New research from Venafi, a machine identity management software provider, found that 66% of organizations have changed their cybersecurity strategy as a direct response to the conflict between Russia and Ukraine
Released August 24, Venafi’s study focused on the security impact around the increasing number of nation-state attacks and recent shifts in geopolitics. The study found that 64% of respondents suspect their organization has been either directly targeted or impacted by a nation-state cyberattack.
A Perpetual State of Cyberwar
Venafi, in its survey of more than 1,100 security decision makers globally, found that:
- 77% believe we’re in a perpetual state of cyberwar
- 82% believe geopolitics and cybersecurity are intrinsically linked
- 68% have had more conversations with their board and senior management in response to the Russia-Ukraine conflict
- 63% doubt they’d ever know if their organization was hacked by a nation-state
- 64% think the threat of physical war is a greater concern in their country than cyberwar
Kevin Bocek, vice president of Security Strategy & Threat Intelligence at Venafi, put the survey results into context:
“Cyberwar is here. It doesn’t look like the way some people may have imagined that it would, but security professionals understand that any business can be damaged by nation-states. The reality is that geopolitics and kinetic warfare now must inform cybersecurity strategy. We’ve known for years that state-backed APT groups are using cybercrime to advance their nations’ wider political and economic goals.
“Everyone is a target, and unlike a kinetic warfare attack, only you can defend your business against nation-state cyberattacks. There is no cyber-iron dome or cyber-NORAD. Every CEO and board must recognize that cybersecurity is one of the top three business risks for everyone, regardless of industry.”
Machine Identities a Growing Method of Cyberattacks
Venafi reports that the use of machine identities in state-sponsored cyberattacks is growing. Correspondingly, the digital certificates and cryptographic keys that serve as machine identities are the foundation of security for all secure digital transactions, the company said. Thus, machine identities are used by everything from physical devices and to software to communicate securely.
Venafi’s research also reports that Chinese APT groups are conducting cyber espionage to advance China’s international intelligence. Meanwhile, North Korean groups are funneling the proceeds of cybercrime directly to their country’s weapons programs.
As a prime example of the scale and scope of nation-state attacks that leverage compromised machine identities, Venafi notes the SolarWinds attack, which compromised thousands of companies by exploiting machine identities to create backdoors and gain trusted access to key assets.
Venafi also mentions Russia’s recent HermeticWiper attack, which breached numerous Ukrainian entities just days before Russia’s invasion of the country. In this recent example of machine identity abuse, Russia used code signing to authenticate malware.
The only way to reduce risks of machine identity abuse is through a control plane that provides observability, governance and reliability, Venafi asserts.
As Bocek explains the imperative to protecting machine identities from exploitation:
“Nation-state attacks are highly sophisticated, and they often use techniques that haven’t been seen before. This makes them extremely difficult to defend against if protections aren’t in place before they happen. Because machine identities are regularly used as part of the kill chain in nation-state attacks, every organization needs to step up their game. Exploiting machine identities is becoming the modus operandi for nation-state attackers.”
