Brace for Iranian Cyberattacks on American Businesses
After the U.S. strike that killed the Iranian Major General, expect more cyberattacks on vulnerable businesses – especially smaller operations.
In a recent radio interview on Power Talk, Luis Alvarez, cybersecurity technologist and CEO of Alvarez Technology Group, discussed the imminent threat of Iranian cyberattacks on the U.S. economy. Cyberattacks originating from Iran are widely anticipated as a response to the U.S. military strike in Baghdad that killed Iranian second in command Major General Qassim Suleimani on January 3, 2020.
Mr. Alvarez discussed how Iran is a master of asymmetric warfare, which is a nonmilitary warfare approach used by countries that can’t directly compete with U.S., Russian, or Chinese military might. “Iran has a robust cyber unit that has targeted many infrastructure networks in the United States, with attacks going back five or six years,” stated Mr. Alvarez. Those attacks targeted mainly power plants and government agencies.
Iran originated cyberattacks have a history of attacking economic strongholds. From 2011-2013, Iran targeted the U.S. financial sector with denial of service attacks, which stopped thousands of bank customers from accessing their accounts and using online services to conduct business. At the time, the denial of service attacks was highly disruptive to individual users and the U.S. economy.
In 2013, Iran gained access to a dam in New York state. This was the first known event where Iran gained access to an element of the U.S. infrastructure. In 2016, seven Iranians were charged with the bank and dam cyberattacks. While the New York damn hacking did not have any long-standing consequences, the worry remains over cyberattacks against outdated U.S. infrastructure, particularly against water treatment facilities and the power grid.
An official alert was released on January 6, 2020, by the U.S. Department of Homeland Security recommends that organizations adopt a state of heightened awareness, increase their vigilance, review their internal incident reporting processes, and organize an incident response plan. Patterns of publicly known Iranian cyber threats are available on the Homeland Security website, including mitigation and detection recommendations. The concern is also high that Iran will turn its cyberattacks against economic targets, and small businesses may be particularly vulnerable.
“One of the things we tell our clients is that look, on the internet, every business is equal,” said Mr. Alvarez. A small business without the IT support of a large company is more likely to be targeted. Mr. Alvarez also pointed out that while anti-virus and firewall are important tools to protect a company, that may not be enough. The best approach is to invest in IT support who can actively detect Iranian security breach attempts and move quickly to neutralize the cyber threat. Mr. Alvarez concludes, “Cyberattacks insight such fear in people that they don’t know what to do and stop trusting the institutions that protect them … that does more damage than dropping a bomb.”
