Commentary From Crisis Management Expert Edward Segal, Author of the Award- Winning Book "Crisis Ahead: 101 Ways to Prepare for and Bounce Back from Disasters, Scandals, and Other Emergencies " (Nicholas Brealey)

The Russian invasion of Ukraine is taking different forms, including cyberattacks.

Last week, CNBC said that, "Websites for the Ukrainian Ministry of Foreign Affairs, Cabinet of Ministers and Rada, the country's parliament, were among those down.... The government sites were offline as officials attempted to switch traffic elsewhere to minimize damage..."

But the impact of Russia's cyber warfare in Ukraine could be far-reaching.

'The Most Sobering Statistic'

Baruch Labunski, CEO of Rank Secure, observed that, "Here's the most sobering statistic I've seen about the threat to businesses all over the globe that the Russian invasion of Ukraine poses in terms of cybersecurity: According to Ukraine's Ministry of Foreign Affairs, 1 in 5 Fortune 500 companies rely on Ukraine's IT outsourcing sector.

"That means that even if your business isn't directly targeted by Russian-based cyberattacks, you may still feel the impact," he warned.

'Under No Illusions'

Mykola Volkivskyi, a political expert and former advisor to a top official of the Ukrainian Parliament, is president of The First International Ukrainian Foundation of Development. He observed that, "Cybersecurity is under great threat throughout Europe—joint action is often ineffective and attacks on critical infrastructure provide a good time to conduct an operation. We have no illusions about Russia's plans to attack Ukraine, so its previous successful testing of the attack provides a lot of material to continue the action. 

"The new large-scale attack will not be limited to information portals of government organizations or anything—now the entire banking system will be hit, there will be disruptions in energy supply, communications, Internet, contacts in the metropolis, and more. All spheres will suffer—the demand for cash and foreign currency will increase, panic will hit people who will buy fuel and food," he predicted.

'Ukraine Has Become A Testing Ground'

Writing in New Eastern Europe, Volkivskyi said that, "The Russian Federation is investing heavily in state-controlled cyber groups. These [groups] systematically carry out industrial espionage and intelligence activities using various methods. For example, the Kremlin has interfered in elections and referendums, stolen and leaked compromising information, and disabled banking systems.

"Ukraine has become a testing ground for many of these tactics over the past ten years. Despite this, the activities of such groups in other regional states prompted us to write about Moscow's actions. Overall, the Kremlin appears ready to move to a new stage of provocations in Eastern Europe in order to counter NATO's military infrastructure. What will these actions look like in the future and how can Ukraine's experience help its neighbors in Europe?,'' he asked.

'Part Of An Integrated Offensive Military Invasion'

Jonathan Reiber is the senior director for cybersecurity strategy and policy at AttackIQ. He noted that the initial cyberattacks "may end up being the first declared hostility where cyberspace operations are a part of an integrated offensive military invasion.

"It would by no means be the first time that a nation-state has conducted cyberattacks to achieve a strategic objective, and recent history is replete with such examples,'' he noted.

"How might it unfold? We could see a coordinated campaign of cyberspace operations targeting the Ukrainian government's senior leader communications, military critical infrastructure and communications, and aspects of Ukrainian national critical infrastructure, to include the energy, manufacturing, and media sectors (as well as others).

"Such a coordinated campaign could extend far beyond what the Russian government has done to Ukraine in the past. For the sake of international peace and security, we should all hope for de-escalation,'' Reiber concluded.

Advice For Business Leaders

'Time Is Running Out'

Bryan Hornung, the founder of Xact IT Solutions, warned that, "Time is running out if you have not started on a comprehensive cybersecurity plan for your business.

"At this stage, companies should be looking to adopt a zero-trust model to protect critical assets and secure home-based workers. If you're not quite ready for zero trust having the basics like advanced endpoint protection, multi-factor authentication on everything, and a firm password hygiene policy that utilizes password management technology is a good start.

"I would recommend layering all of that with human threat hunting technology which most businesses today, even small ones, can afford," he concluded.

'CISA's 'Shields Up Warning'

Earlier this month, as concerns mounted about a Russian invasion of Ukraine, the Cyber Security & Infrastructure Agency (CISA) issued a 'shields up' warning to U.S. companies. It recommended that, "all organizations—regardless of size—adopt a heightened posture when it comes to cybersecurity and protecting their most critical assets."

CISA said that, "While there are not currently any specific credible threats to the U.S. homeland, we are mindful of the potential for the Russian government to consider escalating its destabilizing actions in ways that may impact others outside of Ukraine."

Good News And Bad News

Michael Greenberger is a law school professor at the University of Maryland Carey School of Law and the founder and director of the University of Maryland Center for Health and Homeland Security. He noted that a defensive cyber checklist issued by CISA for U.S. businesses was both good and bad news.

According to Greenberger, the bad news "is that these merely 'voluntary' defensive CISA 'suggestions" 'expose the entirety of U.S. infrastructure to crippling stoppages. In such a 'voluntary' system, too many entities do not establish (indeed have no knowledge of) defensive cyber measures, especially in the small business and small government sectors. Of course, any weakness within the entirety of an infrastructure system can cripple (and has crippled) the delivery of critical services—no matter how diligent some governments and businesses are." he noted.

Greenberger commented that the good news "is that U.S. military and intelligence agencies can greatly debilitate Russian infrastructure in quick response to any serious Russian cyberattacks. The chances are also great that that a U.S. affirmative response against Russia can inflict pain that far exceeds that which can be imposed by Russia and, indeed, may even debilitate its conventional military's incursion into the Ukraine. Russia knows this. For this reason, Russian cyberattacks on the U.S. should be measured to avoid the worst potential U. S. affirmative responses. 

"In short, this pending conflict will doubtless require the U.S. and state and local governments, as well as the entire business community, to be on the most heightened alert," Greenberger concluded.

                                                                       ###