Rapidly evolving and complex events in the Middle East have the potential to lead to an increase in malicious cyber activity from threat actors.
Nation-state adversaries, such as those attributed to Iran, have a documented history of using cyber operations to advance their geopolitical and strategic objectives, including attacks on financial institutions, water facilities, energy providers and other components of critical infrastructure.
The cyber impact may not be confined to organizations operating in the Middle East. Malicious cyber activity can spread quickly across the globe, affecting organizations with impacted shared digital infrastructure, cloud structures, software as a service (SaaS), as well as international supply chains.
While it is too early to know what activity may occur, the conflict is rapidly evolving, so it is prudent that all organizations take action to remain vigilant against cyber threats.
Actionable Strategies for Organizations
1. Elevate monitoring, awareness and vigilance:
- Increase monitoring of logs and alerts for suspicious activity, especially on internet-facing systems and remote access.
- Issue targeted cyber awareness guidance, informing employees of the increased threats from phishing or suspicious links, vishing or other targeted social-engineering-related attack methods and ensure that they understand cyber security best practices.
- Strengthen capacity management monitoring and improve visibility of outgoing data.
- Monitor real-time guidance and threat intelligence from respective industries, information sharing organizations and professional associations.
2. Test and refine incident response and business continuity plans:
- Conduct a tabletop exercise focused on destructive malware, distributed denial of service (DDoS) and operational disruption scenarios, including impacts on dependent third parties. This should cover both IT and OT environments.
- Confirm 24/7 contact details for IT, security, legal, communications, key vendors and your cyber insurer/broker. Maintain printed versions of these details, along with asset inventories and the business continuity plans.
3. Map and understand potentially affected dependencies and supply chains:
- Review third-party and supply chain exposures, especially vendors, facilities and partners in or reliant on the Middle East.
- Validate contractual incident notification obligations and minimum-security requirements with key suppliers and service providers.
4. Implement targeted technical hardening and mitigation measures:
- Enforce or tighten multi-factor authentication, particularly for remote access, email, admin accounts and cloud services.
- Prioritize patching and configuration review for internet facing systems (VPNs, email, web apps) and industrial control system (ICS)/programmable logic controller interfaces.
- Confirm backups are recent, tested, offline stored and protected to support recovery from destructive attacks or ransomware.
5. Review and leverage cyber insurance and external support:
- Verify 24/7 claims/incident hotlines, ensure internal teams know when and how to notify insurer(s) and pre-identify cyber panel and/or the preferred external partners (forensic accountants, legal, PR, OT specialists) you would use in a cyber incident.
- Clarify coverage for business interruption, supply chain disruptions, OT/ICS impacts, data restoration and incident response services; understand exclusions related to war and public utilities.
- Anticipate potential underwriting scrutiny related to operations in the Middle East and related supply chain risks associated with dependencies in the region and beyond.
- If an event occurs, notify your broker and carrier as soon as possible. Be sure to have written evidence of what you knew, when and how. Confirm carrier consent before making any key decisions — engaging vendors, negotiating payments and so on — and engage your legal team accordingly.
If you would like to discuss these steps in more detail, contact your Aon representative.