm with offices in North America, Europe, Asia, and the Middle East. Practice areas include Privacy and Cybersecurity.

Absolute Software

Absolute Software

Absolute provides persistent endpoint security and data risk management solutions for mobile devices - computers, tablets, and smartphones.

Outpost24

Outpost24

Outpost24 provides easy to deploy and intuitive solutions to continuously identify, remediate and mitigate vulnerabilities in your network.

ManagedMethods

ManagedMethods

ManageMethods Cloud Access Monitor is the only Cloud Access Security Broker (CASB) that can be deployed in minutes, with no special training, and with no impact on users or networks.

Digi International

Digi International

Digi is a leading global provider of mission-critical and business-critical machine-to-machine (M2M) and Internet of Things (IoT) connectivity products and services.

River Loop Security

River Loop Security

River Loop Security specialize in solving complex cybersecurity challenges in the IoT and embedded devices space.

Cyber Griffin

Cyber Griffin

Founded by the City of London Police in 2017, Cyber Griffin is an initiative that supports businesses and individuals in the Square Mile to protect themselves from cyber crime.

Kintent

Kintent

With Kintent, compliance becomes a habit, is simple to understand and achieve, and is continuously testable so that your customers can see that you are adhering to all your trust obligations.

Sentrium Security

Sentrium Security

Sentrium is committed to helping organisations protect their technology, information and people. Our range of bespoke services provide solutions to tackle a broad range of cyber security challenges.

Gradient Cyber

Gradient Cyber

Gradient Cyber is a trusted cybersecurity partner specializing in small businesses and mid-market enterprises concerned about cybersecurity but lacking the staff to give it the attention it deserves.

Kivera

Kivera

Kivera enforces your organisation governance and security policies across cloud deployments preventing misconfigurations turning into attack vectors.

WeVerify

WeVerify

WeVerify is a platform for collaborative, decentralised content verification, tracking, and debunking.

Resmo

Resmo

Resmo is an all in one platform for SaaS app and access management for modern IT teams.

Backblaze

Backblaze

The Backblaze Storage Cloud provides a foundation for businesses, developers, IT professionals, and individuals to build applications, host content, manage media, back up and archive data, and more.