Martti Lehto: Intelligence and espionage in the cyber world

Today, information is online and therefore subject to intelligence and espionage. National cyber intelligence involves government agencies and national security organizations collaborating to collect and analyze information from public and non-public sources on cyber threats, adversaries, and capabilities to protect a nation’s critical infrastructure and interests. The aim of intelligence activities is to produce early-stage information for policymakers and military leaders that enables threats, risks and changes to be influenced and prepared for and hardening national defense systems.

Cyber ​​espionage can be defined as activities that obtain secret information (sensitive, private or classified) from private individuals, competitors, groups, governments and opponents to achieve political, military or economic advantage using illegal methods on the Internet, networks, software or computers.

The distinction between cyber intelligence and cyber espionage is ambiguous, as the use of illegal methods has not been comprehensively and unambiguously defined. Cyber espionage, particularly when organized and carried out by nation states, is a growing security threat.

The most common targets of cyber espionage include large corporations, government agencies, academic institutions, think tanks or other organizations that possess valuable IP and technical data that can create a competitive advantage for another organization or government. Targeted campaigns can also be waged against individuals, such as prominent political leaders and government officials, business executives and even celebrities.

Common cyber espionage tactics

Most cyber espionage incidents are classified as advanced persistent threats (APTs). An APT refers to a sophisticated and sustained cyberattack wherein an intruder discreetly gains access to a network, with the objective of extracting sensitive information over an extended timeframe. Such attacks are meticulously orchestrated to target specific organizations and are designed to circumvent existing security protocols for prolonged periods.

Executing an APT attack necessitates a greater level of customization and sophistication compared to conventional cyberattacks. Such adversaries are often well-resourced and comprise highly skilled teams targeting organizations of substantial value.

Cyber espionage can target individuals

A cyber attacker uses vulnerabilities in a system to penetrate a target. A vulnerability can be any weakness that allows damage to occur or can be used to cause damage. Vulnerabilities can exist in systems’ SW/HW, organizations processes, and human activity.

Most cyber espionage operations incorporate some element of social engineering to elicit action or obtain necessary information from the target to facilitate the attack. Phishing attacks are a common form of social engineering. In this type of attack, the attacker attempts to act as a trusted actor in order to obtain personal information. These techniques frequently exploit psychological factors such as excitement, curiosity, empathy, or fear to prompt rapid or unconsidered responses. As a result, individuals may be deceived into disclosing personal data, engaging with malicious links, or downloading malware.

Everyone working in a significant position and handling important information should appreciate that they may become a target of the intelligence operations of a foreign power. State-sponsored operators may also focus their cyber espionage campaigns on private individuals and public servants.

One consequence of Russia’s military actions in Ukraine has been the increased emphasis on cyber espionage, particularly as conventional human intelligence activities have become more challenging for Russian operatives. Nevertheless, the value of human intelligence remains significant. As essential intelligence can now be collected more efficiently through information systems, the focus of human intelligence efforts can be directed with greater precision.

How to prevent cyber espionage?

Numerous cybersecurity and intelligence solutions are available to help organizations gain deeper insights into threat actors, their attack methodologies, and the tactics they routinely employ.

Implementing robust security measures is essential for protecting sensitive data and networks from cyber espionage. Key tactics include endpoint security, which involves proactively detecting and neutralizing threats before they escalate, as well as monitoring for unusual activity during an attack. It is important to regularly audit an organization’s cyber-physical systems. By conducting vulnerability assessments and penetration testing on a consistent basis, organizations can identify and address security gaps.

Equally critical is employee training; regular training sessions are necessary to raise awareness about cyber threats such as phishing and social engineering. Ensuring that employees understand how these attacks work helps foster a culture of cybersecurity awareness. This empowers staff to recognize and report suspicious activities, acting as a frontline defense against potential breaches.