How Ukraine Has Defended Itself Against Cyberattacks – Lessons for the U.S.

Access Control
Cyber defense begins with the entryways into a nation’s information networks. In Ukraine in recent years, hackers entered poorly protected networks by techniques as simple as guessing passwords or intercepting their use on unsecure computers.

More sophisticated cyberattacks in Ukraine used social engineering techniques, including phishing emails that tricked network users into revealing IDs and passwords. Clicking an unknown link can also open the door to tracking malware that can learn password information.

Neuberger’s recommendation for adopting multifactor password authentication recognizes that users will never be perfect. Even cybersecurity experts have made mistakes in their decisions to provide passwords or personal information on insecure or deceptive sites. The simple step of authenticating a login on an approved device limits the access a hacker can obtain from just gaining personal information.

Software Vulnerabilities
The programmers who develop apps and networks are rewarded by improving performance and functionality. The problem is that even the best developers often overlook vulnerabilities as they add new code. For this reason, users should permit software updates because these are how developers patch uncovered weaknesses once identified.

Prior to the invasion of Ukraine, Russian hackers identified a vulnerability in Microsoft’s leading data management software. This was similar to a weakness in network software that allowed Russian hackers to unleash the NotPetya malware on Ukrainian networks in 2017. The attack caused an estimated $10 billion in damage worldwide.

Just days before Russian tanks began crossing into Ukraine in February 2022, Russian hackers used a vulnerability in the market-leading data management software SQL to place on Ukrainian servers “wiper” malware that erases stored data. However, over the last five years Ukrainian institutions have significantly strengthened their cybersecurity. Most notably, Ukrainian organizations have shifted away from pirated enterprise software, and they integrated their information systems into the global cybersecurity community of technology firms and data protection agencies.

As a result, the Microsoft Threat Intelligence Center identified the new malware as it began appearing on Ukrainian networks. The early warning allowed Microsoft to distribute a patch around the world to prevent the servers from being erased by this malware.

Backing Up Data
Ransomware attacks already frequently target public and private organizations in the U.S. The hackers lock out users from an institution’s data networks and demand payment to return access to them.

Wiper malware used in the Russian cyberattacks on Ukraine operates in a similar manner to ransomware. However, pseudo ransomware attacks permanently destroy an institution’s access to its data.

Backing up critical data is an important step in reducing the impact of wiper or ransomware attacks. Some private organizations have even taken to storing data on two separate cloud-based systems. This reduces the chances that attacks could deprive an organization of the data it needs to continue operating.

Drills and Cooperation
The last set of Neuberger’s recommendations is to continually conduct cybersecurity drills while maintaining cooperative relationships with federal cyber defense agencies. In the months leading up to Russia’s invasion, Ukrainian organizations benefited from working closely with U.S. agencies to bolster the cybersecurity of critical infrastructure. The agencies helped scan Ukrainian networks for malware and supported penetration tests that use hacker tools to look for vulnerabilities that can give hackers access to their systems.

Small and large organizations in the U.S. concerned about cyberattacks should seek a strong relationship with a wide-range of federal agencies responsible for cybersecurity. Recent regulations require firms to disclose information on cyberattacks to their networks. But organizations should turn to cybersecurity authorities before experiencing a cyberrattack.

U.S. government agencies offer best practices for training staff, including the use of tabletop and simulated attack exercises. As Ukrainians have learned, tomorrow’s cyberattacks can only be countered by preparing today.

Robert Peacock is Assistant Professor of Criminology and Criminal Justice, Florida International University. This article is published courtesy of The Conversation.