Forrester Urges All Businesses To Prepare For Nation-State Cyberattacks – PLAY VIDEOS
February 29, 2024

Forrester Urges All Businesses To Prepare For Nation-State Cyberattacks

The global rising tide of cyber threats from nation-states should be a red flag for private sector security leaders in all industries to prepare for more frequent and brazen attacks in the future, according to Forrester Research.

To help companies prepare for the changing nation-state attack landscape, Forrester unveiled on March 2 a new model to defend themselves and prepare for an expected onslaught of regulations to follow.

Advertisement

Forrester senior analyst and lead author of the report, Allie Mellen, pointed out that 40% of reported cyber operations by country target the private sector. State-sponsored attacks have increased by almost 100% between 2019 and 2022, and their nature has changed — more are carried out for data destruction, denial of service, and financial theft than in previous years.

The Forrester model is built on three steps.

Advertisement

First, understand how nation-states attack organizations. A good starting point is the nation-state escalation ladder available in the model.

“This is a wise approach,” maintained Erich Kron, security awareness advocate at KnowBe4, a security awareness training provider in Clearwater, Fla.

Advertisement

“In the end, for the victim, does it really matter which actor is responsible for an attack that steals money or sensitive information?” he asked.

“Focusing on how these attacks are being performed, especially as cybercrime groups continue to mature, is far more important for most organizations than worrying about the source,” Kron told TechNewsWorld.

Advertisement

“Being aware that you may be a target is important, though, and planning must be a part of the threat models,” he added.

Threat Modeling
Second, construct threat models based on organization-specific nation-state threats.

Advertisement

“Threat models for geopolitical actors are living references of who, what, where, when, why, and how nation-state attackers target your organization,” the report noted. “They help predict future attacker activity, close visibility, and detection gaps, plan future market moves, and provide a tangible reference for executive discussions.”

“Proper threat modeling is absolutely important when talking about nation-state actors,” said Alexis Dorais-Joncas, senior manager for threat research at Proofpoint, an enterprise security company in Sunnyvale, Calif.

Advertisement

“An organization that wants to heighten its defense has to determine which of the hundreds of state-sponsored actors are targeting them. Then it has to prioritize countermeasures to those threats,” Dorais-Joncas told TechNewsWorld.

Advertisement

The third step is to get involved in influencing the narrative around cybersecurity. To do that, security leaders need to know what government jurisdictions have security requirements for their business; manage their relationships with the government through vehicles like information sharing; prepare for geopolitical events ahead of time; and influence legislative proposals before they become regulations.

The report also recommends joining forces with others in an industry to gain some muscle in the legislative process and keeping board members informed about what’s being done about nation-state threats before they come asking about the situation.

Advertisement

Strong Foundation Needed
“I think the Forrester approach is headed in a good direction,” observed James Lively, an endpoint security research specialist with Tanium, an endpoint management provider in Kirkland, Wash.

He added, however, that for the model to be effective, it must be built on top of an already strong foundation. “If your company is having challenges maintaining a compliance or patch efficacy program, then most models are already rendered ineffective,” Lively told TechNewsWorld.

Advertisement

Morgan Demboski, a cyber threat intelligence analyst with IronNet, a network security company in McLean, Va., called Forrester’s model a “smart approach” to contending with the nation-state problem.

“Having a strategic and informed approach when defending against nation-state attacks is critical,” Demboski told TechNewsWorld.”

Advertisement

“The cyber activity and strategic objectives of nation-state threat actors continue to show the interrelationship between the geopolitical and cyber threat landscapes, highlighting the importance of tracking government actions and international relations to assess their potential implications in the cyber domain,” she continued.

“Preparing for organization-specific activity is important since the threats facing different businesses are multi-faceted and differ between sector and region,” she added.

Advertisement

Attacks Not Going Away
Robert Hughes, the chief information security officer at RSA, a cybersecurity company in Bedford, Mass., noted that the Forrester model appears to be very prudent advice.

“It comes down to knowing the risk level your business is facing,” Hughes told TechNewsWorld. “While at some level it’s like trying to protect your home from a missile attack, there is a solid framework to start thinking through the questions and discussion points you should be aware of as a business to consider your risks and start to address them using a multi-pronged strategy.”

Advertisement

“Nation-state attacks are not going away,” he continued. “They are increasing in volume and capability, and we should expect to see more of this, not less, in the next couple of years.”

While the Forrester approach is sound, it’s nothing new, maintained Mike Parkin, a senior technical engineer with Vulcan Cyber, a provider of SaaS for enterprise cyber risk remediation in Tel Aviv, Israel.

Advertisement

“It’s very much the same ideas the cybersecurity community and business, in general, has been pushing towards for years, with an added awareness of state-level threat actors,” Parkin told TechNewsWorld.

“It does reinforce those ideas, though, and that’s a good thing,” he added.

Advertisement

Leave a Reply

Your email address will not be published. Required fields are marked *