CYBERPOLYGON REPORT 2021

Cyberpolygon report 2021

With this article I want to bring an international online training, carried out by CyberPolygon, in order to increase global cyber resistance to cyber attacks and global cyber threats.

And why? Because digital ecosystems, which are made up of networks of partners, manufacturers and suppliers, are increasingly functioning as a single organism. To give us an idea, by 2025 digital ecosystems are expected to generate more than 30% of global revenue, according to data collected in “The Rise of Ecosystems and Platforms” by McKinsey & Company.

What is CyberPolygon?

But what exactly is Cyber ​​Polygon? It is an initiative of BI.ZONE (Sber Ecosystem) supported by the Cybersecurity Center of the World Economic Forum, which for a few days brings together leaders of global organizations and state representatives, so that through conferences the current trends and risks posed by cybersecurity are analyzed. increased interconnectivity.

To deal with these threats it is necessary to understand the risks and with a systematic approach to be able to create security strategies and share them. We will see it later, but if this report alerts us to something, it is precisely the fact that we must collaborate and coordinate with companies, agencies, governments and global corporations in order to work together and deal with some success against a threatening underworld and organized. And this event educates and trains in those skills, first based on presentations and then with training or challenges.

CyberPolygon 2021 has been very interested in focusing on aspects such as security and protection in the supply chain, the stability of the financial system with the entry of digital currencies, the integrity of the entire system, international cooperation in cybersecurity and in the protection of children connected online.

Cybersecurity: Key to digital life

Today, we are witnessing how electronic administration and online services have become a factor that contributes to the quality of our lives. Improvable? Of course, but the process is already underway and is unstoppable. We can all make a doctor’s appointment or get legal advice with a few clicks through a one-stop portal. Currently, 151 countries have the ability to process business license applications online, and 143 countries have implemented online systems for their citizens to pay their income taxes. And all of this is increasing, because every time we citizens tend to manage our health, finances, education, and soon it will be everything else.

Seeing these realities, the report warns of how cybersecurity becomes the key to data integrity and the sustainability of digital services. Cyber ​​attacks are expensive, in fact $1.5 million could be the price of a single highly sophisticated attack against government systems in Russia. To give you an idea, “if the Russian government opens a new resource on gov.ru in just five days after appearing on the domain, it may already be the target of an attack. The Russians have taken the option of protecting their federal databases more than regional or commercial ones, since the State is reducing the amount of critical personal data in the latter. The trend is towards tokenization, the use of digital identifiers and data anonymization because they are key to protecting citizens’ data”, according to Rostelecom Vice President for Information Security, Igor Lyapunov.

Unity is strength in cybersecurity

Another key aspect is the one addressed by Roger Halbheer, Microsoft’s Chief Security Advisor, for whom “the bad guys are good at sharing information, while we are not so good at talking about incidents. One of the ways to destroy attackers’ business is to share these tactics, indicators of compromise, and threat intelligence, so we can learn from each other.” He commented on it before, the bad guys do organize themselves and are clear about their objectives. And the rest? Well, the first thing is to share and collaborate.

Today, a State is efficient if its initiatives are digital and built on technological platforms. The immediacy, comfort, time flexibility that digitization gives us can obviously make us think that its growth is going to be exponential in all facets of our lives.

For example, the aerospace industry is very sophisticated with computer vision systems, artificial intelligence, and the Internet of Things, and that facilitates space exploration. That is why they have determined that “…it is crucial to guarantee their cybersecurity, providing a secure connection and encrypted data transfer, in addition to psychological health support during long missions,” according to Roscosmos astronaut Pyotr Dubrov. In this regard, it comes to mind, how long will it take for quantum technology to take over from current cybersecurity systems?

The focus has also been placed on the famous ransomware and attacks on the different supply chains that undermine the network operations of companies and affect both the public and private sectors. Collective decisions are sought to avoid the domino effect and reduce risks for the entire world community.

Digitization has created many potential entry points for cybercriminals, as there are more devices on the network, more electronic transactions and more online communication, and that is a great danger. Less secure home networks have increased the vulnerability of corporate networks and opened up new opportunities for cyberattacks. Therefore, it is necessary to ensure a coordinated response to cybercrime, and the public and private sectors must join forces and improve the exchange of relevant information on cybercriminals. In this aspect I see an increasingly diffuse border between the public and the private, for that reason of having to join and collaborate. We are already seeing it in NASA space missions together with private companies.

According to Michael Daniel, President and CEO of the Cyber ​​Threat Alliance “cybercrime is highly organized. It is easy to enter the market and the profits are lucrative, even accessing industrial control devices and systems.” In May 2021, Colonial Pipeline, one of the largest pipeline operators in the United States, paid cybercriminals $5 million in bitcoin, following a ransomware attack. And if you don’t pay? Is there a power outage? Sabotage? In the end, the danger hangs over the entire society that we have built and that is reeling from blackmail by organized cybercriminals. We must protect energy, health, justice, defense, because if a developed society falls prey to chaos, it becomes a jungle.

What proposals exist to mitigate cybercrime?

But what is being proposed to mitigate this? It is necessary to share data multilaterally and for this the industry has to associate with cybersecurity organizations without taking into account borders, promoting the close collaboration of private companies with governments. Will they form large hybrid corporations that dilute countries and governments?

Very interesting is the reflection of Teresa Walsh, Global Head of Intelligence FS-ISAC, who states “…ransomware is so prolific for being a service. A person without much knowledge can create a ransomware, simply by going to the underground market and buying a phishing kit to help distribute it, and reap the monetary benefits.” In 2020, ransomware attacks have grown by 150% and payment of amounts by victims of cyber attacks has increased by 4. Of course, in the end you pay, but the blackmail is still there. And it is paid as the lesser evil of something that could generate lack of control.

At this point, Kaspersky CEO Eugene Kaspersky says that “…supply chains are a scalable attack vector as a multi-layered structure. Numerous cybercriminal gangs learn and share information building a cybercriminal ecosystem.” Talk about ecosystem. Beware, it is no longer about 4 hackers who meet in an apartment or country house and mess it up. This in the movies was even bucolic, but we have to discard that image immediately. Cybercriminal ecosystems. No more no less. How do they act? What supports do they have? How are they financed? Can your accounts be traced? How to avoid attacks on nerve centers of society?

For Chris McCurdy, Vice President and General Director of Security at IBM “Supply chain providers should focus on threat modeling, on the principle of zero trust, on computer emergency response teams, as well as cybersecurity awareness”.

Craig Jones, Director of Cybercrime at Interpol is clear “…the police must work globally with private partners in order to gather forces, understand the threats and allocate resources jointly against cybercrime.”.

We must understand that today, a supply chain connects many processes, in which dozens of independent companies participate. With supply chain attacks on the rise, the security of every company in the chain, and every customer, is an urgent concern. Supply chain attacks are the result of exploiting vulnerabilities in supplier technologies or processes. They are successful if a piece of software or technology is infected in thousands of companies, because of the multiplier effect it has. For example, in July 2021, attackers exploited a vulnerability in the software of Kaseya, a provider of network infrastructure management software, and hacked into its servers. Through a software update mechanism on the servers, the hackers released an encryption engine on all computers managed through Kaseya. As a result, the systems of 1,500 organizations in 17 countries were encrypted in 19 days. Such can be the devastating effect of these attacks.

Kevin Simzer, COO of Trend Micro, predicts that “…supply chain attacks will get worse, because attacks are profitable…there is a need to change the philosophical approach and develop a zero-trust policy: don’t trust vendors, but verify them.” The word trust is repeated. If we look at trust, it is what has moved us and made us evolve as a society. Without trust there is nothing. We trust companies, banks, governments, institutions.

That is why it is so essential that trust is not lost. In this regard, Dorit Dor, Vice President of Products at Check Point Software Technologies is in favor of “… carrying out a checklist or standard as a good practice, as well as carrying out a verification of suppliers. This does not provide complete protection. Providers can only meet security standards of a certain level, which cannot solve all business problems. By creating regulations to control providers, companies also have to increase the speed of response to attacks.”

And it is that in a simple and simple way it is perfectly clarified by Troels Oerting, President of Bullwall Inc and President of the Advisory Council of the Security Center of the World Economic Forum “Today we are so interconnected, that my vulnerability is your vulnerability, and vice versa”.

Cyberpolygon 2021 Report Recommendations

Cybercriminals use phishing, botnets, malware, pharming, and ICANN has been able to detect around 1 million registered malicious domains each month. Therefore, if there is no coordination and collaboration, the stability and resistance of the digital space cannot be guaranteed.

This report also alerts us to how cybercrime is reaching healthcare and humanitarian organizations with up to 109 weekly ransomware attempts on average in each organization in the first quarter of 2021 alone.

CyberPolygon’s report also covers protecting children in the virtual space, as they may be exposed to bullying, phishing, social engineering and cyberbullying techniques. On the other hand, this report delves into guessing the technological future in approximately 10 years.

In this sense, Roger Halbheer, Microsoft Security Advisor “… is committed to holograms, replacing flat screens but, in any case, these new technologies must be in a safe and protected environment.” And Igor Lyapunov talks to us about the Skynet system from the Terminator movie as something “…that is no longer a science fiction movie”. Steven Wozniak, co-founder of Apple Computer, whom we all know, was very interested in emphasizing artificial intelligence saying that “… we should not push technology into areas of thinking for us, especially for itself. Talking about machines that think for themselves is a very bad concept.”

Astronaut Pyotr Dubrov leaned into his field of work and said “… that for example, the study of the nature of gravitation could help us to acquire a totally new way of traveling to distant planets.”

Finally, according to a series of training sessions carried out in test environments, CyberPolygon 2021 recommends:

• Make greater efforts in integration and continuous deployment
• Develop skills in the administration of Linux systems and containerized applications.
• Comprehensive study on how to avoid cyber threats in companies
• A working action plan is the key ingredient to a successful incident response.
• A strategy helps an organization save time and minimize damage in the event of an attack.

More articles by Luis López in English

More artilces by Luis López in Spanish