So much remains unknown about what is now being called the Sunburst hack, the cyberattack against US government agencies and corporations. US officials widely believe that Russian state-sponsored hackers are responsible.
The attack gave the perpetrators access to numerous key American business and government organisations. The immediate effects will be difficult to judge, and a complete accounting of the damage is unlikely.
However, the nature of the affected organisations alone makes it clear that this is perhaps the most consequential cyberattack against the US to date.
An act of cyberwar is usually not like a bomb, which causes immediate, well-understood damage. Rather, it is more like a cancer — it’s slow to detect, difficult to eradicate and it causes ongoing and significant damage over a long period of time.
Here are five points that cybersecurity experts — the oncologists in the cancer analogy — can make with what’s known so far.
1. The victims were tough nuts to crack
From top-tier cybersecurity firm FireEye to the US Treasury, Microsoft, Intel and many other organisations, the victims of the attack are for the most part firms with comprehensive cybersecurity practices.
The list of organisations that use the compromised software includes firms like MasterCard, Lockheed Martin and PricewaterhouseCoopers. SolarWinds estimates about 18,000 firms were affected.
As CEO of cybersecurity firm Cyber Reconnaissance Inc and an associate professor of computer science at Arizona State University, I have met security professionals from many of the targeted organisations.
Many have world-class cybersecurity teams. These are some of the hardest targets to hit in corporate America. The victims of Sunburst were specifically targeted, likely with a primary focus on intelligence gathering.
2. This was almost certainly the work of a nation – not criminals
Criminal hackers focus on near-term financial gain. They use techniques like…