In the event of a cyber attack, businesses are on their own. Here’s how and why you need to prepare.

How does an American-made exploit end up harming American companies like FedEx? 

Software leaks and can be copied. Because everyone uses much of the same technology stack globally, these attacks can “boomerang” back on us, like a missile that can be remotely overtaken mid-air.

The threadline is the stakes are high, the costs are high, and the skill level required to run these attacks are high. American code has leaked or been pilfered by North Korean, Chinese, Russian, and Iranian hackers. Some are state-backed, some less so (like in Russia). And unlike missiles or submarines, the cost of entry to use these tools requires little more than a laptop and a good internet connection. 

Unlike a typewriter in the Cold War, all the equipment in use today is roughly the same worldwide. The Russians have all the same Intel-powered computers as American schools and universities. The Chinese use the same Windows, Mac, Android, and iOS platforms and services as U.S., Canadian, and Mexican trucking companies. Many of the bugs are hard to track, unknown to most people, and take weeks to trace back. They’re also deceptively simple, often just erasing hard drives or encrypting files in ransomware attacks that most attackers have no intention, or even the ability, to give back even if the ransom is paid.

The U.S. Department of Homeland Security has preparedness plans for all manner of natural disasters, hurricanes, floods, wildfires, tornadoes, heat waves, and multi-day power outages. Most of these plans are short-term, like how to deliver water after a hurricane. There is no plan for a large-scale cyberattack that could potentially deny millions of Americans power for weeks or months. There is no plan for how to retaliate against a state actor if large hospital networks or, indeed, entire local and state governments are locked out of their machines, voting systems, records, databases, and services.

And for good reason. Any retaliation against a state actor likely invites an escalation of attack. Presidents Obama, Trump, and Biden have wrestled with this and decided a tit-for-tat escalation is more harm than good to American interests. It’s mutually assured destruction for the cyber age, but with code and not nuclear weapons.

This means one thing for American businesses and individuals: you’re on your own in the event of an attack. Large employers or healthcare providers can and do receive assistance from the FBI, CISA, and other federal agencies. But none of them have any ability to “hit undo” or attack back. Their support is strictly guidance, with best practices, like how a doctor might tell you to rest and drink fluids to fend off a cold.

Infosec and IT security teams know the harsh reality that everyone is vulnerable. Every machine is as vulnerable to a cyberattack as human bodies are to a physical threat. There is no way to stop everything, and any effort to try would require decades, cost money, and necessitate updated hardware, software, and replacement components. Most people are not excited about spending a few hundred dollars on a new internet router. 

This is where Vantage Point can help. We’re not infosec teams, nor do we sell coding or programming services. Instead, we help businesses create continuity of operations plans (COOPs) and test their internal processes against various situations and scenarios.

• Can your team function without email for a day? How about for a month? After email hosting provider Rackspace was attacked in 2023, everyone’s Microsoft Exchange email was completely inaccessible for more than six weeks.
• Would your company continue to fulfill orders if it was discovered your website was leaking credit card information? 
• How would your PR and communications teams respond if your nursing home was found to be leaking patient records to an unknown source?
• How well can your team spot email phishing? Phishing remains the number one source for malware and ransomware implants. It’s easier and faster for outside agents to trick Jenny in Payroll or Alvin at the Reception Desk to click a malicious link than it is to find and deploy a Zero Day bug in macOS.
• Could your local county government continue to respond to 911 calls, inspect health code violations, treat water, order road salt, plow roads, and record tax payments if every computer in the county was attacked?

VPC can help design tabletop exercises and other live-action drills to help you prepare for this reality. Because it is a reality, as witnessed by Dallas, Tulsa, Jackson County, MO, Vermont Health Network, Minneapolis Public Schools, LASD, Ascension, Scripps Health, JBS Foods, MGM Resorts, Kaseya VSA, and millions more.