Sun Tzu's Art of Cyberwar

An ancient Chinese military treatise from the 5th century BC, The Art of War by Sun Tzu, is considered a definitive work on military strategy and tactics. Through the ages, military leaders have been inspired by it, even to this day.

Beyond the military, its advice on how to outsmart opponents has been applied to various competitive fields from business to sports. Increasingly, as warfare moves from the battlefield to the realm of cyber-space, its principles are being seen as especially applicable to cybersecurity.

Despite being written thousands of years ago, these classic defense strategies are undoubtedly still relevant, for the modern defender of IT infrastructure. The principles of Sun Tzu are not only relevant to defense, but also for understanding the approach of attackers.

Know the Enemy and Know Yourself

One of the most often quoted Sun Tzu quotes has enduring resonance for many situations in life, including cyber-security. To understand how a hacker is likely to operate, we must first understand their motivations and what they are trying to achieve. When we know what assets they are likely to target, we can better focus on effectively protecting them.

To be properly prepared for cyber-incidents, we must also have a clear understanding of our own business and infrastructure, where is our data held? What software are we running? Is everything patched and maintained? What’s more, is the proper training in place for staff? Attackers will always ‘strike at what is weak,’ and employees are often the weakest link in the security chain.

All Warfare is Based on Deception

Many of the methods used by attackers are based on deception, whether that’s phishing, spear phishing, whaling or social engineering. Often used to trick unsuspecting employees into engaging with malicious attachments or links, phishing attacks are becoming increasingly sophisticated, with hackers now tricking employees by posing as more senior members of staff and even CEOs, requesting funds to be transferred.

Recent ISACA research has found that 1 in 5 UK office workers have fallen prey to phishing scams, while over half said their employer has not provided any cyber-security awareness training. Employee training and awareness is key to limiting the risk of deception by malicious attackers, and as the above example demonstrates, this training needs to be rolled out to the most senior staff, too.

Attack him where he is Unprepared… 

Appear where you are Unexpected

While employees can be a weak link in the chain, they are not the only route inside an organisation. It’s important to remember that attackers will also have been trained to know their enemy and, in preparation for an attack, will have done their homework on all possible routes and weaknesses. Organisations should therefore consider all avenues of access and what vulnerabilities they might have.

Fortunately, with exercises such as penetration testing, organisations are now able to assess their own security before a hacker does. Through this exercise, organizations can not only scan their systems for vulnerabilities, they can also test employee knowledge and awareness by simulating a real-world attack scenario.

Just as Water retains no Constant Shape…  

In Warfare there are no Constant Conditions

Attackers are agile, so organisations need to be as well. As organizations become wise to traditional attack methods, hackers will only develop new ones in a constant arms race for supremacy.

At the same time, businesses are continually evolving and adapting, whether that’s upgrading systems, introducing new technologies or changing business models. Businesses should be mindful that all of this change can introduce new cyber security risks, or remove old ones. One of the best ways to be prepared is to keep up to date with the latest best practice frameworks for enterprise IT, such as COBIT 5.

In the Midst of Chaos there is also Opportunity 

When it comes to cyber-security breaches, the rule is always ‘when,’ not ‘if.’ When breaches occur, organisations should focus on the lessons they can learn and improvements they can make as a result. The root cause should be identified and changes should be swiftly implemented to address this, with the lessons learned shared with all relevant staff.

Suffering a breach can provide the opportunity to reflect and revisit the strategies organisations have in place. Why not apply strategies that have been tried and tested over millennia? As Sun Tzu says, “The opportunity to secure ourselves against defeat lies in our own hands”.

Info-Security

You Might Also Read:

Russian General Brags About Cyberwar Successes:

Fighting The Invisible War In CyberSpace:

 

 

« Hackers Hit Russian Bank Customers
WannaCry Was Not A Phishing Attack »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

Watch this webinar to hear security experts from Amazon Web Services (AWS) and SANS break down the myths and realities of what an NGFW is, how to use one, and what it can do for your security posture.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

Malwarebytes

Malwarebytes

Malwarebytes provides artificial intelligence-powered technology that stops cyberattacks before they can compromise computers and endpoints.

Cyren

Cyren

Cyren is a cloud-based, Internet security technology company providing threat detection and security analytics.

Qualitest Group

Qualitest Group

Qualitest is the world’s largest pure play Quality Assurance and software testing company.

FAMOC

FAMOC

FAMOC is an enterprise mobile management solution that delivers comprehensive security and management for applications, documents, email, and mobile devices.

Avatu

Avatu

Avatu specialise in providing clients the advice, technology and tools they need to fight cyber and insider threats.

edgescan

edgescan

edgescan is a cloud-based continuous vulnerability management and penetration testing solution.

AllClear ID

AllClear ID

AllClear ID provides products and services that help protect people and their personal information from threats related to identity theft.

Cyber Security Jobs

Cyber Security Jobs

Cyber Security Jobs was formed to help job seekers find jobs and recruiters fill cyber security job vacancies.

HackHunter

HackHunter

HackHunter’s passive sensor network continuously monitors, detects and alerts when a malicious WiFi network and/or hacking behaviour is identified.

Police CyberAlarm

Police CyberAlarm

Police CyberAlarm is a free tool to help members understand and monitor malicious cyber activity. This service is made up of two parts; monitoring and vulnerability scanning.

Simplilearn

Simplilearn

Simplilearn is the world's #1 online bootcamp for digital skills training in disciplines such as Cyber Security, Cloud Computing, Project Management, Digital Marketing, and Data Science.

Tugboat Logic

Tugboat Logic

Tugboat Logic was created to address the skills and expertise gap in the security and compliance industry. Our goal is to simplify and automate information security management for every enterprise.

Assure IT

Assure IT

Assure IT is a Singapore company specialising in technology governance, risk and compliance.

Secuvy

Secuvy

Secuvy leads in data security, privacy, compliance, and governance, offering a unified platform for proactive data discovery, management, protection, and enhanced data value.

M6iT Consulting

M6iT Consulting

M6iT Consulting is an industry-leading solution partner managing the IT requirements for a full range of companies.

ZEST Security

ZEST Security

The ZEST platform natively integrates into your technology stack to make efficient risk remediation possible.