Defending Against Today’s Cyber Threats: Former Government Leaders Weigh In

Key takeaways

• The “Big Four” nation states in the current threat landscape, Russia, Iran, North Korea and China, continue to pose a major cyber threat to businesses of all sizes, said cyber expert Jeff Greene.
• Attackers are picking the easiest target, not the biggest one, explained cyber expert Nicole Tisdale, noting that small organizations are just as vulnerable as large ones.
• While artificial intelligence is not a new cyber threat, the speed and emergence of autonomous AI agents have created a new variable of risk, Greene said. He noted that research shows that 78% of employees are using bring-your-own AI tools not approved by their employers, highlighting the need for AI governance policies. 
• Resilience is the only complete defense to a cyberattack, Greene explained, stressing that organizations with a practiced resilience plan will recover more quickly, lose less data and spend less money during a response.
• The hardest part of cyber preparedness could be knowing where to start, according to Tisdale. Free cybersecurity tools from Travelers can help, including five cyber readiness practices, employee training tips and a business continuity guide.

Summary

What did we learn? Here are the top takeaways from Defending Against Today’s Cyber Threats: Former Government Leaders Weigh In:

Nation-state threat actors each bring different motivations and tactics, and the threat they pose has only grown. 

The “Big Four” countries looming large in the current threat landscape are Russia, Iran, North Korea and China, Greene said. Russia is focused on the Ukraine war and espionage. “Embarrassment campaigns are one of their specialties,” he said. Iran may be less sophisticated, but they’re utilizing new technologies. “It doesn’t take a lot of sophistication to have a big impact, particularly if you understand your adversary,” he stated, noting that Iran is very motivated due to the Middle East conflict and has already attacked critical U.S. water infrastructure. In contrast, North Korea focuses on generating money through theft, ransomware and stealing cryptocurrency. And China is extremely skilled and has become much stealthier. “They’re the generational cyber adversary we’re going to face,” he said of China. Watch at 4:06

The emergence of autonomous AI is reshaping and accelerating the cyber threat landscape.

“We’ve seen the first wave of truly autonomous AI attacks, with the AI agent acting on its own,” Greene said. The big public warning shot was the OpenAI Hugging Face incident that made the news this past summer, he explained, adding that he covered it on his Substack, Cyber Shorthanded. In this incident, OpenAI tasked one of its new models with solving a cybersecurity test. “Instead of taking the test, the AI decided it was going to go out and steal the answer key,” he said, noting that the AI broke out of a sealed controlled testing area and hacked a company to achieve its goal. Companies should also be considering how they’re going to incorporate AI into their businesses, as well as educating employees and putting AI governance policies in place, he said, pointing to one study that found 78% of employees are using bring-your-own AI tools not approved by their employers. Watch at 8:22

Using concise, clear and business-relevant communications can help overcome the fear and misunderstanding around cybersecurity.

To address these issues, Tisdale stated that it’s important to focus on communicating about cybersecurity in a clear, audience-focused way: “Fear will get anyone’s attention, but what you need is a clear next step to act on.” Small organizations have limited time, money and staff, and they often assume that most cyber help is going to be too advanced or not tailored for them,” she said. Leaders may think their organization is too small to become a target of a nation state, but that’s not the case, Tisdale said. “Attackers are picking the easiest target, not the biggest target,” she stated. In addition to thinking they’re not large enough, some business leaders dismiss cybersecurity as an IT problem, she noted. “They might say it’s not my issue, then cybersecurity gets handed off and it never becomes a business decision,” she stressed. Watch at 14:03

Preparation, resilience and practicing realistic incident response plans are key for cybersecurity.

Resilience is the only complete defense to a cyberattack, Greene said, adding that he urges businesses to think about what they need to be able to keep running on their “worst digital day.” That means leading with the business when making plans for a cyber incident, Tisdale stated. “The goal is to stay open, make sure people get paid and keep customers,” she said. If you have an exercised resilience plan, you will recover more quickly, lose less data and spend less money during a response, Greene said. “The exercise piece is key,” he added, noting that many organizations, including public companies, startups, medium-sized companies and utilities, have plans that they don’t read until an incident happens. An effective tabletop exercise, he said, must be realistic and limited in scope, with clear follow-through: Draft basic communications templates in advance, set up dedicated response channels before you need them and know who you’re calling first. Watch at 12:20

Starting small can empower businesses of all sizes to get and stay cyber-ready.

“The hardest thing is knowing where to start,” Tisdale said. The good news is that you don’t need to do everything at once, she added, noting that she recommends starting with one action, one person to own that action and a follow-up date. This approach helps you build up muscle memory and score one win, she explained. Tisdale’s broader advice for getting people to actually act on cyber fundamentals comes down to a simple directive: Just say yes. When your phone prompts you to turn on multifactor authentication or suggests a stronger password, say yes. She recommended password managers, specifically the one already built into your phone. “There is no password that you can come up with that beats what that tool generates, and starting there builds the muscle memory that carries over into business systems.” Watch at 22:30

There is an array of free cybersecurity tools that can help individuals and organizations get started, Tisdale said, pointing to resources offered by Travelers. 

These include: five cybersecurity readiness practices to help prevent evolving threats, tips on cybersecurity training for employees and a guide to business continuity and business risk assessment. You can also download the most recent Travelers Cyber Threat Report to stay current on the latest threats and hand your clients these free tools today. “I don’t want anyone to think that you have to start from scratch,” she said. Watch at 23:13