By Keith Gologorsky, Senior Vice President, Worldwide Federal and SLED, Hack The Box
Every major cyber incident changes how government agencies prepare for the next one. Security teams identify weaknesses, adjust their defenses, and focus on preventing similar attacks. Agencies also need to consider threats and scenarios they haven’t encountered before.
Adversaries are constantly looking for new ways to achieve their objectives. They may target an overlooked system or exploit a commercial service that an agency depends on to carry out its mission. Cyber teams need to understand how adversaries think, where they might strike, and how to respond when something unexpected happens.
I call this having a “forward lean” in cybersecurity. It means thinking ahead, understanding where the mission is going, and making sure teams have the skills to adapt when an adversary takes an unexpected approach.
Look beyond familiar attack patterns
Early in my career, I worked with a former branch chief of Joint Task Force – Global Network Operations (JTF-GNO) who told me, “Cyber threat analysis is an art, not a science.” That advice has stayed with me because adversaries don’t always follow predictable patterns. Defenders need to think creatively and sometimes “paint outside the lines,” just as adversaries do.
Established processes, intelligence reporting, and technical indicators help guide threat analysis. But defenders also need to recognize when an adversary takes an unexpected approach and consider what they’re ultimately trying to accomplish. For state-sponsored actors, that often means denying, degrading, or disrupting operational capabilities, sometimes by targeting systems outside traditional government network boundaries.
The 2022 cyberattack on Viasat’s satellite communications network illustrates how attacks on commercial infrastructure can disrupt critical operations across borders. Attackers compromised infrastructure used to manage satellite communications and deployed destructive malware known as AcidRain, disabling large numbers of modems. The disruption affected users across multiple European countries, highlighting how attacks on shared infrastructure can have consequences beyond their immediate targets.
The attack showed how an adversary could disrupt military communications by targeting a commercial provider. Mission dependency mapping helps agencies look beyond traditional asset inventories to understand which outside systems and services their operations rely on, and where an adversary might exploit those dependencies to disrupt the mission.
Understand how the mission is changing
Government missions are constantly evolving as agencies deploy personnel overseas, introduce new technologies or rely on commercial providers to support operations. As the mission changes, so do the opportunities an adversary may look to exploit.
Defenders need to know where the mission is going and how those changes affect the networks and systems that they’re responsible for protecting. That includes knowing what normal activity looks like, which systems are critical to operations, and what happens if those systems become unavailable.
This requires regular communication between cybersecurity teams and mission leadership. Defenders need visibility into upcoming operations and the systems and services they depend on. They also need to know which disruptions would have the greatest impact on the mission.
There are everyday challenges to account for as well. Policy exceptions happen, users make mistakes, and some systems can’t be patched immediately because of operational requirements. Cyber teams need to plan for these realities and understand how an adversary might take advantage of them while keeping the mission running.
Test teams against tomorrow’s threats
One of the best ways to prepare for unfamiliar threats is to put cyber teams through realistic threat emulation exercises. These exercises help teams identify blind spots and see how well they respond under pressure.
I often use the phrase “practice like you play” because that’s how teams build muscle memory. The more they practice, the more familiar they become with their responsibilities, who to contact, and what decisions need to be made when something goes wrong.
Exercises should involve skilled adversaries who pursue realistic objectives, move through the network if they remain undetected, and adjust their tactics along the way. Teams also need to deal with unexpected activity, competing alerts, and incomplete information, much like they would during a real incident.
That pressure tests how well different parts of the organization work together. Cyber threat intelligence analysts need to identify actionable information, incident responders need to investigate and act on findings, and senior leaders need to understand the potential mission impact so they can make operational decisions.
Consider an employee who accesses agency email from a personal laptop and opens malware on that device. Can investigators perform forensics? What steps need to happen before they can obtain the device? The team should know the answers right away.
These exercises also show leaders where their teams are prepared and where they may need more training for workforce development. Leaders can see how quickly teams identify suspicious activity, obtain critical logs, and coordinate a response. They can also see how well their teams adapt when a scenario changes or familiar indicators no longer apply.
Leaders should also consider whether their analysts understand the geopolitical environment surrounding a threat and have relationships with peers outside their organization. Having people outside the organization to call can make a difference when something unexpected happens.
Past incidents will always influence government cybersecurity priorities. The more agencies understand where their missions are going and test their teams against unfamiliar scenarios, the better prepared they’ll be when an adversary takes a different approach.
Keith Gologorsky is Senior Vice President of Worldwide Federal & SLED at Hack The Box, the leading cybersecurity readiness platform for the human-AI workforce. He brings more than 15 years of defense contracting experience supporting U.S. Department of Defense entities, including DoD CERT, JTF-GNO, AFRICOM, and EUCOM. At U.S. European Command, he established the Joint Cyber Center’s analytical capability and co-founded a long-standing international regional cyber analytical working group with over 150 analysts participating. His industry leadership includes contributing to Symantec’s Cyber Threat Analysis Program (CTAP) and co-founding ThreatConnect.