Does the state really protect the economy from cyberattacks?

The short answer: yes. But not instead of your organization.

In wartime you see more noise: disruption attempts, wiping, leaks and influence operations. It looks dramatic and makes the headlines.

In quiet times the work does not stop. Quite the opposite. That is when attackers gather intelligence, steal credentials, get in through suppliers and leave access in place for the day they need it.

We saw this against Israel. After October 7, Iranian activity started out fairly opportunistic and later became more targeted and coordinated. Some of the attacks were also combined with attempts to shape public perception, not just to damage systems.

So where does the state fit in?

The Israel National Cyber Directorate does important work: intelligence, alerts, help through the 119 hotline, coordination with critical infrastructure and building a national layer of defense. That matters. But the state will not turn on MFA for you, will not shut down an old server that is exposed to the internet, and will not run a drill with your management team on a Thursday evening.

State-backed attackers also often look for the easy way in. An unpatched system. A weak password. A supplier with too much access.

As I see it, an organization that wants to be ready should start with five things:

Shut down services that do not need to be exposed.
Turn on phishing-resistant MFA, starting with admin accounts.
Patch vulnerabilities in internet-facing systems quickly.
Actually test your backups, do not just tick the box.
And drill your management team: who decides, who gets notified and what keeps running.

The state should protect the macro layer.
Responsibility for the organization's own door stays with management.

And in cyber, in wartime and in quiet times, an unlocked door is still an unlocked door.

#InformationSecurity #Cyber #CISO #RiskManagement

Originally published in Hebrew on LinkedIn: view the original post