3 ms·

As an SWE I do agree somewhat with what you say but this story is not complete. If you look at the attacks on Ukraine and the cybersecurity damage done it was f

As an SWE I do agree somewhat with what you say but this story is not complete. If you look at the attacks on Ukraine and the cybersecurity damage done it was fairly small in the grand scheme of things. Another important thing is that Microsoft helped them to fight back as well, so it was not a terrible investment. Was there any quantifiable risk assessment done to understand the potential damages if Russians carried out similar attacks in the Netherlands?

dralley 2y ago
> As an SWE I do agree somewhat with what you say but this story is not complete. If you look at the attacks on Ukraine and the cybersecurity damage done it was fairly small in the grand scheme of things. It's worth mentioning that the most expensive and extensive malware attack in history was caused by one of such Russian cyberattacks hitting systems which (at the time) they weren't intended to. Causing severe shipping delays and billions of dollars in damage. https://www.wired.com/story/notpetya-cyberattack-ukraine-russia-code-crashed-the-world/ https://www.wired.com/story/notpetya-cyberattack-ukraine-rus... If such attacks were intentional, you could cause much worse problems. For example, doing this https://www.cisa.gov/news-events/news/attack-colonial-pipeline-what-weve-learned-what-weve-done-over-past-two-years https://www.cisa.gov/news-events/news/attack-colonial-pipeli... except without offering a ransom fee to undo the damage, and doing it in parallel across more industries.
- sweetjuly 2y ago
  Why don't we see these attacks though? I know they're worryingly practical and the West certainly has enough enemies (especially from extremist groups who don't have the same peace keeping concerns as a nation state), and yet we don't see groups just sabotaging critical infrastructure and businesses left and right. Is it really just difficulty/a lack of skill?
  - dralley 2y ago
    I mean, we do and have, they just haven't yet been explicitly targeted at critical infrastructure. When they hit critical infrastructure, it has been more of an accident, that gets papered over by just paying the ransom (because it was a financially motivated attack) or the US government getting sufficiently pissed off to intervene directly state-to-state (which kinda happened with the Colonial Pipeline one in 2021). If the attacks were targeted, were destructively motivated instead of financially motivated, there was no "kill switch", government threats ceased to work, etc... it'd be pretty bad.
  - pama 2y ago
    A reasonable guess is that some entities are storing / collecting attacks patiently waiting for one big event. Having smaller constant incidents only helps strengthen the opponent over time, thus making it harder to deploy a coordinated attack that can change history. The dutch narrative in the article is a good example of what happens whem nontechnical people make decisions over long periods of time without major incidents.
    - sweetjuly 2y ago
      This makes sense for nation states playing war games but what about smaller actors? Terror groups seem content blowing up shopping malls and driving cars into parades (which are all things which I imagine are planned on a much shorter scale than your proposed "long game"). Why don't they go after infrastructure and businesses? Surely critical infrastructure is an interesting and attractive target for them?
      - inhumantsar 2y ago
        there's a clue in the name I think. terror, as in deep, mortal fear. the goal of a terror group is to make as many average individuals fear for their lives as possible. cyberattacks, even significant and disruptive ones, are abstract. it's hard to draw a line from shutting down a pipeline to an individual's sense of mortality. it's not an efficient way to get their message across. ofc it would be a different situation if terror groups could use a cyberattack to drain the capital out of an entire bank or cause a power plant to go chernobyl.
qaq 2y ago
I work for top tier cyber security outfit we had a sizable amount of resources allocated to helping mitigate cyber threats to Ukraine. My understanding is this is not isolated as most top tier or even smaller vendors and service providers took an active role in helping Ukraine defend against ruissian cyber attacks.

dralley 2y ago

> As an SWE I do agree somewhat with what you say but this story is not complete. If you look at the attacks on Ukraine and the cybersecurity damage done it was fairly small in the grand scheme of things. It's worth mentioning that the most expensive and extensive malware attack in history was caused by one of such Russian cyberattacks hitting systems which (at the time) they weren't intended to. Causing severe shipping delays and billions of dollars in damage. https://www.wired.com/story/notpetya-cyberattack-ukraine-russia-code-crashed-the-world/ https://www.wired.com/story/notpetya-cyberattack-ukraine-rus... If such attacks were intentional, you could cause much worse problems. For example, doing this https://www.cisa.gov/news-events/news/attack-colonial-pipeline-what-weve-learned-what-weve-done-over-past-two-years https://www.cisa.gov/news-events/news/attack-colonial-pipeli... except without offering a ransom fee to undo the damage, and doing it in parallel across more industries.

sweetjuly 2y ago
Why don't we see these attacks though? I know they're worryingly practical and the West certainly has enough enemies (especially from extremist groups who don't have the same peace keeping concerns as a nation state), and yet we don't see groups just sabotaging critical infrastructure and businesses left and right. Is it really just difficulty/a lack of skill?
- dralley 2y ago
  I mean, we do and have, they just haven't yet been explicitly targeted at critical infrastructure. When they hit critical infrastructure, it has been more of an accident, that gets papered over by just paying the ransom (because it was a financially motivated attack) or the US government getting sufficiently pissed off to intervene directly state-to-state (which kinda happened with the Colonial Pipeline one in 2021). If the attacks were targeted, were destructively motivated instead of financially motivated, there was no "kill switch", government threats ceased to work, etc... it'd be pretty bad.
- pama 2y ago
  A reasonable guess is that some entities are storing / collecting attacks patiently waiting for one big event. Having smaller constant incidents only helps strengthen the opponent over time, thus making it harder to deploy a coordinated attack that can change history. The dutch narrative in the article is a good example of what happens whem nontechnical people make decisions over long periods of time without major incidents.
  - sweetjuly 2y ago
    This makes sense for nation states playing war games but what about smaller actors? Terror groups seem content blowing up shopping malls and driving cars into parades (which are all things which I imagine are planned on a much shorter scale than your proposed "long game"). Why don't they go after infrastructure and businesses? Surely critical infrastructure is an interesting and attractive target for them?
    - inhumantsar 2y ago
      there's a clue in the name I think. terror, as in deep, mortal fear. the goal of a terror group is to make as many average individuals fear for their lives as possible. cyberattacks, even significant and disruptive ones, are abstract. it's hard to draw a line from shutting down a pipeline to an individual's sense of mortality. it's not an efficient way to get their message across. ofc it would be a different situation if terror groups could use a cyberattack to drain the capital out of an entire bank or cause a power plant to go chernobyl.

qaq 2y ago

I work for top tier cyber security outfit we had a sizable amount of resources allocated to helping mitigate cyber threats to Ukraine. My understanding is this is not isolated as most top tier or even smaller vendors and service providers took an active role in helping Ukraine defend against ruissian cyber attacks.