Security Teams Face Burnout Amid Fight Against Geopolitically Motivated Attacks


Security teams today are facing endless waves of cyberattacks. They continue to reel from pandemic disruptions and burnout while bracing for a barrage of cyberattacks. Many of those attacks are geopolitically motivated – specifically, tied to Russia’s invasion of Ukraine. In fact, according to VMware’s eighth annual Global Incident Response Threat Report, 65% of defenders state that cyberattacks have increased since Russia invaded Ukraine of February 24.

Many of the cyber attacks are directly related to Russia’s Ukraine campaign.  Leading up to the invasion, Russian cyberattacks hit Ukraine’s largest gas retailer, their defense ministry’s website and at least 21 companies involved in the liquefied natural gas industry. This included Chevron, Cheniere Energy and Kinder Morgan. New malware and exploits targeting Ukrainian government networks, domestic telecom companies and other critical infrastructure continued after the invasion.

Zero-day exploits also are showing no signs of abatement after record levels last year. A little less than two-thirds of respondents said they experienced such attacks in the past 12 months, up from 51% in 2021. This surge is also attributed to largely to geopolitical conflict.

The report shined a light on emerging threats such as deepfakes. Deepfake attacks rose by 13% with 66% of respondents saying they witnessed them in the past 12 months. Email was the top delivery method at more than three-fourths, for such attacks, which corresponds with the rise in BECs. From 2016 to 2021, BEC incidents cost organizations an estimated $43.3 billion, according to the FBI.

“Cybercriminals have evolved beyond using synthetic video and audio,” said Rick McElroy, principal cybersecurity strategist at VMware. “Their new goal is to use deepfake technology to compromise organizations and gain access to their environment.”

APIs are also increasingly under threat – 23% of all attacks seen by respondents in the past 12 months compromised API security. Breached systems can be used to distribute attacks, known as progressive API attacks.

With rising threats, incident responders are fighting back and 87% saying that they are able to disrupt a cybercriminal’s activities sometimes or very often. However, they need to be able to perform even better if they hope to continue to repel threats. Security teams need more visibility across today’s widening attack surfaces to be better equipped to weather the storm.

To do this, security teams should:

  • Focus on workloads holistically. Companies must understand the inner workings of their entire workload.
  • Inspect in-band traffic. Many modern attacks succeed by disguising themselves as legitimate IT practices.
  • Integrate network detection and response with endpoint detection and response.
  • Embrace Zero Trust principles. This broad approach to security assumes every digital transaction could be dangerous.
  • Conduct continuous threat hunting. Security teams should assume attackers have multiple avenues into their organization.

Just as security teams were feeling a calm from pandemic disruptions, an endless wave of threats came in full force, and have not slowed down. As long as security teams have more visibility of the widening attack surface, they will be better equipped to defeat the bad actors and prevent successful attacks.

Edited by Erik Linask
Get stories like this delivered straight to your inbox. [Free eNews Subscription]

TechZone360 Editor

Related Articles

Shabodi Accelerates Adoption of Network-Aware Applications with CAMARA API Enterprise Reference Implementation

By: Special Guest    2/16/2024

Shabodi, an Application Enablement Platform (AEP) provider unleashing advanced network capabilities in LTE, 5G, 6G, and Wi-Fi 6, announced they have l…

Read More

How Much Does Endpoint Protection Cost? Comparing 3 Popular Solutions

By: Contributing Writer    2/2/2024

Endpoint protection, also known as endpoint security, is a cybersecurity approach focused on defending computers, mobile devices, servers, and other e…

Read More

What Is Databricks? Simplifying Your Data Transformation

By: Contributing Writer    2/2/2024

Databricks is an innovative data analytics platform designed to simplify the process of building big data and artificial intelligence (AI) solutions. …

Read More

What Is Blue/Green deployment?

By: Contributing Writer    1/17/2024

Blue/green deployment is a software release management strategy that aims to reduce downtime and risk by running two identical production environments…

Read More

The Threat of Lateral Movement and 5 Ways to Prevent It

By: Contributing Writer    1/17/2024

Lateral movement is a term used in cybersecurity to describe the techniques that cyber attackers use to progressively move through a network in search…

Read More