Only three days into our shiny new decade and we saw the take-down of a political strongman in Iran, an uptick in nation-state cyber (and other political) activity, and then a brief stand down from heightened alert warnings. And now Iranian leadership is blaming the US for Iran's launch of a surface-to-air missile that downed a Ukrainian Air Lines jet with 176 non-combat people on board on January 12. It feels to me as though we are stuck in a tragic time loop, a non-comedic parallel to the 1993 movie, Groundhog Day, in which the main character relives events until he slowly grasps the inevitability of consequences and takes remediatory (redemptive?) action.

 

We often fall into a similar, circular behavior pattern with cybersecurity program implementation, taking a wait-and-see approach, looking for shadows and signs to determine whether we really, really need to adopt basic recommended security controls. Will the groundhog see its shadow and go back in the hole for another six weeks? Will DFARS 7012 compliance be based largely on the 110 NIST SP 800-171 security requirements, even when the final version of DoD's Cybersecurity Maturity Model Certification details are published? All signs point to yes. And the recent DHS cyber warnings, triggered by concerns about Iranian retaliation and cyber saber-rattling, also point to a "yes" for implementing a solid system security plan (SSP), corrective plan of action and milestones (POAM), and incident response and recovery plan (IRP).

 

Iran has a highly sophisticated cadre of cyber professionals, some of whom have reverse-engineered the Stuxnet malware that compromised some 1,000 centrifuges in Iran's Natanz nuclear enrichment facility in 2010. The original malware gave the world a disturbing look into the power of digital tools to disrupt critical infrastructure managed by industrial control systems. Learning from the Stuxnet malware contributed to the development of Triton malware (used against a Saudi Arabian target in December 2017), which targets industrial control systems (ICS) in production equipment and, more specifically, the automated safety mechanisms that protect human machine operators against physical injury and even death. [i] Concern that Iran could deploy some form of cyber retaliation against US manufacturing assets follows logically. (...)