More than ever before, organizations are aware of the potential financial impact of a cyber attack. Many wrongfully assume that the steep, monetary burden of a cyber attack is exclusively tied to damaged digital assets, lost records, and the price of investigating and reporting a breach. While those expenses represent a considerable hit, damage to an organization’s physical assets can be just as harmful.

Cyber attacks that cause physical damage typically occur when a hacker gains access to a computer system that controls equipment in a manufacturing plant, refinery, electric generating plant or similar operation. After the hacker gains access to an organization’s machinery, they can then control that equipment to damage it or other property.

These types of events can lead to major disruptions and costly damages. To safeguard their physical assets, it’s critical that organizations understand what types of businesses and assets are exposed to these attacks.

What’s At Risk?

To better understand what kinds of physical losses can occur following a breach, it’s helpful to compare cyber attacks to a natural disaster or other industrial accident. Following these kinds of incidents, organizations often incur costs to repair and replace damaged equipment in addition to any lost revenue caused by the disruption.

Unlike natural disasters, however, cyber attacks that cause physical damage aren’t limited to a geographic location and can impact an entire network. This means that damages caused by a breach can be widespread, affecting multiple sectors of the economy depending on the target.

Because of this, cyber attacks that cause physical damage are often dynamic and extensive. When an attack on critical infrastructure occurs, it not only affects business owners and operators, but suppliers, stakeholders and customers as well.

Who’s At Risk?

Cyber attacks that cause physical damage—the targets, the assailants, the motivations and the means of the attack—are constantly evolving. Incidents can occur in a variety of ways, including phishing scams, internet exchange point attacks, breaches of unsecured and unencrypted devices, and even plots carried out by rogue employees.

When discussing these attacks, many experts cite power and energy sector organizations as the most at-risk. However, vulnerabilities also exist in utilities, telecommunications, oil and gas, petrochemicals, mining and manufacturing, and any other sectors where industrial control systems (ICSs) are used.

ICSs are open computer systems used to monitor and control physical processes as well as streamline operations and repairs. ICSs are not often designed with security as a primary consideration, which leaves them susceptible to attack. What’s more, for many automated processes, attacks don’t even need to cause physical damage to result in significant disruption and losses.

So, when it comes to the emerging risk of cyber attacks that cause physical damage, targets vary by industry and the damages can be extensive due to the interconnected nature of ICSs.

Real-world Examples

Because organizations are not always required to make cyber attacks that cause physical damage public, they largely go unreported. However, the following are a number of high-profile incidents that demonstrate how important it is to consider physical and infrastructure cyber exposures:

• Ukrainian power grid attack—This was a multistage, multi-site attack that disconnected seven 110 kV and three 35 kV substations. Together, the attack resulted in a power outage for 80,000 people and lasted for three hours. Using only a phishing scam, the attackers were able to cause substantial, prolonged disruption to the economy and general public.
• Saudi Arabian computer attacks—In these incidents, hackers destroyed thousands of computers across six organizations in the energy, manufacturing and aviation industries. Through a simple virus aimed at stealing data, computers were wiped and bricked. Not only did this mean critical business data was lost forever, but all of the damaged computers had to be replaced—a substantial fee for businesses of any size. This attack was similar to an attack on Saudi Aramco, the world’s largest oil company, which destroyed 35,000 computers.
• Petrochemical plant attack—This attack targeted a Saudi Arabian petrochemical plant. The attack was unique in that it wasn’t designed to steal data, but rather sabotage operations and trigger an explosion. The only thing that prevented an explosion was a mistake in the attackers’ computer code. Had the attack been successful, the plant would likely have been destroyed and many employees could have died. Experts are concerned that similar attacks could be carried out across the globe.
• Hospital ventilation attack—In this incident, a hacker was able to damage and control a hospital’s HVAC system using malware. This attack put the safety of staff, patients and medical supplies in jeopardy, as the hacker could control the temperature of the facilities at will.

Attacks causing physical damage will likely become increasingly common as technology advances and hackers continue to get more creative. Even more concerning is that these kind of attacks not only endanger a company’s data, reputation and finances, but human lives as well.

How Do I Protect My Organization?

Insurance coverage for cyber attacks that cause physical damage is still in its infancy, and your organization may have gaps in protection. Even if your property insurance policy includes physical or non-physical damage coverages, that does not necessarily mean you’re covered from first or third-party losses from cyber attacks.

The level of protection your company has depends largely on the structure of your policies. As such, it’s critical for businesses to do their due diligence and understand if their policies do the following:

• Impose any limits on coverage, particularly as it relates to physical damage of tangible property
• Cover an attack and any resulting damages
• Provide contingent coverage for attacks that aren’t specifically targeted at the organization

While it’s important to speak with a qualified insurance broker about your cyber risk policy options, there are a number of steps businesses can take by themselves to protect their physical assets. In addition implementing a cyber risk management plan, business should consider doing the following to protect their data:

1. Keep all software up to date.
2. Back up files regularly.
3. Train employees on common cyber risks and what they should do if they notice anything suspicious.
4. Review your exposures and speak with your insurance broker to discuss policy options for transferring risk.

© Zywave, Inc. All rights reserved

Because news surrounding data breaches often highlight major companies like Target or Yahoo, it’s easy to think of cyber attacks as a big business problem. However, small businesses are just as much at risk and could have to front $46,000 or more per cyber security event. As such, it’s important to be aware of the following five common cyber attacks that threaten small businesses:

1. Denial-of-service attacks (DoS). A DoS attack occurs when a cyber criminal sends a large amount of data from multiple computers in order to overwhelm your system and shut it down. This attack can result in a direct loss in revenue, as your website could be down for extended periods of time.
2. Inside attacks. Cyber attacks don’t always come from outside sources. In some cases, a disgruntled employee who has access to your system can hijack your critical data and hold it for ransom.
3. Malware is any malicious software that can be used to gain access to your system and cause damage. Typically, malware refers to worms, viruses and ransomware.
4. Password attacks. Password attacks are when hackers crack your password and gain access to your system. This type of attack can be difficult to defend against because it doesn’t always require a malicious code or software.
5. Phishing is a cyber attack in which a hacker disguises him- or herself as a trusted source in order to acquire sensitive information. This can be accomplished via email or other direct forms of online contact.

To protect themselves from all types of cyber breaches, small businesses should consider evaluating their systems for exposures on a regular basis. In addition, it is important to train workers on cyber security and ensure that antivirus and other protective measures are up to date and operational.

© Zywave, Inc. All rights reserved

Recently, Dynamic Network Services Inc. (Dyn)—a cloud-based internet performance management (IPM) company in the United States—had its server infrastructure compromised following distributed denial-of-service (DDos) attacks. Dyn said that more than 100,000 devices may have been involved in the massive cyber attack that overwhelmed its servers and produced a ripple effect, temporarily shutting down access to sites like Twitter and Netflix for the east coast of Canada and much of the northeastern United States.

How the Attack Worked

A DDoS is a type of cyber attack that hijacks multiple devices—usually through installing and spreading malware—to “flood” a specific group of servers with a multitude of requests for information all at the same time. The tactic effectively “clogs” the servers so that they’re unable to handle normal web traffic and can ultimately force them to shut down temporarily.

In the past, attacks like these would typically utilize personal computers to carry out the attack. In this case, however, it appears that the attack co-opted a number of “smart” devices—things like digital video recorders (DVRs), printers and even cellphones. Government officials currently believe that a non-state actor is behind the attack, but as the investigation is still ongoing, they have yet to definitively rule anything out.

Key Takeaways

Regardless of the source, the attack highlights a pair of troubling trends. First, this DDoS attack was one of a growing number of more sophisticated attacks. And, while Dyn—a company with robust cyber security measures—was able to restore its regular operations fairly quickly, it only did so after defeating two separate waves of the attack.

Second, and perhaps more importantly, this attack shows the potential vulnerability posed by the increasing number of interconnected, internet-enabled devices commonly called the Internet of Things (IoT). The inter-connectivity of devices on the IoT is the source of a number of benefits; however, that very same inter-connectivity offers cyber criminals an often overlooked—and potentially less secure—avenue of attack.

© Zywave, Inc. All rights reserved.

According to figures released by IBM, nearly 60 per cent of all cyber attacks in 2015 were launched by “company insiders,” based upon data gathered from 8,000 of their clients’ devices. Though industry experts have warned for years that a company’s employees may inadvertently make systems vulnerable, IBM found that 44.5 per cent of attacks were, in fact, malicious.

It’s important to note that IBM defined an “insider” as anyone who had either physical or remote access to a company’s assets. While this would certainly include employees, it would also include business partners, contractors and vendors.

While insider threats can be difficult to detect, businesses can still work to prevent them. Above all, it’s important to have a cyber security plan in place—one that manages passwords in a mindful way and protects shared documents.

© Zywave, Inc. All rights reserved