How to Prepare for Cyber Threats During the Russian Invasion of Ukraine

On Feb. 24, the Russian invasion of Ukraine escalated with the use of conventional warfare, but coordinated cyber conflict has been underway in the region for much longer.

In 2014, Ukraine's Central Election Commission was targeted by threat actors. In December 2015, an attack on the power grid plunged parts of the country into darkness. In June 2017, an attack on tax preparation software in Ukraine using malware dubbed "NotPetya" affected organizations including banks, newspapers, and even radiation monitoring systems at Chernobyl. The effects of NotPetya were not limited to organizations in Ukraine, however, and several global companies faced billions of dollars of impacts.

Most recently, significant threats have emerged since Russia invaded Ukraine. This includes high volumes of distributed denial-of-service (DDoS) attacks; increased malware activity, such as data wiping; targeted and persistent phishing attacks; and disinformation campaigns via SMS messages to induce panic.

All organizations, particularly ones in critical infrastructure sectors, could be affected directly or indirectly by these threats and others likely to arise. While it's too late to create and test business, disaster, and third-party recovery plans during this crisis, existing plans should be invoked. Security and risk management leaders should also apply lessons from previous attacks as well as those currently unfolding to respond to the crisis and prepare for future threats.

Immediate Actions: Demonstrate Calm and Control
In the initial phases of the crisis, the "fog of war" will challenge situational awareness, and panic will increase the risk of mistakes. Security and risk management leaders must ensure they do not add to that fear, uncertainty, and doubt, and instead concentrate on what they can control.

Focus immediate responses on increasing awareness and vigilance to detect and prevent potential threats. Remember, it's just as important to be mindful of the increased stress and pressure facing the organization during this time. A human error due to these forces may have a greater impact on the organization than an actual cyberattack.

Immediate actions for security and risk leaders to undertake include:

Short-Term Actions: Monitor Threats and Act Accordingly
As new cyberattacks unfold over coming days and weeks, it will be critical to rely on threat intelligence tailored for your organization. Threat actors will likely leverage the situation to propagate attacks using known techniques such as targeted phishing, but new techniques may also emerge.

Subscribe to the US Cybersecurity and Infrastructure Security Agency (CISA) (or similar regional government security agency) feeds for updates on threats, and watch for government guidance to prepare for attacks that the organization may not be ready to handle. Set up a task force to monitor vulnerabilities and advisories.

Additional actions in this phase include:

Longer-Term Actions: Learn From Previous Attacks
The NotPetya attack of 2017, which originated in Ukraine but had reverberating effects across the globe, offers lessons for security and risk management leaders on how to act in the mid- to long-term period following the current crisis in Ukraine.

A huge lesson from NotPetya was the need for resilience thinking. When fighting such an attack, organizations must make decisions with incomplete data. No one can initially grasp the full picture of an attack as it's happening, so risk-based analysis with the data at hand will be essential to drive business decisions.

NotPetya also demonstrated the nature of the interconnectedness of assets, both in enterprise and operational settings. Many firms with minute footprints in Ukraine became collateral damage following the NotPetya attack, halting business operations across the globe and causing billions of dollars in damages. It's very likely that there will be similar collateral damage from the ongoing attack. Security and risk leaders must revise security plans to account for interconnected systems and prioritize safety and operational resilience.

Finally, NotPetya showed that alert and operational fatigue will must be managed appropriately. This is a stressful period that may lead to burnout. Mindfulness techniques and work-life balance practices will support efficient decision-making during a challenging time.

Security and risk leaders should consider medium- to long-term actions such as:

Unknown consequences of a crisis like this test the value of business continuity management efforts as well as incident response plans, but it may also highlight their gaps. This is a critical time for security and risk management leaders to remain calm, maintain control, and triage responses to ensure that the organization can remain resilient against threats during this crisis and through others in the future.