As a result of the mass proliferation of the internet and the fact that much of the developed world's economy and critical infrastructures depend on the internet to function on a daily basis, the resulting scenario has several upsides and downsides in a broad context. The upsides are clearly manyfold, as the internet serves as one of the greatest inventions of our society. The internet, especially now with the digital transformation taking place in recent years, is a tool that connects us all and allows for unprecedented efficiency, innovation, creativity, and communication.
We have become completely accustomed to this everyday tool that we take for granted as much as we do the air we breathe or the electricity that flows through our cities. The downside of such a technological force, and a truly interconnected world, is a looming dark side filled with cybercrime, cyber-attacks, and malicious actors looking to profit on the behalf of innocent victims. Furthermore, cyber-attacks are becoming the new nation-state weapon, where cybercrime is starting to dictate the global risk scenario at the highest levels. It gets worse because cybercrime is no longer anchored solely to the virtual world as it once was.
Specifically, we have seen that malware, ransomware, and botnet attacks are common tools utilized by cybercriminals when cyberattacks spill over into the real world. These facts remind us that it is that moment when we realize how critical proper cybersecurity is for our fundamental security. In a networked world, we have to be very serious about how we approach security because sophisticated and clever cybercriminal opportunists lurk behind every wall with a formidable repertoire of cyber-weaponry.
Cybersecurity And Cybercrime
Cybersecurity itself exists to try to halt cybercrime, protect both individuals and businesses, as well as facilitate a safe cyberspace internet arena for all of us. To borrow from the Berkeley School of Information definition, 'Cybersecurity comprises a set of technologies and practices that ensure the availability, integrity, and confidentiality of information percolating through digital systems, networks, devices, and sensors'.
Cybersecurity is also a paradigm that needs to rapidly evolve, shift and change as it adjusts to cybercrime that follows these same patterns, 'These dynamics make cybersecurity one of the most professionally important and intellectually interesting domains-a true, twenty-first century master problem'. So, a world without cybersecurity means a world without a functional internet. Cyber attacks (cybercrime) have been ranked as the number one global risk, putting them ahead of even natural disasters at this point. Global IT leaders and insurance giants alike agree that global security strategy needs to be focused on cybersecurity in the coming years as threats escalate into the cyber-physical domain, and incidents like nation-state APT (Advanced Persistent Threats) attacks and ransomware troubles are not looking to die down anytime soon.
Cyber-Physical Threats: A Growing Global Peril
As we have mentioned above, the consequences of a globally interconnected digital world coupled with sophisticated cybercrime are that cyber attacks have now transcended into the real world. Yes, what we have been accustomed to seeing in 'hacker flicks' is now reality. Cyber-physical systems (or CPS) are therefore taking the brunt of cybercrime. As IoT (Internet-of-Things) devices that range from tablets to wearables converge with networks and IT systems in a 5G-enabled digitally transformed environment, attacks on CPS systems that cause cyber-physical harm are bound to happen.
For a cybercriminal, his/her daily task revolves around uncovering vulnerable endpoints to attack, disrupt, blackmail, or profit from (what we call ROI or Return on Investment). CPS systems today include sectors such as; healthcare and the industrial industry. As more and more critical infrastructure systems (such as gas, water, industrial, healthcare) become networked and digitally transformed, the cyber-physical risk of real-world disruption arises. Because of the intertwining of the digital and the physical, this can easily equate to subsequent physical harm.
Physical systems in the traditional sense were siloed (separated) are no longer as such, meaning that the digital transformation has pushed critical infrastructures towards a single entry-point -increasing the cybersecurity risks exponentially. Research and statistics estimate that by 2023, CPS-related incidents and organizational damage are likely to surpass $50 billion; loss-of-life compensation, insurance, regulatory fines, damaged brand reputations, and litigation fees. It is not only financial damage though, as the loss of human life eclipses everything else and should be the primary factor why we should be worried.
Real-World Examples of Cyber-Attacks on CPS
There are numerous examples of cyber-attacks translating into real-world harm (sometimes referred to as cyber-kinetic threats). Some of these are;
The Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) has covered several CPS incidents, one of them being disruptions in an industrial plants instrument systems
A recent cyber-attack on the major U.S. oil and gas pipeline was noted as one of the most costly attacks on a national economy
The cyber-attack on the San Francisco MUNI/SFMTA (Municipal Transportation Agency)
An attack on a German steel mill that disrupted control systems and prompted the partial shutdown of the plant
A Russian-based cyber-attack that remotely disabled electrical power to a considerable portion of the nation of Ukraine
A cyber-attack on hospital HVAC systems that were infected with malware and a remote-access program that jeopardized patient safety
An Iranian cyber-attack on the Supervisory Control and Data Acquisition (SCADA) systems of the Bowman Dam in Rye, New York that almost gave the cybercriminal complete control of the operation of the dam
The famous Stuxnet worm which disrupted uranium centrifuges in an Iranian nuclear plant
The Future of Cyber-Physical Cybercrime
Cyber-physical attacks are a big stressor for global insurance companies that are having difficulty ascertaining how to cover such a dynamic risk. This is because the nature of these attacks (whether that be hacktivists, cybercriminals, espionage, or sabotage) is constantly shifting and evolving. The amount of potential attack surfaces, attack vectors, and avenues for cyber-physical attacks is practically infinite. Therefore, such incidents create enormous challenges for risk management departments, corporate boards, and cyber insurance. CPS will only become more and more prevalent, as we drive towards a future of autonomous vehicles, telehealth, connected biological implants, traffic flow sensors, drones, transit systems, and much more.
Cybersecurity knowledge and preparedness are critical for everyone; that means cybersecurity specialist firms, government agencies, authorities, and the average Jane and Joe. CPS is going to grow together with IoT as this is an inevitable trend. To consolidate the cybersecurity of something of such great importance to human health and safety means rethinking the cybersecurity stance from the individual and stakeholder level. Wishful thinking must be thrown out the window, as this is not an area to play around with. The traditional three-pronged cybersecurity approach of data confidentiality, integrity, and availability needs to be remolded so that the highest amount of focus lies on confidentiality. An inadequate security stance concerning cyber-physical attacks will bring dire consequences, therefore building strict access controls and educating the public and workforce on the exact dangers of a networked world is paramount.
