Three Ways to Take Home the Gold When It Comes to Cybersecurity at the Olympics

The Winter Olympics have officially kicked off in Pyeongchang, South Korea – where the best athletes from around the world showcase their talents and vie for Gold as they represent their countries on the world stage.Although sometimes overlooked, the Olympic Games – and other high-profile events – become ground zero for another global talent race: cybercrime.

The Olympics are a massive undertaking – requiring additional help to be recruited to make sure the host-city is able to accommodate all of the athletes and attendees, under a tight timeline (i.e. building and maintaining the Olympic Village, stadiums, public transportation and lodging). Additional help is also required of the organizations who are broadcasting, sponsoring and advertising the Games. These professionals are not necessarily security experts, which attackers are both aware of and ready to take advantage of.

With the threat landscape and complexity of attacks continually increasing, here are the top three ways to go for the gold when it comes to getting you, your organization and your customers cyber-secure for the Olympic Games:

1) Put a Training Timeline in Place

Just as the cyclical nature of the Olympic Games presents a timeline for malicious actors to design their attacks around, it provides host-city organizations, attending organizations, and participating organizations a two-year timeline to develop threat intelligence. Organizations should be utilizing this timeline to their advantage: it gives them the (rare) opportunity to prepare for attack.

It’s best to put timeline in place to plan ahead and actually train for the likely attack scenarios, as well as preparing a response strategy in anticipation of when the unexpected happens. This two-year timeline leaves no excuse for putting cyber defenders in a position where they experience their first cyberattack scenario when it happens in real-life – requiring them to combat aggressive attackers under pressure (and manage it effectively). Instead, take advantage of the time in between each event to provide cyber defenders with real-life training scenarios, so they can be properly prepared for combat. Tokyo is following this best-practice and is already providinghands-on simulated training for cybersecurity professionals and citizens in preparation for the 2020 Tokyo Olympic and Paralympic games.

2) Evaluate and Identify Your Attack Surface

It’s important to realize that cybercrime is not getting smaller, as the attack surface continues to morph and grow. Therefore, it is critical to determine your own attack surface (which directly relates to your engagement level) – and then ensure that this surface is protected.

The first important step towards assessing your attack surface is identifying the likely targets for the events in question. This will most likely depend on where your engagement with the event exists. Are you a sponsor, are you engaging in business at the event with potential customers at risk, or did you send employees? Individuals often overlook that major events are a major risk –  even if the individual isn’t officially participating themselves. Why? The individual could still have high-value internal resources or employees that will be engaged or participate with the event. For example, is one of your C-level executives will be at the Olympics in South Korea? What preparation have you done to insulate that asset from potential threats at the event – whether they be physical or cyber? It’s time to think ahead and be on the offensive side of the equation.

3) Implement Training at the Individual Level Based on Attack Surface

Depending on the surface area of your attack surface, here are recommended, proactive approaches to ensure protection during future Olympics Games:

Hold a security training class for all employees planning to attend the Olympic Games

Educate attendees about the vulnerabilities associated with the Olympic Village and Stadiums. It will be important to explain that malicious actors are rethinking their approach to cyberattacks and how they execute on them. Thinking about the current trends in cybersecurity – here are two areas to focus on with attendees: 1) identify where IT links to OT or IoT within Olympic sites, and 2) beware of phishing scams and entering through the least protected link.

Secure your CEO

40 percent of organizations believe that C-level executives are the greatest risk to their organization being hacked. Furthermore, C-level executives are the most at-risk of cyberattacks when working outside the office – with airports, hotels and airplanes among the riskiest venues. If your CEO or members of your C-Suite are attending the event, hold a training seminar before they depart for the event to educate them about the threats associated with attending the Games – from “Checking-in” to the host city on social media to connecting to unsecured Wi-Fi during their travel and stay. In addition, pull together a one-pager with security tips and official sites for them to reference while they are abroad.

Educate all employees/customers of the vulnerabilities associated with digitally engaging with the Olympic Games

Make sure your employees and customers are aware of all of the phishing and malware campaigns associated with digitally engaging with the Games. With the Games happening overseas, it is imperative that they know the signs and can differentiate what is safe and what is not. This can be applied to planning to joining social media conversations around the events, purchasing merchandise, or even streaming content from their devices.

The Takeaway

Start planning now for the events on the horizon; hopefully you thought ahead for Pyeongchang – but remember Tokyo 2020 isn’t that far way. Plan, train, evolve from tabletop exercises to cyber simulators, educate your employees on the threats and have a plan for response. At the end of the day, athletes don’t win because they just show up – they win because of the rigorous training, planning, and relentless execution that comes from true focus on the objective. For this month’s Games and all that come after, we need to become World Class Cyber Athletes.

About the author: Ben Carr, is the VP of Strategy at Cyberbit. Ben is an information security and risk executive and thought leader with more than 20 years of results driven experience in developing and executing long-term security strategies.

Copyright 2010 Respective Author at Infosec Island via Infosec Island Latest Articles "http://ift.tt/2ByUzmf"