Stealing sensitive data and sabotaging a refrigerator are different threats and require different defense structures. We asked Alessandro Armando, of the National Cybersecurity Agency, how we are moving against the increasing hacker attacks.
The latest episode in chronological order is the series of bomb scares which involved 19 simultaneous airline flights, six of which arrived or departed from Italy. It was about swattingthat is, a deception of the emergency services through false reports. We are only halfway through a busy week from the point of view of hacker attacks, with the sabotage of supermarket refrigerators in nine European countries and that of the plasma storage systems of the French Blood Institute.
We have a perception and the data confirms it: cyberattacks are on the increase all over the world. Clusit, the Italian Association for IT Security, counted almost 5 thousand in the first half of the year, the highest number ever recorded in a similar period of time. In Italy they are not growing at the same rate, but we already have some noteworthy episodes in mind such as the violation of the email accounts of political exponents including the Prime Minister, Giorgia Meloni, the unauthorized access to Trenitalia systems, the ransomware against La Sapienza University and the blocking of IT operations at the Policlinico Triestino. If until last year most cases hid an activist intent, now 95% of attacks are exclusively criminal in nature. And it’s plausible (but not confirmed) that the groups are tied to hostile nations. Are Italy and the European Union prepared for the so-called hybrid war?
It is not so easy to trace who is responsible for an attack
In some cases, the attacks have been claimed by criminal groups revolving around Russia, such as NoName057 and INC Ransom, but their actual involvement is not yet confirmed. «It is difficult to attribute an attack with certainty to a specific perpetrator. We can assume that they are due to the will of nations such as Russia, China or North Korea because it coincides with their purposes, but finding certain proof is another story”, warns Alessandro Armando, full professor of Computer Engineering at the University of Genoa, member of the Technical-Scientific Committee of the National Cybersecurity Agency (ACN) and president of the Scientific Committee of the SERICS Foundation.
«Often we limit ourselves to identifying patterns of action, exploiting cyber intelligence systems to trace the modus operandi of known criminal groups. Specific characteristics may be, for example, the tools used or the methods of requesting a ransom.”
Hybrid and increasingly varied warfare
The most affected sector remains that of public administration, with the blocking of systems and the risk of data theft.
But the nature of hacker attacks is increasingly varied as demonstrated by the sabotage of refrigeration systems. And this complicates things. In the first case, in fact, IT systems, Information Technology, or online services such as those guaranteed by the Revenue Agency website or the electronic health register are mainly affected. In the second case, however, these are OT systems, Operational Technology, where IT infrastructures remotely manage physical equipment. «They are two different categories, which receive different attacks and have to build different defenses», confirms Armando.
«In the IT field, cybersecurity is more consolidated, while in the OT field we are trying to recover lost ground, but some difficulties are determined by the operational context. Let’s think, for example, of a power plant and the long update times of its systems. Or, in the medical field, to diagnostic devices: they are often not designed to counteract cyber attacks, but intervening on the software that controls them to eliminate any vulnerabilities can compromise the certification of the devices”. They thus become secure on a computer level but unusable on a practical level.
We are moving, but the time factor is central
«Italy is certainly moving to consolidate cybersecurity and is doing it well», but an entire country that takes action requires its time. Hackers can also act more quickly thanks to artificial intelligence and this increases the attackers’ advantage at least in the short term. «The Claude Mythos model developed by Anthropic found a series of vulnerabilities in the systems, even very severe ones, that escaped the human eye and traditional analysis tools. AI, like many technologies, is a double-edged sword, because this technology is also in the hands of hackers. In the present and in the immediate future we are exposed and must therefore accelerate the adaptation process and raise our defenses.”
What Europe is doing
Among the steps we are taking is the new European directive on cybersecurity, which in Italy has been implemented through the ACN and which introduces a significant innovation: «If previously the responsibility for a company’s IT security was delegated to the IT department, it is now attributed directly to its governing bodies». In other words, cybersecurity ends up on the boardroom table and becomes a top priority. Those who manage an organization will need to ensure that it has an effective action plan for risk management and that adequate resources are allocated to its implementation.
In concrete terms, companies must register the digital assets to be protected, such as data or network services, identify vulnerabilities in their systems and evaluate a series of countermeasures to prevent or mitigate the effects of possible illicit access. «Finally, verify that the impacts of an attack do not interrupt operations, a crucial factor for organizations that provide critical services, such as a hospital».
