Cyber Technical Surveillance Countermeasures

Cyber espionage is the unauthorised access to confidential digital information. It is typically conducted by state-sponsored groups, independent hackers who infiltrate computer systems, networks, or devices, or, on some occasions an insider threat. Unlike cybercrime, which focuses more on financial gains, cyber espionage is about information gathering for advantage.

The primary requirement is stealth and undetectability. Thieves often break into networks to listen to communications, steal classified information, or siphon intelligence for an extended period of time without being detected.

Some of the main targets of cyber espionage include:

• Critical National Infrastructure
• Data Centres
• Technology Companies
• Politicians
• Defence Contractors
• Commercial/Legal/Financial institutions working on Political sensitive casework

• To steal Intelligence: The most common purpose of cyber espionage is to gain illicit access to corporate/organisational secrets, blueprints, and/or proprietary technologies. Thieves often reside in other companies or countries where they can steal or copy innovations.
• Gain political advantage: entities may use the practice of cyber espionage to gain information on hostile countries or their political adversaries. Cyber spies infiltrate a nation’s government network or communications for secret access to sensitive information regarding negotiations, policies, or in-house strategies.
• Military insights: Cyber espionage may be used to garner military secrets such as troop mobilisation, defense strategy or weapons technology. The theft of such information gives a strategic military advantage so that espionage actors may pre-empt an adversaries’ actions or gain knowledge of their defense capabilities.

Due to its covert nature, it can be challenging to determine when cyber espionage is being undertaken. However, there are identifiable signs of compromise:

• Unusual network activity: One of the major symptoms is abnormal activity in the network. It could be unexplained data transfer, login times at odd hours, or an access pattern that goes against typical behaviour. For example, if large amounts of sensitive data are transmitted during off-hours or to unfamiliar locations, it may indicate an ongoing espionage attempt.
• Unauthorised access:  Identifying instances where illegal or unauthorised access has occurred, particularly those with special access privilege. Examples include logins on security-sensitive systems and when an employee’s account has been used to access the system via unknown IP addresses or devices. In such a case, this may be an indication that the account has been compromised.
• Advanced Persistent Threats (APTs): APT is a kind of attack involving sophisticated and long-lasting intrusions where attackers get into the internal networks without notice for months or even years. Some indicators would be unusual outbound traffic, changes in system files, or the presence of any kind of malware that silently functions behind the scenes.
• Information leakage: A sudden exposure of confidential information, either organisational or personal, can be an indicator of a cyber espionage attack.

Implementing strong security practices before an attack is crucial to protecting data and networks. Although it won’t eliminate the threat, they should minimise the impact of one.