Panaseer CEO on CNBC: How should CISOs prepare for Iranian cyberattacks?

Homeland Security has warned US companies to be prepared for the possibility of Iranian cyberattacks on the American private sector.

As tensions between the US and Iran continue to escalate, the likelihood of Iranian cyberattacks increases. As Steven Bellovin, computer science professor at Columbia University School of Engineering told USA Today: “I am not predicting it will happen, but if it happens, I won’t be surprised.”

Our CEO, Nik Whitfield, appeared on CNBC’s Squawk Box this morning to discuss what this means for CISOs and what they can do to prepare. You can watch the interview on CNBC’s website and you can catch up on Nik’s key points below.

Iran has offensive cyber capabilities

“Most advanced countries do have a cyber capability both for defense and sometimes for offense. So yes, it’s likely that they do have the capability to attack should they want to.”

Iran has invested heavily in its cyber capabilities since the 2010 Stuxnet cyberattack, which is thought to have been a joint operation between the US and Israel.

Since then, Iran has launched multiple cyberattacks of its own against other nations, including Turkey, Israel and the UK. Out of sight, Iran and the US have also traded blows, engaging in a steady stream of like-for-like attacks over the past decade.

Iran has attacked US financial institutions in the past

“A very powerful organisation like a nation state has a lot of capability to wield against an enterprise company and that’s why enterprises, financial institutions in particular, need to invest in their defences to thwart these threats.”

JPMorgan Chase, Bank of America and Wells Fargo have all been compromised by DDoS attacks that were believed to have been launched by Iran.

When it comes to cybersecurity, nation states have access to far greater resources than most enterprises can match. Iran may not have the capability to disrupt the CIA or NSA, but they can cause widespread disruption by targeting private sector companies linked to financial services, healthcare, utilities or infrastructure.

Proactivity is key

“CISOs around the world will be on high alert at the moment because there is an increased threat level… All the hard work they’ve done over the years starts pays off in these situations.

“If they understand all of their assets and what they’re defending; if they understand whether their controls are switched on and working; if they understand how they’re vulnerable, then they’ll have a good picture of how they’re going to defend themselves.”

Hackers probe an organisation’s defences before deciding to attack. The best way to dissuade a threat actor from compromising your network is to adopt a proactive security posture.

Organisations who can demonstrate that the fundamentals of cyber hygiene are in place will be a less viable target than those who adopt a more reactive approach. This means establishing total visibility of your network and total controls coverage across all assets.

Visit CNBC’s website to watch the full interview.