The Iran-Russia Cyber Agreement & US Strategy In The Middle East

The new cooperation agreement between Russia and Iran on cybersecurity and information technology is likely to create new hurdles for the United States and its allies in the Middle East. This January, Russian Foreign Minister Sergey Lavrov and his Iranian counterpart Javad Zarif signed a cooperation agreement on cybersecurity and information and communications technology (ICT).

The agreement includes cybersecurity cooperation, technology transfer, combined training, and coordination at multilateral forums, like the United Nations.  

Iran / Russia Cybersecurity Alliance

Although the cooperation with Moscow outlined in the agreement could upgrade Tehran’s offensive cyber capabilities, the agreement is largely defensive, motivated by the countries’ shared animus toward the United States and U.S. influence in the Middle East as well as a desire to reduce dependence on Western technology.

There are limits, however, to how closely the two sides can be expected to work together.

The relationship between Russia and Iran has long suffered from mutual suspicion, ideological differences, and competition. Moreover, in the past, Russian and Iranian operators have operated at cross purposes. For example, in October 2019, British and U.S. officials revealed that the Russian threat actor Turla had hijacked Iranian hacking infrastructure as part of a false-flag operation.

Due to suspicion and conflicting objectives, cyber cooperation between Moscow and Tehran is likely to be focused on intelligence sharing and improving cyber defenses, rather than sharing offensive capabilities. Nonetheless, the agreement could pose four challenges to U.S. cyber operations. 

  • First, Russia could help Iran obtain stronger cyber defense systems. Harvard’s Belfer Center’s National Cyber Power Index 2020 lists Iran as the lowest-scoring nation for cyber defense capabilities, with Russia ranked in the middle of the countries surveyed. If Tehran addresses these defensive deficiencies with the help of Russian technology and training, it could make U.S. initiatives like 'Defend Forward' more challenging and costly.
  • Second, Iran-Russia cyber cooperation could entail Russian cyber teams deploying to Iran to monitor Iranian networks in order to collect insights and identify U.S. malware, similar to U.S. Cyber Command’s “Hunt Forward” operations. Acquiring and analyzing Cyber Command or National Security Agency hacking tools and techniques could help improve Russian and Iranian defenses, thwart future U.S. cyber operations, and force U.S. hackers to develop new exploits sooner than they hoped.
  • Third, if able to access Iranian defense systems, Russian hackers could acquire and reverse engineer U.S. or Israeli malware that has been used against Iran. This occurred with the Stuxnet worm, which targeted Iran’s nuclear facilities in 2010 and was attributed to the United States and Israel. Since then, numerous cyber actors have developed over 22 million pieces of malware that used Stuxnet’s blueprint to target organizations around the world. Stuxnet eventually infected thousands of networks globally, so hackers had access to lots of samples, but an attack that did not become as widely known could still be repurposed if Russia is able to access Iranian networks.
  • Fourth, technologies and techniques that Iran acquires from Russia could be provided to Iran’s proxies around the Middle East, including Hezbollah and militias in Iraq and Yemen. Some of these groups have already shown considerable hacking capabilities. In January, security firm ClearSky revealed that a Hezbollah-affiliated hacking group named Lebanese Cedar was involved in an extensive campaign that targeted telecoms and internet service providers in the United States, Europe, and Middle East. Equipping Iranian proxies with advanced Russian cyber capabilities could allow them to threaten government agencies, businesses, and U.S. operations in the Middle East. It could also hamper investigations into cyber operations conducted by Iranian proxies and lead to misattributing them to Russia, possibly causing unintended escalation.

US Reaction & Strategy

Although the agreement between Moscow and Tehran could pose challenges for U.S. cyber strategy, some of its disruptive implications can be mitigated. To minimize the risk of their hacking tools being repurposed for use against them, the United States and its allies should establish a unified vulnerability disclosure mechanism to share vulnerabilities, including those that have already been exploited, with each other and vendors. 

While the United States already has a vulnerability equities process, other allies seem to have only varying degrees of similar processes, if at all. Because victims are likely to patch vulnerabilities once they’ve been targeted, the attacking country can disclose the vulnerabilities it used after they’ve been exploited without weakening its offensive capabilities. Furthermore, the United States could promote the responsible development of offensive capabilities by adding self-destruct code modules to prevent them from being analyzed by adversaries. These modules have been deployed as part of highly sophisticated malware campaigns in the past and are designed to overwrite their own file data in order to prevent forensic analysis.

Establishing a standardized vulnerabilities disclosure mechanism could take place as part of a broader effort to strengthen intelligence sharing and security ties between the United States, Israel, the Gulf States, and possibly other actors in the region. As cyber cooperation between Russia and Iran grows, leaving it unchallenged could pose new threats to U.S. security and strategy in the Middle East.

This article was first publised  by the Council on Foreign Relations (Creative Commons BY-NC-ND 4.0)   

Image: Unsplash

You Might Also Read: 

The Cyber Security Top Ten Power List:

 

« British Companies Compromised By Exchange Email Hacking
2021 Blockchain Trends »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

International Association of Professional Security Consultants (IAPSC)

International Association of Professional Security Consultants (IAPSC)

Members of the IAPSC represent a unique group of respected, ethical and competent security consultants.

GSMA - IoT Security Guidelines

GSMA - IoT Security Guidelines

GSMA has created a set of security guidelines for the benefit of service providers who are looking to develop new IoT products and services.

CYBER 1

CYBER 1

CYBER 1 provides cyber security solutions to customers wanting to be resilient against new and existing threats.

Ingalls Information Security

Ingalls Information Security

Ingalls Information Security provides network security, monitoring and forensics.

Netwrix

Netwrix

Netwrix empowers information security and governance professionals to identify and protect sensitive data to reduce the risk of a breach.

Global Cybersecurity Forum (GCF)

Global Cybersecurity Forum (GCF)

Global Cybersecurity Forum is a catalyst platform designed to create a more resilient and better cyberworld for all.

Red Piranha

Red Piranha

Red Piranha's Crystal Eye Unified Threat Management Platform is designed for Managed Service Providers and corporations that need extreme security that is both easy to use and affordable.

SecureLogix

SecureLogix

SecureLogix deliver a unified voice network security and call verification solution. Protect against call attacks & fraud.

Quside

Quside

Quside, a spin-off from The Institute of Photonic Sciences in Barcelona, designs and manufactures innovative quantum technologies for a wide range of applications including cyber security.

Valarian

Valarian

Valarian (formerly Worldr) is on a mission to build cutting-edge solutions that empower borderless collaboration in the new era of digital sovereignty.

gener8tor

gener8tor

The gener8tor Cybersecurity Accelerator offers a cutting-edge program in San Antonio, home to the second-largest concentration of cybersecurity experts in the United States.

Q5id

Q5id

At Q5id, we prove that your customers' digital identity and real-world identity are the same, our verification and authentication solution delivers a Proven and Secure digital identity for everyone.

TriCIS

TriCIS

TriCIS design and engineer highly secure integrated solutions that meet the highest government and military security standards, providing information assurance to organisations across the globe.

ITRM

ITRM

ITRM are one of the UK’s top managed service providers and offer a range of award-winning IT solutions, from ad-hoc consultancy to cyber security.

Omnex

Omnex

Omnex provides consulting and training services in Quality, Environmental, and Health and Safety standards-based management systems including Automotive Cybersecurity.

Airbus Protect

Airbus Protect

Airbus Protect is an Airbus subsidiary bringing together the Company’s expertise in cybersecurity, safety and sustainability-related services.