A cyberattack (or cyber attack) is any offensive maneuver that targets computer information systems, computer networks, infrastructures, personal computer devices,[1] or smartphones. An attacker is a person or process that attempts to access data, functions, or other restricted areas of the system without authorization, potentially with malicious intent.[2] Depending on the context, cyberattacks can be part of cyber warfare or cyberterrorism. A cyberattack can be employed by sovereign states, individuals, groups, societies or organizations and it may originate from an anonymous source. A product that facilitates a cyberattack is sometimes called a cyber weapon. Cyberattacks have increased over the last few years. A well-known example of a cyberattack is a distributed denial of service attack.
A cyberattack may steal, alter, or destroy a specified target by hacking into a private network or otherwise susceptible system.[3] Cyber Attacks can range from installing spyware on a personal computer to attempting to destroy the infrastructure of entire nations. Legal experts are seeking to limit the use of the term to incidents causing physical damage, distinguishing it from the more routine data breaches and broader hacking activities.[4]
Cyberattacks have become increasingly sophisticated, hazardous,[5] and expensive to recover from.[6]
Since the late 1980s, cyberattacks have evolved several times to use innovations in information technology as vectors for committing cybercrimes. In recent years, the scale and robustness of cyberattacks have increased rapidly, as observed by the World Economic Forum in its 2018 Global Risks Report wrote: "Offensive cyber capabilities are developing more rapidly than our ability to deal with hostile incidents".[7]
an assault on system security that derives from an intelligent threat, i.e., an intelligent act that is a deliberate attempt (especially in the sense of a method or technique) to evade security services and violate the security policy of a system.
Any kind of malicious activity that attempts to collect, disrupt, deny, degrade, or destroy information system resources or the information itself.
The increasing dependency of modern society on information and computer networks (both in private and public sectors, including the military)[10][11][12] has led to new terms like cyber attack and cyber warfare.
CNSS Instruction No. 4009[9] define a cyber attack as:
An attack, via cyberspace, targets an enterprise's use of cyberspace for the purpose of disrupting, disabling, destroying, or maliciously controlling a computing environment/infrastructure; or destroying the integrity of the data or stealing controlled information.
As cars begin to adopt more technology, cyber attacks are becoming a security threat to automobiles.[13]
Prevalence
In the first six months of 2017, two billion data records were stolen or impacted by cyber attacks, and ransomware payments reached US$2 billion, double that in 2016.[14] In 2020, with the increase of remote work as an effect of the COVID-19 global pandemic, cybersecurity statistics reveal a huge increase in hacked and breached data.[15] The worldwide information security market is forecast to reach $170.4 billion in 2022.[16] Companies in 2023 saw an increase in email cyber attacks as Forbes reports 94% of companies dealt with issues.[17] As Cyber attacks continue to become more prevalent so will the monetary impact of these attacks. Esentire reports that the monetary impact of cyber attacks will continue to grow and they forecast that in 2025 the impact will be north of 10 trillion dollars.[18]
Cyber warfare utilizes techniques of defending and attacking information and computer networks that inhabit cyberspace, often through a prolonged cyber campaign or series of related campaigns. It denies an opponent's ability to do the same while employing technological instruments of war to attack an opponent's critical computer systems. Cyberterrorism, on the other hand, is "the use of computer network tools to shut down critical national infrastructures (such as energy, transportation, government operations) or to coerce or intimidate a government or civilian population".[19] That means the result of both cyber warfare and cyberterrorism is the same, to damage critical infrastructures and computer systems linked together within the confines of cyberspace.
The financial crime expert Veit Buetterlin explained that organizations, including state actors, which cannot finance themselves through trade because of imposed sanctions, conduct cyber attacks on banks to generate funds.[20]
Motivations
Motivations takes a look at the reasoning behind cyberattacks. Three common motivations include but are not limited to political, personal,[21] and financial reasons.[22]
Political
Also known as Hacktivism, cyberterrorism, or cyberwarfare,[21] some cyberattacks are “hacking for a cause".[23] With the Russo-Ukrainian War starting in 2014, there has been an increase in political cyberattacks.[21] These attacks have either been sponsored by their government, such as the North Korean-sponsored group Lazarus Group,[24] or they have been carried out by anti-establishment protesters like Anonymous.[25] Cyberattacks is a popular form of attack among terrorists or activists for the extensive damages it can cause to their targets and the attention it can generate.[26] These attacks also cause the target organization and the public to panic.[26]
Personal
Some attacks may be motivated for personal gain.[21] Hackers within a subculture that encourage such activities may attempt to show off their technical skills by shutting down or causing as much damage as possible to a company’s websites for validation from their peers.[27] Some attackers may also just be disgruntled employees.[21]
Financial
One common reason behind cyberattacks is for financial reasons.[22] Some individuals may be in insecure social or economic situations and may see ransoming a company as a viable option for money. Because malware-for-services have become more affordable in the past years, it has become more accessible to buy ransomware[22] and use them to commit cybercrimes. The attacker evaluates between risk and reward to determine their motivation and targets.[28]
Ethical hackers, either working on their own or employed by government agencies or the military, can find computer systems with vulnerabilities lacking the appropriate security software. Once those vulnerabilities are found, they can infect systems with malicious code and then remotely control the system or computer by sending commands to view content or to disrupt other computers. There needs to be a pre-existing system flaw within the computer such as no antivirus protection or faulty system configuration for the viral code to work.
Many ethical hackers will promote themselves to cyber terrorists, for financial gain or other reasons.[29] This means a new set of rules govern their actions. Cyberterrorists have premeditated plans and their attacks are not born of rage.[30] They need to develop their plans step-by-step and acquire the appropriate software to carry out an attack. They usually have political agendas, targeting political structures. Cyberterrorists are hackers with a political motivation, their attacks can impact political structure through this corruption and destruction.[30] They also target civilians, civilian interests, and civilian installations. As previously stated, cyberterrorists attack persons or property and cause enough harm to generate fear.
An "active attack" attempts to alter system resources or affect their operation.
A "passive attack" attempts to learn or make use of information from the system but does not affect system resources (e.g., wiretapping).
An attack can be perpetrated by an insider or from outside the organization;[8]
An "inside attack" is an attack initiated by an entity inside the security perimeter (an "insider"), i.e., an entity that is authorized to access system resources but uses them in a way not approved by those who granted the authorization.
An "outside attack" is initiated from outside the perimeter, by an unauthorized or illegitimate user of the system (an "outsider"). In the Internet, potential outside attackers range from amateur pranksters to organized criminals, international terrorists, and hostile governments.[8]
A resource (both physical or logical), called an asset, can have one or more vulnerabilities that can be exploited by a threat agent in a threat action. As a result, the confidentiality, integrity or availability of resources may be compromised. Potentially, the damage may extend to resources in addition to the one initially identified as vulnerable, including further resources of the organization, and the resources of other involved parties (customers, suppliers).
The attack can be active when it attempts to alter system resources or affect their operation: so it compromises integrity or availability. A "passive attack" attempts to learn or make use of information from the system but does not affect system resources: so it compromises confidentiality.
A threat is a potential for violation of security, which exists when there is a circumstance, capability, action or event that could breach security and cause harm. That is, a threat is a possible danger that might exploit a vulnerability. A threat can be either "intentional" (i.e., intelligent; e.g., an individual cracker or a criminal organization) or "accidental" (e.g., the possibility of a computer malfunctioning, or the possibility of an "act of God" such as an earthquake, a fire, or a tornado).[8]
A set of policies concerned with information security management, the information security management systems (ISMS), has been developed to manage, according to risk management principles, the countermeasures in order to accomplish to a security strategy set up following rules and regulations applicable in a country.[31]
An attack should lead to a security incident i.e. a security event that involves a security violation. In other words, a security-relevant system event in which the system's security policy is disobeyed or otherwise breached.
The overall picture represents the risk factors of the risk scenario.[32]
An organization should take steps to detect, classify and manage security incidents. The first logical step is to set up an incident response plan and eventually a computer emergency response team.
An attack usually is perpetrated by someone with bad intentions: black hatted attacks falls in this category, while other perform penetration testing on an organization information system to find out if all foreseen controls are in place.
The attacks can be classified according to their origin: I.E. if it is conducted using one or more computers: in the last case is called a distributed attack. Botnets are used to conduct distributed attacks.
Other classifications are according to the procedures used or the type of vulnerabilities exploited: attacks can be concentrated on network mechanisms or host features.
Some attacks are physical: i.e. theft or damage of computers and other equipment. Others are attempts to force changes in the logic used by computers or network protocols in order to achieve unforeseen (by the original designer) result but useful for the attacker. Software used to for logical attacks on computers is called malware.
A distributed denial of service attack is an attempt made by a hacker to block access to a server or a website that is connected to the Internet. This is achieved using multiple computerized systems, which overloads the target system with requests, making it incapable of responding to any query.[34]
In detail, there are a number of techniques to utilize in cyberattacks and a variety of ways to administer them to individuals or establishments on a broader scale. Attacks are broken down into two categories: syntactic attacks and semantic attacks. Syntactic attacks are straightforward; it is considered malicious software which includes viruses, worms, and Trojan horses.
A virus is a self-replicating program that can attach itself to another program or file in order to reproduce. The virus can hide in unlikely locations in the memory of a computer system and attach itself to whatever file it sees fit to execute its code. It can also change its digital footprint each time it replicates making it harder to track down in the computer.
A worm does not need another file or program to copy itself; it is a self-sustaining running program. Worms replicate over a network using protocols. The latest incarnation of worms make use of known vulnerabilities in systems to penetrate, execute their code, and replicate to other systems such as the Code Red II worm that infected more than 259 000 systems in less than 14 hours.[36] On a much larger scale, worms can be designed for industrial espionage to monitor and collect server and traffic activities then transmit it back to its creator.
A Trojan horse is designed to perform legitimate tasks but it also performs unknown and unwanted activity. It can be the basis of many viruses and worms installing onto the computer as keyboard loggers and backdoor software. In a commercial sense, Trojans can be imbedded in trial versions of software and can gather additional intelligence about the target without the person even knowing it happening. All three of these are likely to attack an individual and establishment through emails, web browsers, chat clients, remote software, and updates.
Semantic attacks
Semantic attack is the modification and dissemination of correct and incorrect information. Information modified could have been done without the use of computers even though new opportunities can be found by using them. To set someone in the wrong direction or to cover your tracks, the dissemination of incorrect information can be utilized.
Cyberattacks by and against countries
In Q2 of 2013, Akamai Technologies reported that Indonesia topped China with a portion 38 percent of cyber attacks, an increase from the 21 percent portion in the previous quarter. China was at 33 percent and the US at 6.9 percent. 79 percent of attacks came from the Asia Pacific region. Indonesia dominated the attacking to ports 80 and 443 by about 90 percent.[37]
China's People's Liberation Army (PLA) has developed a strategy called "Integrated Network Electronic Warfare" which guides computer network operations and cyber warfare tools. This strategy helps link together network warfare tools and electronic warfare weapons against an opponent's information systems during the conflict. They believe the fundamentals for achieving success is about seizing control of an opponent's information flow and establishing information dominance.[41]The Science of Military and The Science of Campaigns both identify enemy logistics systems networks as the highest priority for cyberattacks and states that cyber warfare must mark the start of a campaign, used properly, can enable overall operational success.[41] Focusing on attacking the opponent's infrastructure to disrupt transmissions and processes of information that dictate decision-making operations, the PLA would secure cyber dominance over their adversary. The predominant techniques that would be utilized during a conflict to gain the upper hand are as follows, the PLA would strike with electronic jammers, electronic deception, and suppression techniques to interrupt the transfer processes of information. They would launch virus attacks or hacking techniques to sabotage information processes, all in the hopes of destroying enemy information platforms and facilities. The PLA's Science of Campaigns noted that one role for cyber warfare is to create windows of opportunity for other forces to operate without detection or with a lowered risk of counterattack by exploiting the enemy's periods of "blindness", "deafness" or "paralysis" created by cyberattacks.[41] That is one of the main focal points of cyber warfare, to be able to weaken your enemy to the full extent possible so that your physical offensive will have a higher percentage of success.
The PLA conducts regular training exercises in a variety of environments emphasizing the use of cyber warfare tactics and techniques in countering such tactics if it is employed against them. Faculty research has been focusing on designs for rootkit usage and detection for their Kylin Operating System which helps to further train these individuals' cyber warfare techniques. China perceives cyber warfare as a deterrent to nuclear weapons, possessing the ability for greater precision, leaving fewer casualties, and allowing for long-ranged attacks.
On March 2, 2021, Microsoft released an emergency security update to patch four security vulnerabilities that had been used by Hafnium, a Chinese nation-state-sponsored hacking group that had compromised at least 30,000 public and private Microsoft exchange servers.[42]
The 2007 cyberattacks on Estonia were a series of cyberattacks that began on 27 April 2007 and targeted websites of Estonian organizations, including Estonian parliament, banks, ministries, newspapers, and broadcasters, amid the country's disagreement with Russia about the relocation of the Bronze Soldier of Tallinn, an elaborate Soviet-era grave marker, as well as war graves in Tallinn.[43][44] The attacks triggered a number of military organizations around the world to reconsider the importance of network security to modern military doctrine. The direct result of the cyberattacks was the creation of the NATO Cooperative Cyber Defence Centre of Excellence in Tallinn.
Ethiopia
In an extension of a bilateral dispute between Ethiopia and Egypt over the Grand Ethiopian Renaissance Dam, Ethiopian government websites have been hacked by the Egypt-based hackers in June 2020.[45]
There were two such instances between India and Pakistan that involved cyberspace conflicts, starting in the 1990's. Earlier cyber attacks came to be known as early as 1999.[30] Since then, India and Pakistan were engaged in a long-term dispute over Kashmir which moved into cyberspace. Historical accounts indicated that each country's hackers have been repeatedly involved in attacking each other's computing database system. The number of attacks has grown yearly: 45 in 1999, 133 in 2000, 275 by the end of August 2001.[30] In 2010, Indian hackers laid a cyber attack at least 36 government database websites going by the name "Indian Cyber Army".[46] In 2013, Indian hackers hacked the official website of Election Commission of Pakistan in an attempt to retrieve sensitive database information.[47] In retaliation, Pakistani hackers, calling themselves "True Cyber Army" hacked and defaced ~1,059 websites of Indian election bodies.[47]
According to the media, Pakistan's has been working on effective cyber security systems, in a program called the "Cyber Secure Pakistan" (CSP).[49] The program was launched in April 2013 by the Pakistan Information Security Association and the program has expanded to country's universities.
In 2020, according to the Media reports, Pakistan Army confirms the series of Cyber Attacks that has been identified on Pakistani Government and private websites by the Indian Intelligence. ISPR also advised the government and private institutions to enhance cyber security measures.[50]
On the noon of 26 October 2021, a cyberattack caused all 4,300 fuel stations in Iran to disrupt and disable government-issued cards for buying subsidized fuel. This cyber attack also caused digital billboards to display messages against the Iranian government.[52][53]
It was the most significant cybercrime attack on an Irish state agency and the largest known attack against a health service computer system.[58][59] The group responsible was identified as a criminal gang known as Wizard Spider, believed to be operating from Russia.[60][61][62] The same group is believed to have attacked Ireland's Department of Health with a similar cyber attack.
Israel
In April 2020, there were attempts to hack into Israel's water infrastructure of the Sharon central region by Iran, which was thwarted by Israeli cyber defenses. The cyberattack intended to introduce dangerous levels of chlorine into the Israeli water supply.[63]
North Korea
In February 2024 UN sanctions monitors were investigating claims that dozens of cyber attacks that North Korea is suspected of carrying out has raised around $3 billion which is being used to fund and develop it's nuclear weapons program.[64]
In August 2020 the Norwegian parliament Stortinget suffered a cyberattack on the email system belonging to several officials. In December 2020, the Norwegian Police Security Service said the likely perpetrators were the Russian cyber espionage group Fancy Bear.[65]
Russia
During the 2018 FIFA World Cup, Russia countered and stopped around 25 million cyber-attacks on IT Infrastructure.[66][67]
In June 2019, Russia has conceded that it is "possible" its electrical grid is under cyber attack by the United States.[68] The New York Times reported that American hackers from the United States Cyber Command planted malware potentially capable of disrupting the Russian electrical grid.[69]
On 19 October 2020, the US justice department charged six Russian military officers of a worldwide hacking campaign, which attacked targets like French election, the 2018 Winter Olympic Games opening ceremony, US businesses and Ukraine's electricity grid. The campaign was believed to have cost billions of dollars for the mass disruption it caused.[70]
A series of powerful cyber attacks began 27 June 2017, that swamped websites of Ukrainian organizations, including banks, ministries, newspapers and electricity firms. In January 2022, Microsoft disclosed activity of a ransomware and DoS attack on various government agencies and organizations.[71][72]
United Arab Emirates
In 2019, Reuters reported that United Arab Emirates launched a series of cyberattacks on its political opponents, journalists, and human rights activists under Project Raven, on an espionage platform namely Karma. The team included ex-US intelligence agents. Project Raven commenced in 2009 and was planned to be continued for the coming ten years.
United Arab Emirates, used and asked for help from couple of countries providing their best calibres to overcome this crisis, and to confine the damage and consequences upon Project Raven, and indeed big names did participate to help like the American master, Graham Dexter, and the Egyptian phenomenal name in cybersecurity, Elhamy El Sebaey.[73]
United States of America
In 2015. the Office of Personnel Management (OPM) and the Interior Department were hacked, resulting in data breaches of government and security records. Numerous reports claim that Chinese hackers conducted these attacks, as the Chinese government has used hackers to attack and target U.S. military networks the year prior.[74][75] In 2024, cyber-tensions remain between the United States and the People's Republic of China, as accusations of hacking the U.S. government continue to arise. Reuters claims that cyber-espionage operations have been attacking the U.S. infrastructure, including the electric grid, water plants, oil and gas pipelines, and transportation, placing an increased focus on civilian attacks. Government officials have expressed concern about these attacks, relating them to bombings that have no economic or political gain whatsoever.[76] Though neither of the claims are confirmed by the Chinese government, U.S. officials continue to emphasize Chinese involvement in cyberattacks against their country.
During the 2016 presidential election, an indictment of 12 Russian military intelligence officers revealed that Russian hackers conducted an attack against the Clinton administration that targeted staff and campaign email addresses, following her opponent's, Donald Trump's, discernment of missing emails from Democratic servers on the same day as the attack. Robert S. Mueller, a special counsel of the United States government, claimed that the Russian government was also guilty to laundering money and stealing voter information. Furthermore, he investigated a possible conspiracy between the Russian government and Trump's possible attempt to sway the 2016 election.[77]
In 2023, the United States Government was able to identify and stop an organized attack on numerous computers throughout the states. This attack was taken out by Volt Typhoon, a Chinese hacking group who used its ability to access computers with lowered cyber security to try and infiltrate different American systems.[78]. In April of 2024 , the FBI reports that Volt Typhoon is still a threat and plans to target the US through different cyber attacks in the future.[79]
Consequence of a potential attack
Consequences can include a multitude of direct and indirect effects. In September 2020, media reported of what may be the first publicly confirmed case of a civilian fatality as a nearly direct consequence of a cyberattack, after ransomware disrupted a hospital in Germany.[80]
A whole industry is working to minimize the likelihood and the consequences of a cyberattack.
Many organizations are trying to classify vulnerability and their consequences. The most popular vulnerability database is the Common Vulnerabilities and Exposures.
Once a cyberattack has been initiated, there are certain targets that need to be attacked to cripple the opponent. Certain infrastructures as targets have been highlighted as critical infrastructures in times of conflict that can severely cripple a nation. Control systems, energy resources, finance, telecommunications, transportation, and water facilities are seen as critical infrastructure targets during conflict. A new report on the industrial cybersecurity problems, produced by the British Columbia Institute of Technology, and the PA Consulting Group, using data from as far back as 1981, reportedly has found a 10-fold increase in the number of successful cyber attacks on infrastructure Supervisory Control and Data Acquisition (SCADA) systems since 2000.[81] Cyberattacks that have an adverse physical effect are known as cyber-physical attacks.[82]
Control systems
Control systems are responsible for activating and monitoring industrial or mechanical controls. Many devices are integrated with computer platforms to control valves and gates to certain physical infrastructures. Control systems are usually designed as remote telemetry devices that link to other physical devices through internet access or modems. Little security can be offered when dealing with these devices, enabling many hackers or cyberterrorists to seek out systematic vulnerabilities. Paul Blomgren, manager of sales engineering at cybersecurity firm explained how his people drove to a remote substation, saw a wireless network antenna and immediately plugged in their wireless LAN cards. They took out their laptops and connected to the system because it wasn't using passwords. "Within 10 minutes, they had mapped every piece of equipment in the facility," Blomgren said. "Within 15 minutes, they mapped every piece of equipment in the operational control network. Within 20 minutes, they were talking to the business network and had pulled off several business reports. They never even left the vehicle."[83]
Energy
Energy is seen as the second infrastructure that could be attacked.[84] It is broken down into two categories, electricity and natural gas. Electricity also known as electric grids power cities, regions, and households; it powers machines and other mechanisms used in day-to-day life. Using US as an example, in a conflict cyber terrorists can access data through the Daily Report of System Status that shows power flows throughout the system and can pinpoint the busiest sections of the grid. By shutting those grids down, they can cause mass hysteria, backlog, and confusion; also being able to locate critical areas of operation to further attacks in a more direct method. Cyberterrorists can access instructions on how to connect to the Bonneville Power Administration which helps direct them on how to not fault the system in the process. This is a major advantage that can be utilized when cyberattacks are being made because foreign attackers with no prior knowledge of the system can attack with the highest accuracy without drawbacks. Cyberattacks on natural gas installations go much the same way as it would with attacks on electrical grids. Cyberterrorists can shutdown these installations stopping the flow or they can even reroute gas flows to another section that can be occupied by one of their allies. There was a case in Russia with a gas supplier known as Gazprom, they lost control of their central switchboard which routes gas flow, after an inside operator and Trojan horse program bypassed security.[83]
Wind farms, both onshore and offshore, are also at risk from cyber attacks. In February 2022, a German wind turbine maker, Enercon, lost remote connection to some 5,800 turbines following a large-scale disruption of satellite links. In April 2022, another company, Deutsche Windtechnik, also lost control of roughly 2,000 turbines because of a cyber-attack. While the wind turbines were not damaged during these incidents, these attacks illustrate just how vulnerable their computer systems are.[85]
Finance
Financial infrastructures could be hit hard by cyberattacks as the financial system is linked by computer systems.[3] Money is constantly being exchanged in these institutions and if cyberterrorists were to attack and if transactions were rerouted and large amounts of money stolen, financial industries would collapse and civilians would be without jobs and security. Operations would stall from region to region causing nationwide economic degradation. In the U.S. alone, the average daily volume of transactions hit $3 trillion and 99% of it is non-cash flow.[83] To be able to disrupt that amount of money for one day or for a period of days can cause lasting damage making investors pull out of funding and erode public confidence.
A cyberattack on a financial institution or transactions may be referred to as a cyber heist. These attacks may start with phishing that targets employees, using social engineering to coax information from them. They may allow attackers to hack into the network and put keyloggers on the accounting systems. In time, the cybercriminals are able to obtain password and keys information. An organization's bank accounts can then be accessed via the information they have stolen using the keyloggers.[86] In May 2013, a gang carried out a US$40 million cyber heist from the Bank of Muscat.[87]
Transportation
Transportation infrastructure mirrors telecommunication facilities: by impeding transportation for individuals in a city or region, the economy will slightly degrade over time. Successful cyber attacks can impact scheduling and accessibility, creating a disruption in the economic chain. Carrying methods will be impacted, making it hard for cargo to be sent from one place to another. In January 2003 during the "slammer" virus, Continental Airlines was forced to shut down flights due to computer problems.[83] Cyberterrorists can target railroads by disrupting switches, target flight software to impede airplanes, and target road usage to impede more conventional transportation methods. In May 2015, a man, Chris Roberts, who was a cyber consultant, revealed to the FBI that he had repeatedly, from 2011 to 2014, managed to hack into Boeing and Airbus flights' controls via the onboard entertainment system, allegedly, and had at least once ordered a flight to climb. The FBI, after detaining him in April 2015 in Syracuse, had interviewed him about the allegations.[88]
Water
Water as an infrastructure could be one of the most critical infrastructures to be attacked. It is seen as one of the greatest security hazards among all of the computer-controlled systems. There is the potential to have massive amounts of water unleashed into an area which could be unprotected causing loss of life and property damage. Even water supplies could be attacked; sewer systems can be compromised too. There was no calculation given to the cost of damages, but the estimated cost to replace critical water systems could be in the hundreds of billions of dollars.[83] Most of these water infrastructures are well developed making it hard for cyberattacks to cause any significant damage, at most, equipment failure can occur causing power outlets to be disrupted for a short time.
In 2024, multiple US water facilities had their industrial equipment compromised by hackers to display anti-Israel messages. Although no major damage has been inflicted, it has revealed US water facilities are experiencing lack of funding and resources to patch security vulnerabilities in their infrastructure.[89]
Waste management
In addition to water facilities, waste management facilities can also be and have been targets of cyberattacks.
In 2023, the Radio Waste Management (RWM) company, owned by the United Kingdom government, experienced an unsuccessful cybersecurity breach through the use of LinkedIn. The attack attempted to identify and access the people who are part of the business.[90]
In 2023, Sellafield, the UK's largest and most hazardous nuclear waste disposal site, had been targeted by foreign hackers, linked to Russia and China. Sleeper malware was discovered inside of the site's networks, and it is unknown how long it had been installed or if it had been fully removed. The full extent of the weak security was exposed when staff found they could access Sellafield's servers from outside the site. Reports in 2012 and 2015 reported that the company and senior management have been aware of the security vulnerabilities but failed to report or spend resources to address these vulnerabilities. Sellafield's sensitive documents, such as foreign attack or disaster emergency defense plans and radioactive waste management, may have been compromised.[91]
It is possible for smaller scale electronics in e-waste to become targets of cyberattacks. The PwC estimates that globally by 2030, the amount of Internet of Things (IoT) devices owned around the world would reach over 25 billion, and of that, 70 million tonnes of e-waste will be generated and disposed of. Although only based on anecdotal evidence, it's estimated the majority of this e-waste is improperly disposed of, allowing the components of these devices to retain sensitive information and personal data. Cyber criminals may target e-waste of individuals or organizations to gain access to sensitive data that isn't as securely guarded as active devices.[92]
Hospitals and Medical Facilities
Hospital as an infrastructure is one of the major assets to have been impacted by cyber attacks. These attacks could "directly lead to deaths." The cyberattacks are designed to deny hospital workers access to critical care systems. Recently, there has been a major increase of cyberattacks against hospitals amid the COVID-19 pandemic. Hackers lock up a network and demand ransom to return access to these systems. The ICRC and other human rights group have urged law enforcement to take "immediate and decisive action" to punish such cyber attackers.[93]
Hospitals and medical facilities have seen an increase in ransomware attacks in which criminals encode Protected Health Information (PHI) and other private identifiable information. When the ransom is paid, the money is exchanged for a key to decode the information and to return the stolen data.[94] Access points into hospital infrastructure are often through third party companies that hospitals may contract jobs through. The HIPAA Omnibus Rule created in 2013 requires that all business contracted to perform work for the hospital where patient information could be involved would be required to be held to the same standards of security.[95] An increasingly common access point has been through camera and security systems that are being added to the hospitals network. As more outside companies and devices become connected through the internet, the risks for cyberattacks increases. During the COVID- 19 pandemic an increase in attacks was noted. Researchers concluded that this was the result of increased remote work in which hospital staff had more devices connected to networks increasing potential areas of vulnerability.[96] One tactic that has been effective in preventing cyberattacks in the healthcare industry is the Zero Trust method. In this model, all users known and unknown are viewed as a potential threat and requires everyone to verify their identity with the appropriate credentials.[94]
With an increased use of Electronic Medical Records (EMR) comes an increased need for security to protect patient information and privacy.[95] When a hospital experiences a data breach in the United States, the facility is required to report the breach to the people impacted under the Health Information Technology for Economic and Clinical Health Act, also called HITECH ACT, as it has the Breach Notification Rule. The rule states that facilities are required to report data breaches if the facility provides patient care under HIPAA guidelines. The Health Insurance Portability and Accountability Act protects patient's right to privacy regarding their Protected Health Information (PHI).[97] Accessing PHI can be very lucrative for cybercriminals as this information can contain home addresses, social security numbers, banking information, and other personally identifiable information.[94]
^Cortada, James W. (4 December 2003). The Digital Hand: How Computers Changed the Work of American Manufacturing, Transportation, and Retail Industries. USA: Oxford University Press. p. 512. ISBN978-0-19-516588-3.
^Cortada, James W. (3 November 2005). The Digital Hand: Volume II: How Computers Changed the Work of American Financial, Telecommunications, Media, and Entertainment Industries. USA: Oxford University Press. ISBN978-0-19-516587-6.
^Cortada, James W. (6 November 2007). The Digital Hand, Vol 3: How Computers Changed the Work of American Public Sector Industries. USA: Oxford University Press. p. 496. ISBN978-0-19-516586-9.
^Lewis, James. United States. Center for Strategic and International Studies. Assessing the Risks of Cyber Terrorism, Cyber War and Other Cyber Threats. Washington, D.C.:, 2002. Web.
^ abcTraer, Scott; Bednar, Peter (2021). "Motives Behind DDoS Attacks". In Metallo, Concetta; Ferrara, Maria; Lazazzara, Alessandra; Za, Stefano (eds.). Digital Transformation and Human Behavior. Lecture Notes in Information Systems and Organisation. Vol. 37. Cham: Springer International Publishing. pp. 135–147. doi:10.1007/978-3-030-47539-0_10. ISBN978-3-030-47539-0.
^Conway, Maura. "Cyberterrorism: Academic Perspectives". 3rd European Conference on Information Warfare and Security: 41–50.
^ abcdPrichard, Janet, and Laurie MacDonald. "Cyber Terrorism: A Study of the Extent of Coverage in Computer Security Textbooks." Journal of Information Technology Education. 3. (2004): n. page. Web.
^Wright, Joe; Jim Harmening (2009). "15". In Vacca, John (ed.). Computer and Information Security Handbook. Morgan Kaufmann Publications. Elsevier Inc. p. 257. ISBN978-0-12-374354-1.
^Caballero, Albert (2009). "14". In Vacca, John (ed.). Computer and Information Security Handbook. Morgan Kaufmann Publications. Elsevier Inc. p. 225. ISBN978-0-12-374354-1.
^ abcKrekel, Bryan. People's Republic of China. The US-China Economic and Security Review Commission.Capability of the People's Republic of China to Conduct Cyber Warfare and Computer Network Exploitation. Virginia: Northrop Grumman, 2009. Web.
^"War in the fifth domain. Are the mouse and keyboard the new weapons of conflict?". The Economist. 1 July 2010. Archived from the original on 5 July 2010. Retrieved 2 July 2010. Important thinking about the tactical and legal concepts of cyber-warfare is taking place in a former Soviet barracks in Estonia, now home to NATO's "centre of excellence" for cyber-defence. It was established in response to what has become known as "Web War 1", a concerted denial-of-service attack on Estonian government, media and bank web servers that was precipitated by the decision to move a Soviet-era war memorial in central Tallinn in 2007.
