3 ms·
I work in infosec department. No we are not, well some are talking about it but that's just silly unless your company 's compromise and resulting loss of reputa
by _8j50 5y ago
I work in infosec department. No we are not, well some are talking about it but that's just silly unless your company 's compromise and resulting loss of reputation somehow benefits the russians, you do business with US gov or have presence in Ukraine.
This is interesting strategic intel but everyday is a day a Russian or some other therest actor is trying to hack us. We operate assuming a breach, if that isn't just b.s. corporate speak then not much has changed.
- tiahura 5y agoInstead of overtly strategic hacking, isn't the more likely scenario a green light being given to Russian-NSO types to ransom and thieve to their hearts' content?
- _8j50 5y agoNot NSO types but regular criminal groups. They already have access to many US orgs just not enough personell to do the hands on keyboard hacking (as opposed to malware). They will do a ton of hacking but it's not like them to do it just for the sake if making noise. They will posture and distract but at any scale thry will have a strategic objective. Be worried about everyone else that is expecting you to waste efforts worrying about russians when you don't have to. What immature teams do is setup too much monitoring, geo block russia,etc... introducing a false sense if security and alert fatigue at the same time. If you haven't already, work on good detections for lateral movement, ransomware and wipers. If you have, just another tuesday.
- rosndo 5y agoUh, the idea is that Russia would use widespread and indiscriminate cyberattacks to punish sanctions. That would make almost everyone a target.
- _8j50 5y agoIt's not in apt28/29 MO (gru/svr) to do that, they outsource to criminals that do this already everyday. Being alert is reasonable but any mature team is already prepared for this. You don't panic when you are prepared is my point. They don't need a war to spread wipers, if you are not ready after wannacry and notpetya...
- bart_spoon 5y agoIt doesn't have to be targeted. NotPetya was a Russian GRU hack aimed at Ukraine that just happened to spillover into becoming the largest worldwide cyber attack in history.
- _8j50 5y agoLike i said, do business in ukraine or related entities then be especially on alert. Companies like maersk did business there during notpetya that had spillover. More alert than usual, IR plans reviewed for this.