Strengthening critical infrastructure through Zero-Trust architecture

by Liam Ryan, VP for Asia Pacific at Ivanti

Source: Ivanti. Ryan.

Cyberattacks have become an increasingly pressing global issue due to technological advancements that have migrated data storage online: 2021 was rife with ransomware and other cyberattacks on crucial supply chains and cyberespionage campaigns by nation-state threat actors.

Despite the damaging effects of recent cyberattacks, critical infrastructure security measures continue to be ineffective and out of date, creating an expanded attack vector for threat actors.

A survey conducted by Ernst & Young showed that although over 50% of companies in Asia Pacific are concerned about the vulnerability of their cybersecurity services, only 0.05% of their annual revenue was allocated to strengthening these services. This could possibly translate to a considerably weaker cybersecurity infrastructure within the region compared to their global counterparts.

The Asia Pacific arm of AXA was struck by a ransomware attack in May 2021, resulting in three terabytes of stolen data from the global insurance company. Such ransomware attacks involving siphoned data could be potentially dangerous as they may be used in criminal activities. Furthermore, as more people steer towards remote working, it is essential for them to possess the ability to access a secure network from their respective locations.

Critical infrastructure continues to be actively targeted by bad actors, given the potential for economic and societal impacts. A recent report identified 32 new ransomware families in 2021, increasing by 26% from the previous year. These ransomware groups continue to target and exploit unpatched vulnerabilities to instigate attacks.

A single supply chain compromise could provide multiple attack vectors for threat actors to hijack an entire network through third-party applications, vendor-specific products and open-source libraries. An attack on these systems could be left undetected, as evident by the SolarWinds hack*, resulting in cyber-physical damage and a business interruption that could cost millions of dollars per day.

Concerns about the security of the supply chain are not a recent development. They date back decades. As cyberattacks on critical infrastructure continue to rise, organisations need to prioritise risk-based patch management, continuous and multifactor authentication and Zero Trust architecture to enhance cyber resilience.

Threat actors take advantage of security gaps within the critical infrastructure to launch sophisticated attacks. Unpatched vulnerabilities are one of the most common exploits for cyberattacks today. The rise in always-on devices and the rapid shift to cloud-based applications will exacerbate security risks from unpatched vulnerabilities.

With risk-based vulnerability prioritisation, organisations can prioritise patching vulnerabilities based on active threat context and impact. Organisations need to be proactive in identifying, understanding and responding to anomalies and vulnerabilities. A risk-based approach accelerates remediation and patch management, allowing organisations to bolster their defences against potential cyberattacks.

Companies in Asia Pacific should adopt a Zero Trust approach to boost the security of their cloud platforms. Zero Trust is an actionable and reliable next step for organisations looking to secure assets in the face of potential cyberattacks as an added layer of protection. Zero Trust architecture ensures all users, devices and networks are authenticated, authorised and validated continuously, reducing the organisation’s attack surface and potential cyberattacks.

Organisations will need to review their existing cybersecurity policies and frameworks to understand their cybersecurity maturity better. By adopting Zero Trust architectures to address their security posture as a whole proactively, organisations can mitigate the potential cyber risks posed by the interconnectedness of critical infrastructure networks and improve overall cyber hygiene.

Governments in the Asia Pacific region are currently tightening cybersecurity-centric measures too. China recently enacted the Data Security Law (DSL), which seeks to augment protection of confidential data by requiring governments to conduct periodic risk assessments of their databases to ensure that they are up-to-date and secure, while the Cyber Security Agency of Singapore (CSA) has launched a framework that requires cybersecurity service providers to be officially licensed.

*Editor's note: In 2020, it was discovered that malware embedded in SolarWinds software had impacted a number of the company's customers. The cyberattack involved the software supply chain, with the malware delivered during routine software updates.